{ "Event": { "published": true, "date": "2021-10-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-15", "timestamp": 1634342581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f338112e-2424-47d5-8780-a4c1323f47dc", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48af035-2de0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634320474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320474, "uuid": "822ec871-d72b-4ee9-9a36-ba3699cf315b", "comment": "Malware payload (Mirai)", "value": "fee3055ab06cddc9a78a071da18a17d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320474, "uuid": "22d49373-95f2-45f7-80bb-8bdbd9861922", "comment": "Malware payload (Mirai)", "value": "007345059b6bf0f32c6cf0f2e5eb7c22d8a4869443bd334de99a652203bec5bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320474, "uuid": "ab42e361-1efd-4b6a-b228-7372b0c5b628", "comment": "Malware payload (Mirai)", "value": "cec8e7cb955dbdc876432a4ba9dfbc40ce1787aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320474, "uuid": "9d51bcd4-fb17-41f9-b50a-92f184d3c9a9", "comment": "Malware payload (Mirai)", "value": "b300f67725aeea18d0febb287c66fe0dfd6df2c32906b3ff7ae68735cb22a69f786508881aa68831476818e7aadbfd8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320474, "uuid": "a8f39809-1251-408b-b543-86e6f1cc13ce", "value": "T1BD730986BC409E20C6C50677FE2F118E33035B9DF2DE7256CD155B707B8B81B0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320474, "uuid": "0757c976-6052-4e94-aeaf-6ed2fee601e6", "value": "1536:i6nN7o8MJxqqZYH2yuKscabXMSj4J70qNde2s8z0I1iO24rmW:h7oRCqZq2a9YvIYqNYm24rmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320474, "uuid": "afe4db5a-99e5-46db-924c-f838759cace8", "value": 80528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320474, "uuid": "2dcc40ef-df9e-4b35-b7e5-59ab873f384d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320474, "uuid": "e49fe775-8660-4489-90fd-17df4e3a6c0c", "value": "fee3055ab06cddc9a78a071da18a17d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51681e7-2dbd-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634305388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305388, "uuid": "9b0e6270-148f-47bd-bf6d-bbb2a37bd223", "comment": "Malware payload (Quakbot)", "value": "863973df5c9a7a470e1bca5c58d57fea", "object_relation": "md5", "Tag": [ { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305388, "uuid": "f31eab72-4d7f-4163-ae4e-c41247b16f2d", "comment": "Malware payload (Quakbot)", "value": "024361c1adbe097b5d58454a74d1061e89f6907f16966b1667353ff516fd2abc", "object_relation": "sha256", "Tag": [ { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305388, "uuid": "98504dd8-7b42-4847-bc54-570fe46a741e", "comment": "Malware payload (Quakbot)", "value": "ce636d2f49953d37c60358d8f7af898121b7fb14", "object_relation": "sha1", "Tag": [ { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305388, "uuid": "3dcc3328-8f1d-4138-8391-052cd3a4640b", "comment": "Malware payload (Quakbot)", "value": "c938480a6d06eb43d5bea0a6febee0ed2a8da60a04b2f15a7b7b2219db25f753744d9760e4858c36935bc7ee810a33c3", "object_relation": "sha3-384", "Tag": [ { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305388, "uuid": "c2881c23-959f-420f-9c42-5721286ec67c", "value": "T138D38C427797C95BE94803398ED3D7DB3B72FC21DE22870336467B0E5E7A2A08D16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305388, "uuid": "df5f5ed1-0c56-443c-8996-9ecf91b66c52", "value": "3072:ak3hOdsylKlgxopeiBNhZFGzE+cL2kdAWc6YehWfGjtUHKGDbpmsiifnSIn0K+l9:ak3hOdsylKlgxopeiBNhZF+E+W2kdAWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634305388, "uuid": "aa5c9c00-a224-4c0a-84a4-36a9ddc09c2c", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634305388, "uuid": "98863b5f-ac61-4c63-8c0a-2fdd71dce378", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305388, "uuid": "8f780cc5-96b6-4ac2-a274-1fc73676d6ec", "value": "Claim-Copy-836825797.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed57da9-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634288950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288950, "uuid": "3e38b09b-caa7-403b-99a6-967fc5a228b7", "comment": "Malware payload (AgentTesla)", "value": "241882fe80267cfd978612a6c1313cd4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288950, "uuid": "3ed2382c-67cd-4591-8d0b-86cf566f150d", "comment": "Malware payload (AgentTesla)", "value": "0270ccbf19805f0f367437cde61674671fb089dd7349df65b7e1408ac464d1f6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288950, "uuid": "ed8fb73a-8a96-40d6-a294-93821d2f14d0", "comment": "Malware payload (AgentTesla)", "value": "6c85454aa96d5bfa6e6b327b5cd00c479d88f0a3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288950, "uuid": "af51e24e-c047-47f6-976d-e17f8007a2e2", "comment": "Malware payload (AgentTesla)", "value": "6b7bb8be4fe685a5140077024284734f290928645c999ce2c9f25a7bd3efa40e1d9eb2d5f6c8741aa93d87e1e18f759d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288950, "uuid": "a75d2cf4-99f6-458c-9f70-16f6e218cd2e", "value": "T1EFA423610BAC19FBBE9D6194C48EAE63F859CFB8DD491C983F91C07931580E29D0B39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288950, "uuid": "cef065c1-43e9-47ed-85bc-c5e722f0d383", "value": "12288:6lab4vziKnUB9q1gnG075VcWmiCKmKVt3TLQ:6lacrBUBDTNVRmiVVt3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288950, "uuid": "1cf9b3ad-a96c-4562-baf5-617d698a70f2", "value": 478410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288950, "uuid": "20ca0820-cfc7-4629-9253-f8555938de39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288950, "uuid": "89943be7-6958-421f-8dc2-3fae702e9bc6", "value": "BND28384.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a54fbd-2daa-11ec-843c-42010a9c0014", "comment": "Malware payload (Lu0Bot)", "timestamp": 1634296907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634296907, "uuid": "29049b70-0a71-4502-9b20-75b4d07a4248", "comment": "Malware payload (Lu0Bot)", "value": "79df1a99f4df898ea597ac8dd22d5f0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634296907, "uuid": "d845ca4c-3bfb-4ef4-b9de-b8ee2ea70aaa", "comment": "Malware payload (Lu0Bot)", "value": "02e4898e0a4cc85c406996e5e60274082746eb45d77a18a24eb545074a56ab3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634296907, "uuid": "9fd3b0ee-76c5-44ca-b538-16257436648b", "comment": "Malware payload (Lu0Bot)", "value": "6b743917a7df5fe642d9a4a33df686b67006e8d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634296907, "uuid": "0650b5a1-7205-4eec-8c68-431dafc42756", "comment": "Malware payload (Lu0Bot)", "value": "9a4e364c4a18da85ef65b4cec011612b0d97e249084acf71361260bb3321517fb17bd349436346250f220be5d5eb8bf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634296907, "uuid": "126f5952-bd3e-44d9-a9d1-5fcec2d4142c", "value": "T164410A9F5B928FB0C5D255BA0E91C895B77C743083FBC1730B6101F5233ACB819A0A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634296907, "uuid": "039c374b-0ffb-4a07-bfad-e8f31f12c915", "value": "6219cadacd987861e8d4e111ba332c1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634296907, "uuid": "bd0ffeaa-b1a0-4589-a8ba-b1af251435ea", "value": "48:6jY6cXJsvBxYjOxWvuwrJJsvB089xRBS:BIvA8I/dIn9xRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634296907, "uuid": "dfbe16e8-cf0d-47bd-8db7-0e1d07c5d808", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634296907, "uuid": "a2b578b9-c4f9-437a-af04-5329cf39b4ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634296907, "uuid": "1f46fa8b-c729-4e74-8f3b-acec03a54357", "value": "usfive_20211015-125218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0d94a6-2d87-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634281909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281909, "uuid": "1e693ab6-7e18-460c-b640-345c6b2254d7", "comment": "Malware payload (AgentTesla)", "value": "f88ddb88720fd2124f58bf8df6d8b2eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281909, "uuid": "28b1cd97-31dd-4da8-89d7-386f2ee6a67c", "comment": "Malware payload (AgentTesla)", "value": "02f4632c2c5fcee495ab78d491e8610c95ca809912eb36abee2d8a2ba4109e57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281909, "uuid": "7145e1df-dca0-43bc-b2c0-ccc6e0bb0756", "comment": "Malware payload (AgentTesla)", "value": "94bf59a6dade60a17ab60b629b735da6adbc671e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281909, "uuid": "eb04c2b5-46a9-4202-8ad9-01255e632b21", "comment": "Malware payload (AgentTesla)", "value": "9ca3468238c795c3a7e7c9c00a9c143e290b896655e21f1809524c86188ead2f006c0dfd06ed7d6cb1b5489b1640bf16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281909, "uuid": "396a085d-25ad-49ad-996b-fedb57c525ef", "value": "T1CA74237FD14BA9EA539E336046E0240173FFB1B2368561A831A55BC41342B767A7F22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281909, "uuid": "a4d449f1-124f-4637-b334-e4d82b49091c", "value": "6144:KtlKUl1V/nTV94eUF8Lrc8Kojt6MI2ovSvFoMUHTNBXA8jRG1X55BkjdojEe4uvn:KtlKegzJBKgatoLBveXLBkjdojYuvs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281909, "uuid": "88ab80ee-e193-4b79-b212-abbe4a5e800a", "value": 368582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281909, "uuid": "e9813caf-5418-4eef-95b7-d1f4a2ba1602", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281909, "uuid": "0b0b969f-1fa6-432b-8885-c52a159922c1", "value": "sale order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018994ba-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634300309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300309, "uuid": "ead75460-5ccb-41d6-9d70-5c90b790a10f", "comment": "Malware payload (Formbook)", "value": "40e29f642a24d2aae99c6ce61e05287d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300309, "uuid": "a669b0b2-e351-4e66-9511-68d0679ce25b", "comment": "Malware payload (Formbook)", "value": "030d67d113b2193c850c7ac4d993c571b478ce61d12b892a8feecc2938775d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300309, "uuid": "28402ba9-4743-4c5c-bebe-5ce324a2abea", "comment": "Malware payload (Formbook)", "value": "08c759b93c052719fb7f09f057874d5a029a382e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300309, "uuid": "03781889-2ef6-432a-b0a6-d6296064b9a3", "comment": "Malware payload (Formbook)", "value": "9840b18f0fc087e19b3d7f318eb641e3788ca9967c1706c8d5f4a65cb8df1b142a099398510483e0586a9b6979346149", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300309, "uuid": "8093601e-6ba7-4be2-8006-c6c5047c77ea", "value": "T157B41221F383C189CEF71A34692BB4680B2BDD994EB1872E10FD36589FB3351A5853E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300309, "uuid": "ab0b701d-ad29-4374-a596-37dabeabab5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300309, "uuid": "dc1408d5-68fc-480f-a610-e5ffeb940136", "value": "12288:L0PJlc+p6/TOqZr6BlIwQNVmJKEi3updJgslkMb9rsbB:wPHR6/TO+cM7upMslkMb5sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300309, "uuid": "fe560634-55a6-4eba-94ba-2ef83725c3a5", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300309, "uuid": "c7f08564-47bb-4b30-85a3-c445574ab1d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300309, "uuid": "84806f81-292c-4862-9a72-e91bd1f1c066", "value": "Yeni Sipari\u015f #86-55113,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed17b15-2d85-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634281299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281299, "uuid": "51dde78c-738e-4c33-b79f-f5a6f5f6ee33", "comment": "Malware payload (GuLoader)", "value": "d59a7128c6b00c04fbbf7804705b8790", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281299, "uuid": "841a8de4-6a9c-495c-b333-edaceb28edd6", "comment": "Malware payload (GuLoader)", "value": "0534867f8bb342cb6927f3a049bf216b7a3f5a8fc560d7cad600941357585710", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281299, "uuid": "37b37048-88a0-46cc-b92a-9988734c6a08", "comment": "Malware payload (GuLoader)", "value": "70a1f063a31823a4b380fbb940cedae71e129c8f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281299, "uuid": "3aea53df-79ad-4dc9-867a-c4bcaddc585a", "comment": "Malware payload (GuLoader)", "value": "b4559f885f5a81b442d4f49847359636aeae74ec936ede6e5eb2ecc7049634c10df9fa02810093ed2c5d0eabe861804d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281299, "uuid": "22809e23-b948-4479-9f74-8554e2415207", "value": "T1ED530141DA23BFE75632893407CF78A7A46E7ED49F0984E3B116C2960B79945336B1D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281299, "uuid": "deb708d5-ecc4-4c04-a5d0-d0c39effafa9", "value": "1536:wE1mDYJBXmMdYc5kFEP1HjNDlGXMVKLxeM6tfMZntI3p2N6C7Crwe:wy8Y/20l1nt4StMZKuswe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281299, "uuid": "c468ec21-1637-4ce6-8f22-b62e45e26b20", "value": 65332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281299, "uuid": "cf995017-5f69-4e7d-80c1-a63b0cbc0c7c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281299, "uuid": "9457d164-080c-474e-93b7-52c82e036caf", "value": "Maj PO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ef3cfc-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634288873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288873, "uuid": "58357189-14ea-4772-ba62-c065d9d32118", "comment": "Malware payload (AgentTesla)", "value": "2c2588d2e27e09d7ce23ae9352329a97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288873, "uuid": "5744ddc3-3fa1-40e5-9343-863413a9c243", "comment": "Malware payload (AgentTesla)", "value": "05f57a596df25f644b493c9b68f3443c6b2e61afe036701444d1d8d81775a8c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288873, "uuid": "75b779cb-c4fd-46fe-ac41-d309c7948ba2", "comment": "Malware payload (AgentTesla)", "value": "1d671327aa100f191a614ac6b9bb3a165e1e44cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288873, "uuid": "53658d67-8571-46c0-b4bd-696dfbffead7", "comment": "Malware payload (AgentTesla)", "value": "b446d43fa6d1c4777e18facedd860ad1e619f4194890860e73de914dd98c24ccd483da9d58313d2fa3b6ea69d7a88080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288873, "uuid": "7cd5a8bf-61f3-408b-b08d-bda3b6eddfbd", "value": "T1DB7423983474E5285C258F7851697F4E958DB0BC7060F0D621CF5D3A9B80B6F4291FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288873, "uuid": "e0e3c62a-2562-4b69-9bb6-07c33bc368da", "value": "6144:r1Mtobn1UZzx9ha66rULcngmBR6il79Cqwp0lLVeHZ0S8FdQizH5YTmKibb4XGc5:rSabnqTH6hxLJ44LVGKRzChibbcGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288873, "uuid": "6cb617e7-3301-4825-b5ec-632266574995", "value": 363168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288873, "uuid": "36937517-3f9b-4cd9-8b0c-cd8cb8fbc4da", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288873, "uuid": "fa240743-7c41-4bcc-a8f3-eec67c59e30f", "value": "proforma invoice.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c128abd3-2d9f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634292470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634292470, "uuid": "99594378-e884-43eb-8f7f-6af11447f2be", "comment": "Malware payload (RemcosRAT)", "value": "b643ca99303a30024a56c8a590336f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634292470, "uuid": "06814690-696a-4b9e-b077-e640cdad9803", "comment": "Malware payload (RemcosRAT)", "value": "0aff281c192e919ce8a4e2091a058aa3c8fab2379dd50d7dd7ac7217af4dc838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634292470, "uuid": "fd55c67d-6fea-4f91-b660-e6721faf083d", "comment": "Malware payload (RemcosRAT)", "value": "e48c63ee1de7916fac9cefb482e2cf60528b0751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634292470, "uuid": "012c61d6-8652-4ecb-819e-b74e17a0bdd2", "comment": "Malware payload (RemcosRAT)", "value": "ad3c0c3327f91e674c7ad63e88fda54b8a75f86f7eccac3815013e1a27318de0e041b8d4051a568e6a2cc0720faf0e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634292470, "uuid": "38124b76-805a-4275-b059-a93b31afc411", "value": "T1A8F4493B2D7C443AD5697474CC1B96BD8C64BD403C28B8AB9ACA2E4DDF39B547E18087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634292470, "uuid": "0604a7b4-2983-4dfa-b1ad-63d02d08de87", "value": "f5ffba271bfb9624023f7853a89e38a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634292470, "uuid": "a7910f9d-f774-46be-9d9c-6c18bbc57c20", "value": "12288:bCF4Dqt0bJMifjeHRcPF7KyiNUZji+BfZ8fQO:eiVbJMifjQ0JiNUZj/Z8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634292470, "uuid": "94ed172b-f533-482d-a5f3-1594bb7dd3fd", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634292470, "uuid": "96ed98c7-585d-480d-bf28-2e1f6ae0ad7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634292470, "uuid": "9c2c4975-050f-468a-8f61-26eb1d7ac72b", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5311c89-2dff-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634333708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333708, "uuid": "4cdfdef1-0a21-488c-99ab-ed8f2f2eb600", "comment": "Malware payload (RedLineStealer)", "value": "1b2ce585b75dd6ac4252f0c5d81bcc47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333708, "uuid": "905a92b8-35b8-4f38-8ecf-399ea2372dd3", "comment": "Malware payload (RedLineStealer)", "value": "0b1f550d5ca453918a4677958e69fe850951123f3bc78650ba2c98fcf6683fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333708, "uuid": "d6b77573-7dcd-4945-87d4-4627fb0b26fd", "comment": "Malware payload (RedLineStealer)", "value": "9c3f77550af38239cd96c487c3c81dab612fe2be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333708, "uuid": "af53ed5d-ca87-4125-907f-cac900cc382f", "comment": "Malware payload (RedLineStealer)", "value": "6856d07e629161000b022859c024504044f85990cc75bf38e53cff40316afcc938241d5517a43ce5db7aa46f99b088ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333708, "uuid": "43e57cc5-6655-41d1-ad9c-0f6d8db1b75b", "value": "T1A064CF6079D1C473E87215310AF4DBB94ABDBD200B6059EB67D85B7E4E302C2DA31A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333708, "uuid": "308fec9e-65c3-49fc-9bb1-bfc259878fdf", "value": "d86b72152e3eb79509e879927a109d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333708, "uuid": "a23e6129-4ba3-4b42-a065-1b63af94ec3b", "value": "6144:3xPOAfsdY0LoOaYo7jaO00ssjxAOD99vINmo+I2NiJ3y:3xmGsdY0LoOaH+NB+hsly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634333708, "uuid": "ae7a1e00-61bf-4e79-9d01-7b5ab76489ad", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634333708, "uuid": "081932b5-681d-49f5-a7e4-53aa9095458c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333708, "uuid": "bf9bef9b-a22f-4336-8343-ca0cafa832a7", "value": "Valorant Skin Changer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a8aafc-2dc7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634309407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309407, "uuid": "26d3f40f-e689-4c43-862c-b7a5c30cabed", "comment": "Malware payload (Mirai)", "value": "b12d5283056eef9f19884c61a521e3dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309407, "uuid": "dabc6288-15ae-4f23-a204-138db8c5d2f5", "comment": "Malware payload (Mirai)", "value": "0c5a3f2d9f98f2c9475badf8c6cceccf8c519d25aa93c080c88c3277f9fe78b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309407, "uuid": "d4b464ce-540c-463a-b9cb-b87814456170", "comment": "Malware payload (Mirai)", "value": "68a8c0600c7136d4d7e649b97237b5388431afcd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309407, "uuid": "babc4ef3-5d15-4a5a-a3c0-0cc1da2c8436", "comment": "Malware payload (Mirai)", "value": "6a8eb2f337198b566a4f3087a5967fc3e1dde5d2ca4662b5106a6379f3653d68a7508b12688b67e6c4723ac4c25d905f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309407, "uuid": "7792e630-864e-4b51-9276-469b7182ab00", "value": "T13863F882BC80EA26CBC01677FA5F508E331567D8E1EA32469D155FA076CFC1B0D5B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309407, "uuid": "36a80998-b372-4dbc-a34a-ef96c9aff1ee", "value": "1536:7Z4ZLO7YQ010oQJ6sZ4U7jL1B8t46eTmTJ2C:7Z4k7L0K7nn84JT8J2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634309407, "uuid": "b79a8ea1-cfb4-45ad-bc66-b019193f3898", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634309407, "uuid": "ac047721-1a9d-4f37-a4a5-0109ebff679d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309407, "uuid": "8d41ccb8-838b-42a2-a867-113379fb950c", "value": "94VG.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8ba2c2-2da0-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634292976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634292976, "uuid": "d08b92a2-1f8b-4d36-b671-9e6ba1e2bbe4", "comment": "Malware payload (Formbook)", "value": "699589bd45b3cfbe2800dd137a56619d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634292976, "uuid": "cff1d3da-cc6a-4d36-ba9e-42ace52caff6", "comment": "Malware payload (Formbook)", "value": "0ce4e2f71989e9a0a4aef640b12237135e2be4b037f9cf533ca7925224e9daa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634292976, "uuid": "ae81cc95-e6ac-4b5c-9349-3f4ae3f28726", "comment": "Malware payload (Formbook)", "value": "c7a5efbb84d4c748556c38c39da5f30fddb4a1a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634292976, "uuid": "e88ddffc-7835-4d78-8534-c6c3a3e7046e", "comment": "Malware payload (Formbook)", "value": "78565409d45118c9e8bcd1e5570e2d6668f4f89b45d77f2c8360258a61792001d0b70f9af005aec08f13b641907f9efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634292976, "uuid": "9d085d1c-9a79-4f3b-b558-627be15c3a7c", "value": "T187E49459F3439C12A457567350E461E3910868C7E8988378EFB3BAA3589E3C45F8CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634292976, "uuid": "8498cb10-0ac9-475e-b1fc-51b05d5618a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634292976, "uuid": "ff741608-f0b6-4123-b849-7cc4788beeb7", "value": "12288:6vf3jRILfwanROnheVzCrZLW5xZWutzZz15SgO:kILQGz+FW5P1tzlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634292976, "uuid": "bc4607ca-75ff-438f-8d5b-068811d8c19d", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634292976, "uuid": "388d2239-9944-445e-b4b8-31d0ceb6d312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634292976, "uuid": "a6540c29-547c-49e8-92ff-e716d0054abe", "value": "GPSCHN202109144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463f4231-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634288828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288828, "uuid": "cdf03efa-7871-41fe-a7f0-110015039ed8", "comment": "Malware payload (NanoCore)", "value": "891820fd2e1bbe5f5f74cd2b77a1f6b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288828, "uuid": "e3751415-9bc9-402a-97dd-bb0eaf11e624", "comment": "Malware payload (NanoCore)", "value": "0d2e62e016f98d3213e3ac755d335795035b76f6ad9d6b5370df9ca0cced055c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288828, "uuid": "0ad44c3e-89c3-420f-87c8-67c7b04896c1", "comment": "Malware payload (NanoCore)", "value": "682a00cb848ded94d88e218f222803214a040774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288828, "uuid": "7794760d-6d10-4b02-9519-fb0024a9aa23", "comment": "Malware payload (NanoCore)", "value": "31b081238f7ea1da7d6c867d58f4aebb535be80c02efb2b4607fcd65002193d6fc1db2eb12ad9ed73bca9eda6a992e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288828, "uuid": "6e60834d-10da-44ce-a6e2-a8afffba9483", "value": "T189840220B6EE970AD8BA57B89C76A2E113B53B727F11DA1E2510235DAD3370787007B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288828, "uuid": "d744143e-90d8-4e4b-bc18-4aec974f030f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288828, "uuid": "c55f5080-5ec0-4810-8ea3-b4a8ced29283", "value": "6144:wRHGKZMkhBE45nstM7gSD3OqpNsvSUvyvdLkld9Bgxoa4zrfVqAhRLh42ZdzMovS:a2SBHnsWMS3Ns5vyVcdmo9TjpKsQ7Y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288828, "uuid": "44e5f806-5b65-4801-a3e8-3344d72daf71", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288828, "uuid": "2f4e1fca-9eb2-41eb-a67b-335642d73093", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288828, "uuid": "ec4115be-9c93-49b9-9103-091bc67cf2ca", "value": "Circular PSSB Parts Disc Credit Term (Dlr) Oct2021 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43d5cf5-2dde-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634319560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634319560, "uuid": "80df9470-6156-4bf6-82b2-6baac140cb0d", "comment": "Malware payload", "value": "2939aadefa42ec7ad1c03d0c6f73b9cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634319560, "uuid": "11ff05f9-c6d3-4198-8a1f-c2b3eab9b418", "comment": "Malware payload", "value": "119da99cd938fb3eeaa4c6e824ebaa9efb36abc66aa04ab60efb7f63350018eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634319560, "uuid": "a63f57cc-71f7-4630-9401-6901dc5a032d", "comment": "Malware payload", "value": "73172c7388b4392f5ca77178a00baa50e3df9785", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634319560, "uuid": "b304cd48-d6c0-4593-a4b8-228cf76860e6", "comment": "Malware payload", "value": "72c465d242255238afac4448ea6470dfab2c8098d4929c70d02f97493321e9ba2a95ec535d2459dab253924ee4588377", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634319560, "uuid": "5e288991-d2d2-47af-a1e4-0629334202e2", "value": "T109456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634319560, "uuid": "eda09d39-d5a0-4742-a393-7cd4adb3bb19", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4S2y1q2rJp0:745vRVJKGtSA0VWeohu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634319560, "uuid": "e532dd1b-ba5f-4732-9c5d-7cad0921c910", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634319560, "uuid": "70f9cd18-38be-439e-9dc2-514c44198e0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634319560, "uuid": "defe5c5d-55f8-432e-851b-be43ebd2f597", "value": "2939aadefa42ec7ad1c03d0c6f73b9cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3f7c0a-2de4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634321938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321938, "uuid": "b2b83ca1-1c9b-4517-adec-52683bdce967", "comment": "Malware payload (Formbook)", "value": "b50f2ee58a34c1e367450e1e2bc107bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321938, "uuid": "038f6068-f711-403a-b084-b91dafc6776c", "comment": "Malware payload (Formbook)", "value": "12fa6c4f9dc345eca587fe606caf9a5eccfcdc5456b2617ec17b1b1f1e06d24a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321938, "uuid": "53f3fcd9-d881-4d11-90cc-ebedf47334c7", "comment": "Malware payload (Formbook)", "value": "9a5bc255948f7b16eb3d109808d8d1bafd1f6070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321938, "uuid": "6afa20ff-ed86-400a-aab5-113239f66f78", "comment": "Malware payload (Formbook)", "value": "aa61bb1d780c96bbdd60850e3802cbd0303341803298494686bfb0105426e1060946692e2030cae0e782f34651ad5885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321938, "uuid": "0564ef4b-3c87-4966-8cf3-fe8b4157c390", "value": "T13144131BF5E014FBC19A1FB159B2EFBBC2B39800981676C767411E3AAC325CB9E18157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321938, "uuid": "9ea3a391-a114-43b1-beef-ef783dfeec14", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321938, "uuid": "8fb88be0-2eff-4b9f-83eb-cfc30d77a658", "value": "6144:wBlL/cO5N8NT5W5DK4ZJzUhzmAsSQ75tRb3Mmuw7mc2tRsjyaEWj0kC:CeOIrqDK4ZZUz8SQfRbPJmc2TWIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321938, "uuid": "4e9cbc48-8519-4047-adc8-917a3a208433", "value": 253770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321938, "uuid": "1553e023-ed40-4bb4-bb86-46c418c84701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321938, "uuid": "71fe0aa5-3db4-4710-82bb-13ec98229695", "value": "Nuevo Pago 15.10.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d566ce-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634280289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280289, "uuid": "82b0e748-22ae-41f0-ab79-3e971c129589", "comment": "Malware payload", "value": "3817ad8b2378d21659bba745d25733ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "encoded Dll", "colour": "#5FB088", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280289, "uuid": "d10d66cc-6e29-486a-a8bc-519f26daa59a", "comment": "Malware payload", "value": "13f97b7a9bded8da6d67bd1c22eb32b7c95646f35dcb95cb8e7e49e5a202cff9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "encoded Dll", "colour": "#5FB088", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280289, "uuid": "2e308a9c-6e1c-4046-a8b3-040a6b1d8c5b", "comment": "Malware payload", "value": "69e2b7b6e85ff68a1c6577a8730804017cdf3ed5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "encoded Dll", "colour": "#5FB088", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280289, "uuid": "7f803c2c-c80a-4393-947d-8e011079d9ec", "comment": "Malware payload", "value": "bba538f683c6c221946b4a69fe46eb95db6c30692c38a1d2aa32d450106f10172a7c45b1923a08cd5f433e43f85f8ad6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "encoded Dll", "colour": "#5FB088", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280289, "uuid": "28329183-b2b6-4880-81dc-078eca7d2ad6", "value": "T13516E10AA60BB437C9EE4AF79617A465653F53DF1605DB2F379001088E24CCCBB792E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280289, "uuid": "4edeab5f-03c9-4c66-9c76-ec9e35baadb7", "value": "49152:gemWWqogqE5BW3dCFNyG1z1GwVGZFhMLl1YBDAktp6Wb30njr3zZVv8zpdg:NLogjwNCbyEz1bY6rYBDXGrjT8z3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280289, "uuid": "70458f8c-4da3-4c30-a4b0-bdafdb974b7a", "value": 4281493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280289, "uuid": "62800934-e064-4dea-850c-4126eac917f8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280289, "uuid": "cea1a0c1-1e93-4880-a4ec-3f60274c313c", "value": "log33.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e312cc-2de8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634323880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323880, "uuid": "606681b4-ae87-45d4-971e-2c8e1cf95138", "comment": "Malware payload", "value": "e18dd20ad2db25cb9f63afd4d471b20f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323880, "uuid": "c2225bd9-9c10-488f-a02b-99067d927768", "comment": "Malware payload", "value": "14e348c5c81b59f8a56bb09bdf5768d28fbe87339a7c543d6707249ebee4f6d0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323880, "uuid": "80b26578-f2cd-4b93-8095-01ca714fae9c", "comment": "Malware payload", "value": "631a22ae8bf03d83c1b2b5aceee18660a70d7a41", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323880, "uuid": "66021370-7e3d-4519-9e77-166398b13fe2", "comment": "Malware payload", "value": "042ce82950f982cb8420361abc663afe85cc9a4cdde5d56c84adde43421ce0be69a162f2cf2ab78c90ae05086f620697", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323880, "uuid": "e52fbb82-4efc-451a-9be0-5a2e80da54f9", "value": "T16B3413C38BBC7201D07B2CB824D672DD7DAB172866D57DCE9C668524CC912660FEAE1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323880, "uuid": "9c7e65b8-0728-4662-83fe-35337fc47653", "value": "6144:9lzcqbtT5KHgSsaMWNORuVBAPw0HWNOR12ZBAbg:9lwap5YgeNORu8PGNORDbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634323880, "uuid": "84764c20-0d13-4988-b641-2f97b6d329d6", "value": 246765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634323880, "uuid": "9cf12758-573b-41e5-9bbb-53ec13551892", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323880, "uuid": "b6850549-a417-4653-aad8-834c45cb7b59", "value": "Android_Guncelleme_build_flow_flow.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ff3e92-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634280271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280271, "uuid": "e8d5e04e-cb9f-497b-a50c-232a5c1a6398", "comment": "Malware payload (NanoCore)", "value": "78c18f8780fd53cf125503ec2f0b13f4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280271, "uuid": "6f8dfbee-12cb-43f8-869e-af4545649853", "comment": "Malware payload (NanoCore)", "value": "156ef0c1cf12455baaea10a67353e2d4a560cc93a891e108204ce44657078dda", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280271, "uuid": "88bede46-ac1f-4ee6-90c8-8a474eb1a324", "comment": "Malware payload (NanoCore)", "value": "aa081b35215e17bc31727d300f1a7fb9a3a5a091", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280271, "uuid": "e9ee14a6-875e-4526-b438-c474e3a2b12b", "comment": "Malware payload (NanoCore)", "value": "fb9a85bbe4e2f75405a467c3934e04c8be913259ce64596745bca308f0eef960a58c1402ceb88373587ff2bc7c9b2779", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280271, "uuid": "4da669ce-55b1-44b4-abfa-b0f923c5f40e", "value": "T12F94C651902E3D6FF62FE81C1693E1C8386EA57AA4F0056C939EF014DE259EAED4C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280271, "uuid": "0930a78a-15c3-4293-9fe3-2f14d89d09bc", "value": "1536:iEIDDDDDDDDCMP1JsvggA1nVoYsurR0yNQpzRRam0fhXdzFz76mAg5eeVhMDw5wX:iNDDDDDDDDX4/OdzFtr5RDAw5wff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280271, "uuid": "a75d7cce-b547-40a0-ba39-5cc627a8edd6", "value": 432380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280271, "uuid": "5b79a271-d8b7-421f-b6b5-ca6355079586", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280271, "uuid": "4b75d6ed-b79b-44eb-9859-35f2938fe8ba", "value": "ORDER SPECIFICATIONS REFF 20210998.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba01b07-2dc8-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634310070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310070, "uuid": "7a2615af-fab1-4180-94e1-8fe8a03af9f6", "comment": "Malware payload (Quakbot)", "value": "7da25a472d5d7a3e5bf7adc43db9326a", "object_relation": "md5", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310070, "uuid": "3235c3b3-57c8-4ef5-9448-8e57911ece5c", "comment": "Malware payload (Quakbot)", "value": "161a19d18bc0e811244d95ba0f19bd860b411f4cac4bfa366be564f3b1b625c9", "object_relation": "sha256", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310070, "uuid": "8caf9196-3800-49d8-aa2b-ddfde997eb46", "comment": "Malware payload (Quakbot)", "value": "ae9c68378df4cf14ae149d1a8e77c14366e62859", "object_relation": "sha1", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310070, "uuid": "7dcd891f-e4af-4c59-a4a0-1c221c43536a", "comment": "Malware payload (Quakbot)", "value": "41a2b7592429c07ad780468268d18017e255c0c37a467111cb7bebdf1f40fb264e929dfe5d9ddf5ba5c086e0c5829490", "object_relation": "sha3-384", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310070, "uuid": "954d133e-961a-431f-ba82-72d240853dfe", "value": "T106159E2132A1D015D027743ACDA1E0F81B9A7C258E787C4B31D93F6FAA7E6C29E0575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310070, "uuid": "03bcecb4-acf9-4ea7-8e72-62673dc41ea7", "value": "f91de5efd2cec623341b057ce3d397d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310070, "uuid": "37b8aa45-4705-4427-a577-a484a4f703de", "value": "12288:9U7AzcO18OcZtc98uEE8aPfR6xa7jg0Ii3pSGdSJbbIclZg5i0WBRLuMdgX2rbnf:mAzcO1T0yfR6lxcYIYZDqM9n7Vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634310070, "uuid": "b815b6c0-feac-451d-88ae-acec870a7ef1", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634310070, "uuid": "9f24f6af-5749-4e24-83c1-0cd921ee74c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310070, "uuid": "3e0d0494-457f-4d17-a4ed-37973f7c4cb3", "value": "44484.7372094907.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd59fdbf-2dbb-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634304543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634304543, "uuid": "7dd7a624-5372-4a4f-a988-2a9980477432", "comment": "Malware payload (RemcosRAT)", "value": "657c6145c9193370cc2d2c0e0a2460ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634304543, "uuid": "7271fd4b-d919-4ce3-9d38-81fee03341df", "comment": "Malware payload (RemcosRAT)", "value": "16b336fb7a05c893f87e958181e474d78fdd8d5e42b321622b3f1b25e5394c43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634304543, "uuid": "f8236d0b-479d-4394-9f3b-64b096907e05", "comment": "Malware payload (RemcosRAT)", "value": "a319a91ee8cb571571901331ec310a4bc2fdbab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634304543, "uuid": "7f6b21d8-1041-4049-b0b2-d8bda69a4d3d", "comment": "Malware payload (RemcosRAT)", "value": "a21217c4f00d319ee6afea888e64859c3d32bbf59d31c5b24ec3472ae69e081dee1772ec571f8d65885d1711955c74c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634304543, "uuid": "d9e17f47-7e86-410d-8f0d-3a4861f87f11", "value": "T151E41220B3F96315D9B64B7515BF22D267B4B37F3A00D6AEB841214C9E23B534B11BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634304543, "uuid": "99090671-79f3-4cf3-8140-7b0ee43103c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634304543, "uuid": "48d4a17f-5dde-4d3b-bf21-d95aa0ccd2d5", "value": "12288:DSBV9/RhCtBKkBfWfQwyFR/ED1LwzAIdXBHVMCzMdSeZr37d:2BVVRhCt3WoDFR/EpwxHbog2r37d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634304543, "uuid": "67bd43cb-e461-43ab-b805-b233ed99a71a", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634304543, "uuid": "e093380f-b981-4a74-a57a-63ad9ed12beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634304543, "uuid": "565ad1a9-3f84-4dca-af50-be9eb5c24167", "value": "AFG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8626b1e7-2dd2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634314275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634314275, "uuid": "a6ff551d-504d-4d0b-848d-954e12ae12f0", "comment": "Malware payload (Loki)", "value": "53e0ffb4bae3b44092706ccb01cf99f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634314275, "uuid": "4c26393c-0694-41dd-a27d-b92045be3603", "comment": "Malware payload (Loki)", "value": "1707bc697b6509cc471011f836effe5815d4c553a6d07eac628dd8757141c7cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634314275, "uuid": "f56a2730-a377-4b31-a4bd-a0224c2d241f", "comment": "Malware payload (Loki)", "value": "ee0f7110864268980343c6801252264c798e1ba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634314275, "uuid": "aa4988aa-d303-46b4-ab07-8b8c1437fae7", "comment": "Malware payload (Loki)", "value": "9f01b06f36d9f10833c55d214af853fa3b55b9efc1076f8f31a1a0f6d6219e1464ff90c6444d9aa87dd9a4d912770dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634314275, "uuid": "9ebe5557-b914-48b3-9548-8698c9d0e457", "value": "T1F9341216A2E648FBF5D357F61AFBB718E17B931465211B8F83D40FBF61306CA9206142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634314275, "uuid": "f28e806d-9cf5-428c-91ec-ef856110a590", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634314275, "uuid": "1b56687e-cc10-41b1-93e8-fe2ec8802674", "value": "6144:wBlL/cZTredk/2YjU1276/AhChM3hz580vpoW3s535zx:CeKk/2292gcM3xe0p3s19x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634314275, "uuid": "ec22b13c-0c28-4191-b59c-d58010cabe7f", "value": 247836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634314275, "uuid": "355062ac-8c23-496c-b3a6-73866b6ce4da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634314275, "uuid": "9e487102-605a-4391-8df5-31d701d30d6e", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.3117.32373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6750403-2db9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634303673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303673, "uuid": "3a80a846-571e-4d8a-bdd4-7b8cfb9d02a9", "comment": "Malware payload (AgentTesla)", "value": "93ddb5a39400af4c05d19924eb1cebad", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303673, "uuid": "c225d4d1-4fc9-4bb2-995e-55f67371652c", "comment": "Malware payload (AgentTesla)", "value": "17ac64301d30a88d641e7048ec39c7619bab71e5de2b1c2686597288380731ec", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303673, "uuid": "1f6d7cf8-3e6f-47fb-84fb-5e23c3ca738f", "comment": "Malware payload (AgentTesla)", "value": "f0cf362afc17bca29c8669181dfb069edf2c9655", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303673, "uuid": "b08043fd-a0e3-44f4-88e4-6f69e6befb42", "comment": "Malware payload (AgentTesla)", "value": "4d9364c39b16e182062055381c63b158356ef348dcb8a8e8d256176d30a49eaa7ef86741e40890402a24314552002d85", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303673, "uuid": "60b9856c-4a27-4d35-a5cc-e40f6b5b4186", "value": "T149A42377D318390C7C9AAD9CD7FC2BF061524ED4B0878BDCF82E06877B1AAA4D61450A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303673, "uuid": "32d284aa-2055-401c-b2f2-2b08ebfa8d5c", "value": "12288:28C2UQgMccPuzGuE6F9LT3rCOlD+GJG9wGD0XN+nfGTTKFceHm:2X29FTWXn3W+D+uhSgNU+T2FcOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634303673, "uuid": "48b32b5c-c8d1-4de2-9ea0-f0d337c2ffe0", "value": 464801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634303673, "uuid": "92f4b7fb-84f5-4cee-88d5-0935639617df", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303673, "uuid": "771726cd-5f58-4957-846c-60478f75b946", "value": "DHL shipments.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b17587-2d99-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634289738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289738, "uuid": "09d1b963-e640-4787-926e-6dac3661e791", "comment": "Malware payload (GuLoader)", "value": "da3b405302f05a2175562bcb3e3ae266", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289738, "uuid": "10ceb933-43c5-4025-84d3-2b4f24921b7d", "comment": "Malware payload (GuLoader)", "value": "18e567faf1360f9188e37a7affa92286972f148814aa92f69b68b894e2648e5b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289738, "uuid": "2b8b73d0-8838-491c-9a10-d3c80f450bf3", "comment": "Malware payload (GuLoader)", "value": "9b85a42192c7936b08abc7ce6325f79cd3f30dbb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289738, "uuid": "44e7115b-f4f9-4653-894d-0511fb0da87e", "comment": "Malware payload (GuLoader)", "value": "5f47ec5e8fb6c93cefce6afdd36e146806cec6fa719f89949eb059a010666d0ef9a6fdf6497b4779b9c2b7bda781d9a3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289738, "uuid": "d06ae9a9-b15b-4f1c-97c8-7126b5987938", "value": "T155D3071DB6E1C964FA65BAB3DB7E4224C726FC20DC11412E23DABD090972641F639F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289738, "uuid": "aa645af8-0b3f-40eb-a7c7-b2cb9c1f6a1f", "value": "1536:0Em9UjNfLx/LREUl8dubK2/WwC6iI4uv0p7zCtCC65A828oW:0Emq1ldE1guwUuvPL2EdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634289738, "uuid": "3886bf81-c5a1-4a61-badb-04d0d10db1ef", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634289738, "uuid": "c69d5f6e-6259-4ae3-9067-a9537347a665", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289738, "uuid": "291d7463-173d-4fbe-98bc-9a25eb829793", "value": "da3b405302f05a2175562bcb3e3ae266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f669859b-2db4-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634301579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301579, "uuid": "ca76471b-74b0-46b7-a1b0-b7d527a70ac9", "comment": "Malware payload (SnakeKeylogger)", "value": "8f07e2d852af0a0cbb6fc3287a94827f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301579, "uuid": "a3b034ba-93d1-416d-9d6f-3cd540552651", "comment": "Malware payload (SnakeKeylogger)", "value": "18f6ec04884030a24eee95c95a1fc39373aaaafb658267090345c835570e4417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301579, "uuid": "2bb7243f-64c5-4dd6-be07-12b32464dbc9", "comment": "Malware payload (SnakeKeylogger)", "value": "f375b0bdd92fe1feb476d51c867afce27db4dc86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301579, "uuid": "a5ed9849-d93d-45b4-a24e-df40937f8a8b", "comment": "Malware payload (SnakeKeylogger)", "value": "fa9bd5b4e95e0e1bbe892a40720fcfdfccf1827f8c0c62ebaece7699e631dbd0b5f5ac290d0c3c83272c82168fdc2a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301579, "uuid": "d0f8fb53-3f05-420b-9687-80c34e66078f", "value": "T1B054F230B7FE8309C93A4F78287692D547B9767B7B01C7AE2485318C8E267134B526B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301579, "uuid": "37505153-92c3-433e-81f1-ee4e0b7a27ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301579, "uuid": "af6022a8-9ad1-415f-89bd-0465ddd22d95", "value": "6144:h6fBXgMkhBVEaD3rfMX0R4FUP+d6MUXvhKPAWY6ku5dZbHoM:h6BSB9D3ra0R42WYM+44r4dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301579, "uuid": "c6f2ced0-f1f2-4a2b-9ffe-5fe6811fe70e", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301579, "uuid": "01bbd7fa-33ab-4cde-aa58-cb5f68cc8581", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301579, "uuid": "30b8e276-7738-47c2-9404-fd9b8bbc3a5e", "value": "8f07e2d852af0a0cbb6fc3287a94827f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f7845a-2d89-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634282952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282952, "uuid": "898727a7-af28-4530-93bd-c5853269435c", "comment": "Malware payload (AgentTesla)", "value": "a4743f85829f12bab113bf304e4f2905", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282952, "uuid": "89800c7e-6839-49ca-805a-0e85c4c0fe63", "comment": "Malware payload (AgentTesla)", "value": "19512e9e5b4d093d9f1677753939165e85bf5d6b7bae01127520b155e6c4f287", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282952, "uuid": "df98ecc8-a4b2-4982-86bd-dbe4d4260a04", "comment": "Malware payload (AgentTesla)", "value": "d5a906f117358bc36831efc5f9a1bc4b16928554", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282952, "uuid": "7db565e5-f5bf-480d-a4dc-eb1599787cab", "comment": "Malware payload (AgentTesla)", "value": "011a82fbb4daa4de1fc6bfc25e5e35996398ce3912097d2369fc44f52e4d5dd52ec6e3416c4fc6b6ce7841ca0059254f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282952, "uuid": "273a462d-8b23-4982-b888-6dc5bb0b2cca", "value": "T1BB54231707E046E004E09416EE74E298D74E6225FFFC9B4D0347FE39ADEAA125D84DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282952, "uuid": "16b3efdb-3db6-4130-812b-0a811404da7c", "value": "6144:l3pvmPpNBYRUxh/PMmnHR0uBAGbcV5EhgHEytZ7atFH:B9G79nHR0uBAGcatR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634282952, "uuid": "5a1a71e3-e6cf-42d7-9909-d2d7143b29db", "value": 297492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634282952, "uuid": "34c477c3-4194-41b2-b860-60d23ebd9397", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282952, "uuid": "d2bb5229-3a8b-4eec-a3d1-ce0dfd7ae534", "value": "Purchase Order CTPO18542#.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a420f42c-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634288985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288985, "uuid": "694a13fc-cb63-497e-a57c-b1484a1014e9", "comment": "Malware payload (AgentTesla)", "value": "db3fe840a44737521d10bebfbac4cd71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288985, "uuid": "c6ecbdc8-7d6b-4989-8e32-0a377ba6f379", "comment": "Malware payload (AgentTesla)", "value": "1ca1ba3013a9fd0c6d2c56fd68df6952b0c64519d781debde8a59efd1b0766d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288985, "uuid": "7aba374e-853a-4979-903e-5e4762b3b024", "comment": "Malware payload (AgentTesla)", "value": "b87634c5cd6190083c149acf43c596da6f5a4023", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288985, "uuid": "eba0c324-104c-46a4-b098-b42559fe48b1", "comment": "Malware payload (AgentTesla)", "value": "9f5e47b99ca3229b12ad8753d6abc74d576ab07daae822eae1efc1314361d0e91e5f021db6ce8bec8086e0a80bf8fb84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288985, "uuid": "7f086729-9fcf-4571-a190-c114379d0e2f", "value": "T1D16423138A43AEA71DC084AABEA50647609FF109F95574BF4B627C0177BFB64AB3C4C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288985, "uuid": "b11025ef-9737-47d5-bb97-39dfcf9ad0c8", "value": "6144:p4RAWTdLpWalMydcR3WQJTUAjzX4aO48ZBoGQPDkz1lLGy/s:p27WalGR3/TDUFFoGqus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288985, "uuid": "8805268e-79cd-4126-92b6-e5fb25614ffd", "value": 308864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288985, "uuid": "f191c2f0-f273-4bc1-a93b-9e49ecf51de1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288985, "uuid": "d80a2c78-31ba-469c-8d1a-bb252f5d7633", "value": "\u7f8e\u91d1\u532f\u738728.84 (USD 40,257+5% \u7a05\uff09.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2fad21-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634280146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280146, "uuid": "1e16a8c0-42d5-4c68-b458-7bebfdefca95", "comment": "Malware payload (SnakeKeylogger)", "value": "ccaef010022ac29c8f9ed0a2731493f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280146, "uuid": "40effff6-3060-4781-9ec4-5ab7d3bc09dc", "comment": "Malware payload (SnakeKeylogger)", "value": "2012f292ee23f1e7281ada06282fd71520e9a56533196377d9cdc7e4f89ceb55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280146, "uuid": "3e947996-69c6-489e-a5a7-25ca5facae74", "comment": "Malware payload (SnakeKeylogger)", "value": "f96a421cabd4431dd4b5c3c2459486b457b5b0cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280146, "uuid": "f4041a87-3416-47d4-9ede-7d13e4a58bfd", "comment": "Malware payload (SnakeKeylogger)", "value": "7d5e5b4f49f9eedc53597814f96969efc20efca306d26f1b6f3314b378ec4a5a152e6d1319b7bf555d63ab13431a6dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280146, "uuid": "f9fc576b-eb48-4087-905b-d58643ddc4ba", "value": "T13E540222366DCD19E4BD2F3FDC9E954103FCA905BA73C72F7978B28C69663E00616189", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280146, "uuid": "5c83e4ba-ec4e-4a5a-bb5f-dfba88dd2cc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280146, "uuid": "2914645b-bfef-4faa-85ea-056fd7871509", "value": "6144:os9SbXWZsg0MdY83zFUnn3aSoeQuWibOyusrKDtsvMkhB:os9vZsgWKFUnn3jQufyIrOKUSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280146, "uuid": "3590d396-83d3-462d-91cb-90da97f05d8e", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280146, "uuid": "efd632eb-cf80-410f-baf1-986d02b8cabb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280146, "uuid": "8206de6e-0968-41e0-aa9d-fa0b6a5f4e68", "value": "ccaef010022ac29c8f9ed0a2731493f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672b2619-2d8b-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634283729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283729, "uuid": "dfcec3c7-ac07-4796-b064-26a4f55fd62f", "comment": "Malware payload (ArkeiStealer)", "value": "4dfab4889288090c9ea382ac2e589ad8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283729, "uuid": "5a543f0b-06fd-4d6e-998a-51bb66742738", "comment": "Malware payload (ArkeiStealer)", "value": "22dbf29f7b7ee63da9418ab462b83e242823b83af7d697e7cf34796febc4d884", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283729, "uuid": "ff295c63-bd0e-4c03-958c-44632ade2017", "comment": "Malware payload (ArkeiStealer)", "value": "09a1c5c406c56fc919aad7f2687fe007f51dd881", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283729, "uuid": "9285fb6c-bad8-4be1-a00d-13a84e4d0578", "comment": "Malware payload (ArkeiStealer)", "value": "e43b76ffc6555d30df0d9d3e088479a05497b12221918dcf57f87869f2654907e54ec51ce6e8079db184a25dbba66341", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283729, "uuid": "b28644a0-1727-44c3-b191-b9bb9ab594ba", "value": "T132E412313699D4B5D9774A7044A1FB996F7A7862D171024B37E8EB6F2FF62C08B20306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283729, "uuid": "b1e72fa2-cfc3-426e-9c99-89a7da73f2a7", "value": "b5be897698085ea8cfb89dc856c9bdbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283729, "uuid": "3fbe283c-b214-48b7-af77-fd3e249489aa", "value": "12288:pdG/qLDpTFCAYdwQVp03LNQuFdsCggBm5xB27Ygc9KEhR9KT/W5S:pgAVEAY3CkCt+x47YZ9hhRAT/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634283729, "uuid": "92e4e36c-383c-49df-8f0f-c257be45a21b", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634283729, "uuid": "db39824e-112a-4ab1-a047-3206ec2c0016", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283729, "uuid": "d79c5b8a-e887-4d8d-8c90-5678d6c38407", "value": "4dfab4889288090c9ea382ac2e589ad8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78309d6b-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634280322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280322, "uuid": "3f78bdaf-26e1-431f-94f0-3903749d8c85", "comment": "Malware payload (BitRAT)", "value": "9b1bfd5f5389758f5bca2a2331f2a1ca", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280322, "uuid": "166eb184-44d0-41df-9b20-fd74e59185a5", "comment": "Malware payload (BitRAT)", "value": "23c8af917aca19ca6ec3ea6ad86600ea6dab859c910e03ad9f9f471bc2267a5d", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280322, "uuid": "1190078a-8950-45b0-909d-d81a37fd8ab6", "comment": "Malware payload (BitRAT)", "value": "c70506f407acf57371ad93c20b1127fe42466e34", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280322, "uuid": "39e76641-e890-4d34-9a59-27f1f20ad992", "comment": "Malware payload (BitRAT)", "value": "1a2d80b0a7d570bb84da10e9ff98d7e9aef6722482e6bf3673ea39e97a02931215f1568076ea62cee31cf9c2b427d337", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280322, "uuid": "223bc1f1-83a4-4c26-821e-fee7c2e86113", "value": "T14E71F9F52B6C9441E64481FDDA50FDBB1AB1728BC6DB48C1309CEE6107A6A387B2B041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280322, "uuid": "08e5852f-fe5b-4a7d-b8e6-ae30ff7135a0", "value": "96:P/Adyjtijay6NAdu8qExTHAMVtG2AM+6uZ:Podj+XCTHnVY2y6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280322, "uuid": "f42df7c7-805b-4f72-a23b-643c31a7d395", "value": 3569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280322, "uuid": "5883bfe3-3f92-462c-a477-f03b403073ec", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280322, "uuid": "657c5feb-4f48-4cbb-a208-fd8028dc3ad3", "value": "Kredi Transfer.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b877aef5-2d67-11ec-843c-42010a9c0014", "comment": "Malware payload (Ratty)", "timestamp": 1634268404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634268404, "uuid": "e9421845-01a3-41eb-89b5-76c2b308c70e", "comment": "Malware payload (Ratty)", "value": "af7f264ed40f293a01ee685ee7d42daf", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634268404, "uuid": "e723879d-2a46-484e-9afb-31c8c169cd1c", "comment": "Malware payload (Ratty)", "value": "2436fa28a278522c298b3a398ddc553c96c4be29ae7b433a999ad49ac71d656c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634268404, "uuid": "e2236e64-45e0-46e8-9f75-1231518384ff", "comment": "Malware payload (Ratty)", "value": "a20caef9550c2ae144529b60598b5f58e63a409a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634268404, "uuid": "479dd20e-c88e-49fa-a553-4c0d8a124ba7", "comment": "Malware payload (Ratty)", "value": "6820b5e55a66ca7d9ac28382eaa2007f43a66b0febd049efa91852082235cc6625d5a8094556f14d4e344f4d3f5ac434", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634268404, "uuid": "a69a1e7a-1125-4d2e-b44a-cb549efa1917", "value": "T1B374E165BFD29624D677A335616D92B2BA2AC3CCD184824B59BE26158CD0C001F1BFFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634268404, "uuid": "eccb7c3b-b68f-4828-ac65-c30a60640c13", "value": "6144:JZjgS007NNMX/+DoklCAFNWClCA+jp02GmaZ/ZJSEPavLFjt+WU:JZNNNzbCClCA+jp02GmWhJnav5jU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634268404, "uuid": "f037e85f-ddf5-49c1-8faa-a8d21108438e", "value": 340743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634268404, "uuid": "736469fc-f085-46d9-ba96-661268710c2f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634268404, "uuid": "ba417eec-6d9c-4b98-b03c-8e93a114cd29", "value": "spnxsdsnu.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fdc102-2d60-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634265307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265307, "uuid": "0a26174b-235b-4018-b4eb-70600765fe22", "comment": "Malware payload (Mirai)", "value": "5db04b52f600e0c603b3eadbe1474450", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265307, "uuid": "9ace7682-9100-4ad4-891b-7b8769bcba11", "comment": "Malware payload (Mirai)", "value": "269652f5a21b38552b3d8a73ff5de62222a6efe5aa25ca2c30a85eae2dbdda36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265307, "uuid": "56087581-331a-4285-9c36-eb6e908b5976", "comment": "Malware payload (Mirai)", "value": "c8e97034682ce869d03acc15f3d53c1d246a06e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265307, "uuid": "2315444c-11a7-44cc-8efa-f9a7271338ee", "comment": "Malware payload (Mirai)", "value": "e1ae5012f108e80b4efb2723790162c973777925a05e4bed9d5082560eb30f139e95be50797f398688b3525b7519a147", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265307, "uuid": "d1d1fc13-97aa-47a8-ad5d-6cc049e0524d", "value": "T1E9640287FB21BC1FCA010BB125DB078976BCD65B82CBD091B2D4C95F35BA185B7A11C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265307, "uuid": "0f96e1d1-4ca1-4601-b406-ce90b558c2fd", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio+Q33Q:p3lOYoaja8xzx/0wsxzSinJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634265307, "uuid": "26ee70db-330d-4b52-b669-e05570a173b1", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634265307, "uuid": "43d718be-5ac2-42b3-93b3-4928ab5ae2ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265307, "uuid": "6030a33f-47ad-4846-bc6c-53f31421d5c7", "value": "5db04b52f600e0c603b3eadbe1474450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757dbc1d-2d9d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634291484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634291484, "uuid": "b56f7054-28d9-481c-a481-8153e5c1df4a", "comment": "Malware payload (AgentTesla)", "value": "d7f0a1af3f32f667fa460653083c2522", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634291484, "uuid": "1400209f-6a38-426e-9cfe-a5d2e892cd37", "comment": "Malware payload (AgentTesla)", "value": "270d46c226fbd50cef535f55fe34ad7b2b975ad3e30614154560c6c4008be27b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634291484, "uuid": "fba4b2bd-3ae9-4337-bb87-6dd48ea1879e", "comment": "Malware payload (AgentTesla)", "value": "83a4d52fabd1aebcbbd010888d77978fd5e8aa1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634291484, "uuid": "6ebfafad-04e0-4cd3-875b-5b48f656ab97", "comment": "Malware payload (AgentTesla)", "value": "b45ad264928f8df2cf9c77730835888dc056c94803230cb5573bcf59668adc5bb04e5cac72ad6f4d511ccf5429c5b76b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634291484, "uuid": "45d5953a-5ee8-41f6-a9c7-187ae6e6d697", "value": "T1E6B4502DFA052672EE9D91304D0D0AC5BFEE0B0B6E40AD9397CB15CA8F5F4E59DC4889", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634291484, "uuid": "17902137-8252-43db-8db8-9d08f4a1e9b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634291484, "uuid": "50a382da-d648-4b40-83f2-6b978e1f6111", "value": "6144:TJ/8VEuQuXwdL2H+z7OL6912XLfeSz6r4x4YOVnBPBzR4W7aevb3uslpidk:TZ8VlRwceXGM3Sz6rghOrBF4EaCJLid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634291484, "uuid": "50a49bf9-867b-47c3-b52f-bf3fba05a55e", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634291484, "uuid": "3651e2eb-fa98-478d-89b5-93c25b71c9ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634291484, "uuid": "bae76d0a-3756-4c51-bc95-e6b4531fb761", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.28791.13601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7b3617-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1634280274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280274, "uuid": "a21ed0ff-1fcb-4b20-aae9-0c96dc503299", "comment": "Malware payload (XpertRAT)", "value": "115cb391afa5ed68f040ec69b00c84c1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280274, "uuid": "3ca9bc94-fffa-4b39-b169-8e265cdf740a", "comment": "Malware payload (XpertRAT)", "value": "2716bdd86f5e2a5364c1dd061a36270bf8eade4838e0e0e08677093bc0b8d910", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280274, "uuid": "d0c2aee0-c1e3-4758-a68a-f6b40ec9cfa0", "comment": "Malware payload (XpertRAT)", "value": "319cea32abbb8ef0a55fff174dafdea4d3a7b0c7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280274, "uuid": "ad42becd-550a-4226-8eaa-276bed3ac98a", "comment": "Malware payload (XpertRAT)", "value": "6fdbc128ecff8b465ebf9feb64268001643108e10055e89fafaf32d9c855654b66f476af00a436fb990645229e702b66", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280274, "uuid": "65f9f37a-1969-477f-ab96-ae18e4af4910", "value": "T17394C651912E3D2FF62FE81C1693E1C8386EA57AA4F0056C939EF014DE259EAED4C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280274, "uuid": "5b503800-c478-456c-bbb6-eca3ae1cc914", "value": "1536:iAIDDDDDDDDCMP1JsvggA1nVoYsurR0yNQpzRRam0fhXdzFz76mAg5eeVhMDw5wX:ipDDDDDDDDX4/OdzFtr5RDAw5wff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280274, "uuid": "58aa11f9-42b1-4631-b138-4c4ffd47fe6a", "value": 432380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280274, "uuid": "b57d066f-4c3a-49e1-8511-197451493a9d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280274, "uuid": "d2ed3593-782f-4112-9ab0-99639bd6d87f", "value": "REQ PO_0092546 FOR PI.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0157d79e-2de3-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634321354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321354, "uuid": "85f0b07b-ed66-4593-a008-f20bd8bd4c14", "comment": "Malware payload (Metamorfo)", "value": "bc6a3dea762ea9a49a43849be11141e8", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321354, "uuid": "7e5cb747-fbb4-4ee1-a014-2ab30eaf566a", "comment": "Malware payload (Metamorfo)", "value": "273a1316bc483a22b5e935b4ebd419bf58e850af29a5c9435f22876ff00c119f", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321354, "uuid": "59cb6a09-389c-4a2f-a571-14962235abd3", "comment": "Malware payload (Metamorfo)", "value": "8a2680eb0b06edba8f9870cdcfed47fd2df3f50e", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321354, "uuid": "24641f7e-8251-4268-8189-97bbf58442b3", "comment": "Malware payload (Metamorfo)", "value": "76d27f23a9453c16cd2734243c56b7c9eaf8471ffc50b70439319730d25765e7d3df1900f2cc006d729fe0b0689a93cb", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321354, "uuid": "1f55e38e-9e26-43c7-93ae-658432e45bca", "value": "T1FC41D1152EEB1715C373CE7A28FAA2468E7ABD51AD524F4E4080439B2461540ED35D6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321354, "uuid": "e2bd9e0c-44b6-4945-8f1d-e43b313f2abd", "value": "48:8+uH+M+LOnV5KSfAyD91cIXv3KaIqiHkb6NS6:8+ueFLshdD91cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321354, "uuid": "a8a8db4a-8786-46cc-aa6d-73312d49658f", "value": 2046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321354, "uuid": "89cab580-ffe3-4684-823d-dd2fea1f0d3c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321354, "uuid": "0ac6c505-5312-441d-aa8d-de92061e0b74", "value": "Curriculo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b027452-2e0d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634339597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634339597, "uuid": "7a0a2e16-1809-403f-b465-a59c5665821d", "comment": "Malware payload (Mirai)", "value": "d9cb7bfab141c1ad04b85374992187f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634339597, "uuid": "aace7873-e740-4b06-8be8-75d02114c4d8", "comment": "Malware payload (Mirai)", "value": "279772f8ca0da6b254a71bfbb3d4eb6b9b27509fae55dad087278a3565087127", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634339597, "uuid": "36781e87-3068-47e3-a76c-f23b60584363", "comment": "Malware payload (Mirai)", "value": "184c62376477902eec8aa810567233a9f72ff950", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634339597, "uuid": "1d8a1786-890f-4b7c-9672-af5320932507", "comment": "Malware payload (Mirai)", "value": "9db984bcedefda981f875cc50c3d756eb96e303d95f2efb31e207cd0943b957a88b901a828350f246a6d3ea8ce0254bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634339597, "uuid": "a50bd76c-85f0-43f7-af82-c5543621efa6", "value": "T1E633F13B6039F6F1E3A12F326445C44718A83B74D1EEB3E82995C664BB9499339F04CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634339597, "uuid": "e11f36af-35f0-42a8-a5bd-85127843e3b3", "value": "768:dtIBBJLYrgTErQDslSUJK8u2YTI09qhoZGqrB9ww4+u9q3UELTQiMDI5UQGMtekT:MBBJDTEMDslNeRqhoZGqrB9+YLENQGf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634339597, "uuid": "6a819423-0d03-4f49-a38b-a2d4fa2cd6ae", "value": 54488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634339597, "uuid": "26b73557-a390-4441-9787-ad0e1ccf4332", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634339597, "uuid": "fd6552e5-855a-4bb4-8f19-c83bdabfe3d5", "value": "d9cb7bfab141c1ad04b85374992187f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0a657f-2d9a-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634290342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290342, "uuid": "52068e77-a77d-4bb2-be58-ce2f17d19d6f", "comment": "Malware payload (DanaBot)", "value": "d9cffdf42207138b4e97df50196564fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290342, "uuid": "93159cec-3429-4a39-ac87-58a1e7ab91a1", "comment": "Malware payload (DanaBot)", "value": "27df37e6d4e820e016c55415b4c1ab5732ed402443296e2c547800eae4bf560c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290342, "uuid": "32ada5d3-41ac-48f8-bc92-6e6de76b24a4", "comment": "Malware payload (DanaBot)", "value": "cb92aadc61233e3fcb42b44a5714bdfed80a4939", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290342, "uuid": "7a89051a-2e96-409b-b835-e7e8a9297e1a", "comment": "Malware payload (DanaBot)", "value": "98edde7bdaccb42d7833a3a92de49ad74e0e8a6e5d5efa986429abbe2b921e9443ba0c8ae9fddc9f94b6963f62c0423b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290342, "uuid": "bdd20531-914c-4029-8579-89ad2ce16cac", "value": "T1885633B2A08090A2E5ED5A78D9D7E9233D87FC3165E8CE55FF33E65F4450A154A0C2F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290342, "uuid": "d3820a7e-076b-48a5-bef4-87725bf02aa2", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290342, "uuid": "65719db4-e490-4850-a0b0-6360e1ce9d88", "value": "196608:bKcJu5KE7T6htlURhGTd6DGwnYHPuDO0B05HZqvlxe:b25F7mVURhGTdaP2PKO95Hgva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634290342, "uuid": "f46488b5-84e4-422b-91d5-41afa64354c5", "value": 6326749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634290342, "uuid": "0447c132-333e-4c80-980f-0061eed2fe83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290342, "uuid": "890767bc-a9c9-444b-95be-73ddbb135871", "value": "d9cffdf42207138b4e97df50196564fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920d80e0-2d61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634265762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265762, "uuid": "a95ff0df-fdae-4437-888e-f8893053936f", "comment": "Malware payload", "value": "3e9dd3d1155cd5beaafd79609d1034fe", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265762, "uuid": "aec8ca59-d9e4-49bf-a782-f639ababbeb6", "comment": "Malware payload", "value": "27fbe9e9d39f10ba7062b1a8ce84f4fae082ed0539025e885c9972ee6163a734", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265762, "uuid": "98984572-a398-477e-ad2b-fe44384ed283", "comment": "Malware payload", "value": "1f81491010b550caa3790f20ac540cee55472b44", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265762, "uuid": "5188dd21-a720-42ab-8949-82ef2cdb9e00", "comment": "Malware payload", "value": "5f0d1399d470eafb414f2c50912a8e535daf322889ffc343bd0f5885704e01b05586d6dcd08ecc8a32aa33c2662304e2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265762, "uuid": "cb88d989-1ac4-4f11-a2e6-9d53b6b5c50c", "value": "T19FA423251DB052B4E3E5FFF153B64334805549E76A3D6607CDA80AAD290242A33EF7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265762, "uuid": "f82ee010-ffc5-426f-b711-791329f0de1d", "value": "12288:66cSVggGDjxgXTxL61nj7NYZ6BANpCV1VaUX:NPgfUxLYnj7NYMiCV1Vaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634265762, "uuid": "d305f15c-6196-4d92-bc4a-ecee34c3f7d0", "value": 454955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634265762, "uuid": "00f93db9-c152-49aa-bfb7-0a4b887e11d5", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265762, "uuid": "8d4fefb2-76e6-4929-8e86-62e5902abd2b", "value": "kuronekoyamato.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72850df-2d96-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634288695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288695, "uuid": "abf6d1ed-7872-4b2b-81d7-4d74d5d16b9f", "comment": "Malware payload (Formbook)", "value": "caa7649ae24eafae30470a408b885c49", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288695, "uuid": "f224e48d-fad8-46a7-adb6-8a452cecdbce", "comment": "Malware payload (Formbook)", "value": "281d5d2e057a2ecca94356372c1aa859fbbcd42db008ba2be42b85586f1b39b6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288695, "uuid": "8a01618d-6197-4646-88b1-5376f69c38f6", "comment": "Malware payload (Formbook)", "value": "d73e639c9e2d8bc4bef809d2aea88e820be04b94", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288695, "uuid": "f3a67858-f707-4d8c-87e2-e8a113d50653", "comment": "Malware payload (Formbook)", "value": "704bccdb309295844e5c6369773f9d79ba4450b169163871b83822029f733fcf6ab6fc5c4801b729c8d7eec1db74a970", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288695, "uuid": "f2f87edd-b2b1-4308-b53c-85433abc4bc4", "value": "T13CA533CB142C686FD6450A36F944C2A763B0A50719CE5425828A3E5F78127BAF70FFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288695, "uuid": "cb5a53c9-121b-4ac2-b0ab-80065e30facc", "value": "49152:wk8xn0k0kr4geGeDxIYPT5vVmD8VQEZ4/UghPx2WDSqUCxL5012wqkT:w5n0dkUgeGyxIYPT5vAD8KEZ4/pDb+q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288695, "uuid": "ac930c83-8fcb-42dd-b92a-be6dcaff5586", "value": 2189766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288695, "uuid": "163a3580-be89-4210-9a79-5aa2b13bf143", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288695, "uuid": "a6111771-c5d6-45eb-b151-21ff1c97972c", "value": "WPS- 3668-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb9e236-2db4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634301378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301378, "uuid": "a6c73e81-b553-441e-af8c-dd6325e9f1cf", "comment": "Malware payload (RedLineStealer)", "value": "c4312799dc3d9b762aff46626acfafbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301378, "uuid": "ab8007bd-1181-4217-8aa8-5ebac72f0f84", "comment": "Malware payload (RedLineStealer)", "value": "2c2d995db36b2f97f96fc48276e363151be9e9324d5d1e64718bafb1e0749483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301378, "uuid": "b021f140-9c7b-4fbb-939b-768fab972605", "comment": "Malware payload (RedLineStealer)", "value": "70d6d3febac219dcadf91287c2444917ded37f92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301378, "uuid": "c0802e53-ba65-4577-a9b3-dd43b3d77cf8", "comment": "Malware payload (RedLineStealer)", "value": "cbdada3193e81ef3a3e5202b1a88c0a309c1a48bb993303157de96ca34bf701b63517bb173099a5d0bd9bf3ef43f3f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301378, "uuid": "832de2b8-31ab-4e85-83d3-c367ab013631", "value": "T1ECD523919A604803E9AFA97071DDE223AA31FB955F6186FB5059F2480F677D02E3C31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301378, "uuid": "3eb9d6e9-b43e-4e81-a63c-b93aca14c212", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301378, "uuid": "3b553a55-8d4e-4730-8330-8141f62e4866", "value": "49152:XJHwCmCCilG+sAS6VYR3XwftmuoEfayEgEznmHtTxOyUkLMnUBVq2Yi:XJHwX4G+vMQUDPnmN/U2Mn8qxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301378, "uuid": "5169647d-30ed-40bd-ae78-700b12a65e88", "value": 2954456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301378, "uuid": "9a2a10a5-faf4-440a-97ad-0d128f063d89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301378, "uuid": "5343973c-4eeb-48b1-be8d-088e7b02d5be", "value": "c4312799dc3d9b762aff46626acfafbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c037e588-2d81-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634279584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279584, "uuid": "d91b8317-77dc-49b6-ab8c-bdfe33aefa1f", "comment": "Malware payload", "value": "738f78c3c139e73ca2f6713ffce31532", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279584, "uuid": "68a8c57e-8899-42fa-9d04-1ac799db4c46", "comment": "Malware payload", "value": "2cebb55cb13b049982c3d9b7931aa853b17e949c1595be43c0231467c0b6315b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279584, "uuid": "7b0c44da-686e-40a7-a41a-8f261789ae7c", "comment": "Malware payload", "value": "2100cdddb136114d57841a24c116373150894f1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279584, "uuid": "abd08bc9-fedb-4a13-888c-38fe1f008f44", "comment": "Malware payload", "value": "4662eab6179eecb7e6d047c5d80dc1ae374eb6f853f4ad5d6f026a39fb502a5011c66526b0aeec396a462051e3b8140f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279584, "uuid": "8ec09c22-bf34-481e-979f-fb3a9ef76bbf", "value": "T18D65334176D3D68ED8608D3F0E619A00D66D9D14BF7F6280893EBD4CD87BE6E67903A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279584, "uuid": "0c5d705b-e55d-49d9-872e-139e510aa72a", "value": "94e2b0572ac9e87d08b3c525a2cff4f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279584, "uuid": "88ef6396-0e0e-408c-8835-49ae5f8f1c50", "value": "24576:R4Hhg7reifeN10KFS/f2mU6q/EpAa4Ld8UrjfgEcJSFL/XN96j8NrCJWDEh:R4Bg7renv0KFmdrq/pDd8UP+SFL/v/Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279584, "uuid": "23e34696-7806-4a35-89d3-5a03c587f950", "value": 1540608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279584, "uuid": "cbbdce53-1d0c-4c6c-a746-73a0fb7e6be0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279584, "uuid": "f5ec692f-f3a5-478e-b3bb-3af74b0ed3bb", "value": "738f78c3c139e73ca2f6713ffce31532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f7d1bc-2de1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634320778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320778, "uuid": "bdb138c4-3c6e-4b0a-82bf-ae6c9684009b", "comment": "Malware payload (Mirai)", "value": "f46aa32906453b11850606b0b16ef59f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320778, "uuid": "cecf2292-0cfe-419d-a051-e492950619ce", "comment": "Malware payload (Mirai)", "value": "2dbefb1967784b348b18d3392c3c95365263990f94f4429631cad4a84ea9aa05", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320778, "uuid": "b7f361fd-993f-40f2-8a2d-ddcf71d76cad", "comment": "Malware payload (Mirai)", "value": "fcfbed9e982a09667b837987f3f3b80260359cbd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320778, "uuid": "7cc2c8ed-fda8-4138-b3f2-570ca7094eb0", "comment": "Malware payload (Mirai)", "value": "6462847661a0ce9fd424d7c7aad5f60bcfff10bae3674c754e16c5685c7b1521f7ee4fa48c86022b9414b17f69cea09e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320778, "uuid": "80b28ad3-d543-4ba3-8b43-774219b1eeff", "value": "T18D634A03AD4085FDC089E1B802BB7179C556F1BC2735B1CB6BD4BF2B3A15EA01F69949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320778, "uuid": "630d71a6-1267-4803-b156-f2f9d13daca2", "value": "1536:Tfu73WGGE0DUm8lquk507eGdkmM1baIR48/yUV:6Z10DU3lqVDCkmMBaIR4HUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320778, "uuid": "79880983-3284-4791-abf8-589460598984", "value": 68512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320778, "uuid": "e6933baf-3d62-4a3b-bdad-96c268c70b9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320778, "uuid": "eda6cef3-845e-44a2-ae89-5f10f112f854", "value": "f46aa32906453b11850606b0b16ef59f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a877b511-2d96-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634288563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288563, "uuid": "634bae1a-5092-4ddb-827c-d25ccc168b55", "comment": "Malware payload (RemcosRAT)", "value": "a8521386eacf0f858077249faa381763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288563, "uuid": "0af1f3f4-011a-422a-a6ca-04f2a1c45a3a", "comment": "Malware payload (RemcosRAT)", "value": "2df667c2a61c1cc161df7e8e1d7dcf1407a0bc30eb7eaf881c835fecfde5f086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288563, "uuid": "7b7734d4-6bfc-458b-b1cc-06e23bc2466b", "comment": "Malware payload (RemcosRAT)", "value": "337fa5730d301ca3d37288ce932a04ebc0221d93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288563, "uuid": "be826497-c1ad-47c2-89d0-5e65a4cbd4f4", "comment": "Malware payload (RemcosRAT)", "value": "45692498952381c429b60289b25db7b85e9189d0f8e6ad8f53a8dd9398f2f512995995fdb87457a635d3ddff64b08c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288563, "uuid": "43ebab39-3702-4939-8978-f91a110e636a", "value": "T1A4E49D5763C50332C46A2F764D4B7D10968E3E312BA828619DEC3D140F25FE9ADE936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288563, "uuid": "70585dbc-7c86-4a9b-ac51-d5e74f920610", "value": "12666343f95da9cc22c238274d75b6c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288563, "uuid": "1d86ff83-7e75-4338-b571-d6821021ce0a", "value": "12288:0SvSsA2JxPaLrNgLGKXhfLeoZ10VicVp7+SnqyUz:0AdLzPCrNgLfXhaoZuVTvpqyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288563, "uuid": "7fa4ae08-946b-4a66-8a56-cac547a417ea", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288563, "uuid": "81664b1d-f466-43d4-b1a2-a94e81f40112", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288563, "uuid": "495eac2b-5eec-4e4e-9d3e-ce41fa8a4e51", "value": "Oxqfxohrjqryauuonybvsdergonzrywtkp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3a5ec0-2d88-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634282451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282451, "uuid": "e6c3aa02-ebc4-4b34-b46a-49c49a01cb35", "comment": "Malware payload (AgentTesla)", "value": "d7c28b38cbbf44d3459ae1e1587050ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282451, "uuid": "bedd3e80-bf9c-44bb-a6e8-62aa1e900422", "comment": "Malware payload (AgentTesla)", "value": "2e3aeb2d7f925dbb05adf41fb17d47abc66ff3a6328aed8f2d77115900a804fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282451, "uuid": "eb96df1d-9433-425f-8b47-41501592f7a8", "comment": "Malware payload (AgentTesla)", "value": "67a55ef4e33bedf0c42e15e5e7ecaca28d973c1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282451, "uuid": "0455b80b-9695-49f6-9897-0e03554573ca", "comment": "Malware payload (AgentTesla)", "value": "6404ee5faf5d0b682b6d6136094ed85c7708717526bf6f403122538fd3be739c97922f73dd00ef1e7be155b85392be8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282451, "uuid": "905bb096-c174-48e9-a55f-d546c0df6af0", "value": "T18884012233FCA34ADA6B0F791C7A56891379B6B67B01D71E6484618D9E733134B203E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282451, "uuid": "bbe239ec-7060-4e79-a37f-622c4414497f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282451, "uuid": "38e55b91-8720-4195-9073-bbe92935f3cf", "value": "6144:QRJgMkhBdLs8GbFwTCfvPlUxFTG6p0s0JO+RyURlLLIRi/S69umKdjcIYN+/:QSBFs8wFwTg2RG6pv0JOYPSJvjcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634282451, "uuid": "ee02cf2f-176e-4d34-b732-d7098c247100", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634282451, "uuid": "f8bcb478-f91a-4326-a6d7-7d006b802150", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282451, "uuid": "d39fd70c-85ee-4bfc-8583-4da2ad450fbe", "value": "Sales_Receipt 5185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c77776-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634321036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321036, "uuid": "c34f1bdb-0b4c-4ee9-a62d-a77a560d1efa", "comment": "Malware payload (Mirai)", "value": "7ec0285435b6ff1a7bab5ad1ee163dcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321036, "uuid": "9fb75616-14ca-4585-bf9f-2365176fcf74", "comment": "Malware payload (Mirai)", "value": "2f016c4efb701d8477f0a81bbd9bbabd2cd32af66b71a2b53cf7568f3c4f2265", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321036, "uuid": "38f18493-69cc-4c67-ba27-b2df5bade935", "comment": "Malware payload (Mirai)", "value": "1fee814d185c03b76999fc6fb93b1c8c4e2a4cd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321036, "uuid": "813638f1-9274-45fe-abb0-01f3bcf0e2d6", "comment": "Malware payload (Mirai)", "value": "55f3c261fd76f62dadabbebea196fc7135e17b1618639edf02d686fc99289cd583e38cbe077b144803b7d1d5b1785793", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321036, "uuid": "f1fc939c-58be-4c2f-90d4-351c99852c85", "value": "T1F5634B46EAD7F9F0CD450AB8205BAF75C836A8333130DFEBEBD8B9179956342605225C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321036, "uuid": "0659a62b-31ae-434e-b1b2-141bae8dd28f", "value": "1536:IeAolofbYYQsBehM1XcB3xuSOUd3dgz8SbmDeG:IeyssLcBJoXbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321036, "uuid": "05e11d24-cc38-4aad-9bef-5c784ad0fae7", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321036, "uuid": "43f2fd63-5e2a-4a58-bd0f-9ac6d8b93fa8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321036, "uuid": "642c150a-3edd-4455-8440-9b9508a046d8", "value": "7ec0285435b6ff1a7bab5ad1ee163dcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ef1e17-2d5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262526, "uuid": "aab270b9-8c2e-4a99-91a4-e9face630bf0", "comment": "Malware payload (Gafgyt)", "value": "b3ca3feb91477ee922de36b93c594f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262526, "uuid": "84cfa772-3d1f-4925-bacc-36f0aa66b275", "comment": "Malware payload (Gafgyt)", "value": "2f0511c3d835ea96b08b6fd8f707778bc11a91eabb855b2098410e211b7d8f4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262526, "uuid": "0385b15b-06fa-4580-8813-18bb755523f2", "comment": "Malware payload (Gafgyt)", "value": "1bde51a15d6a21960bb1da6667d526ffad255754", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262526, "uuid": "60b999fa-b9a1-46a9-b60d-d148979a1aa1", "comment": "Malware payload (Gafgyt)", "value": "c0ee7246c1f24e263b74e3a8887c0c3feb752c8a61f677bc8e93f41b6cd593c78070293eb6a7cea4d2470ad1bb915004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262526, "uuid": "6c9390de-0638-4369-a490-21e2ff8d83f2", "value": "T1EFC39417BB618EB7D81FDE3305AA4902108DE58A12D96F6FB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262526, "uuid": "67f535a1-c3a4-4989-91a3-10b520f91bbe", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epq+DxTirmW+IFB1Df11hR/:/UyLqAmgMJM8Ec+DxurmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262526, "uuid": "ab797aa3-9ae3-457d-85ba-c06a521c328a", "value": 126043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262526, "uuid": "3f86c2c4-ba17-45ba-9fd0-1bc193381e4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262526, "uuid": "d753a14c-7f56-46ad-92e7-6f577867c904", "value": "b3ca3feb91477ee922de36b93c594f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbf7f7c-2d73-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634273409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273409, "uuid": "391720ac-ecb7-4a25-aaab-4192594e8756", "comment": "Malware payload (Mirai)", "value": "f9e2073182c57858517ee610629063aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273409, "uuid": "a5d4588c-fc83-49a0-b837-32ae7c2a4dfe", "comment": "Malware payload (Mirai)", "value": "2f0abfddc523861b66eb71838608f4a40c79eafed65e31839629a5ffffffc6c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273409, "uuid": "47643fce-1016-4d2b-a534-ab319b726314", "comment": "Malware payload (Mirai)", "value": "1b17261393142500588ac89bde96eb413fe1eb3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273409, "uuid": "2b2abd3f-d619-433a-8cb4-003a8556cdcd", "comment": "Malware payload (Mirai)", "value": "154a1e8f9879444953cbb99335add1553add4f1742f9358399108b6813fee9b0ba67832589f1cc0017262c263235a7a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634273409, "uuid": "fcf42003-a47c-4a58-8c2c-d171e78b7574", "value": "T1C7331A91B8829A12C5D4537BFA6E41CC331563A8D1EF33079D266F507BCA82F0EBB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634273409, "uuid": "92d171b8-5185-4006-a77a-40da3346ecce", "value": "768:w7Mc+v+wcWDEKmxmmEBa4OmdiC8saEbwzRgBCEVeHmYMvYPfjA/hcl3D8NRRZPNA:lcBnWDFx8sHeHbMIfU5tGlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634273409, "uuid": "7d753be4-82ab-4fb6-a7f8-91d0b5e473ce", "value": 50316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634273409, "uuid": "d4b879d0-66a4-46c5-b4c5-8bfad6c01021", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634273409, "uuid": "8636d937-dfeb-4409-9c30-a999108eb5e7", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff49695-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634280254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280254, "uuid": "64289a83-d761-4b4d-a917-c73b3e818b9b", "comment": "Malware payload", "value": "5b0c0d33684f5d4ef9386c8e7bf7f644", "object_relation": "md5", "Tag": [ { "name": "base64 encoded DLL", "colour": "#9AF819", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280254, "uuid": "94c44a87-11c9-4127-a738-da99b0f2cf2e", "comment": "Malware payload", "value": "2fcd8ffc71114f53c30fb9a91311c4f60687bf809db6c1824849cb4ac800bb53", "object_relation": "sha256", "Tag": [ { "name": "base64 encoded DLL", "colour": "#9AF819", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280254, "uuid": "e529057e-eb9f-4808-bf92-bf629f2c8a21", "comment": "Malware payload", "value": "a402070f9345860a507b11fa800e54de2de4e2a3", "object_relation": "sha1", "Tag": [ { "name": "base64 encoded DLL", "colour": "#9AF819", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280254, "uuid": "8fd94e82-9669-4713-9405-90d926c593b4", "comment": "Malware payload", "value": "b03b29c3af3e6bbaff6de5ab0229d28cfe0a48571b5953aa3fe83504ca9ebbe34b97a19e2d5b2e5e998b5e3284822e00", "object_relation": "sha3-384", "Tag": [ { "name": "base64 encoded DLL", "colour": "#9AF819", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280254, "uuid": "df4b057f-2968-4660-9535-c6e1d3f93dae", "value": "T16B643A519F884A4EA368559BE16C9E8E57F31702C5F2F2CC2B5339076C4FE1CBE1A885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280254, "uuid": "78162932-eea9-40eb-935f-8aab256825d9", "value": "6144:zG/+9BleXV0WSlQ3tKclZX5sSbscW1+GwZOs:ijM4KcXX57bscW0Ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280254, "uuid": "453888e4-332a-41f0-9c7c-c7906e2b17d6", "value": 330412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280254, "uuid": "8366b845-3442-4d92-8da4-4d0370183fcb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280254, "uuid": "3a29565b-8d8b-4763-8dcb-4e09ffa34d40", "value": "323bbceb-c642-4d50-a34b-f337220ef0cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b828a6-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634280339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280339, "uuid": "2b33e71a-261d-4c53-9727-1d8eb3b6be85", "comment": "Malware payload (Formbook)", "value": "b5193c5f8533941abbf7e6380bce3f4b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280339, "uuid": "6d0ac011-433e-4c17-8e15-6093720418ce", "comment": "Malware payload (Formbook)", "value": "33fda10a14f0add2406657ffdff178d66565e8e7d484e9b574d1dd17228700e7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280339, "uuid": "9646ade6-d77c-46e0-84b8-bca9f19bbed9", "comment": "Malware payload (Formbook)", "value": "29c97cf10619bee4e4de3b294939dcefd5d6fc7c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280339, "uuid": "d40c6ef3-7da0-40c3-894d-0694dd51d5ec", "comment": "Malware payload (Formbook)", "value": "88c6aba6a9553a4e2a5ea2433350c26e62c0cde080d02f909779617f823c8f7395504c720d2a261030fb4c612815de89", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280339, "uuid": "f30ae722-f10e-4796-bbec-fe18b4b4d9e8", "value": "T1B774CE1FECEFB391CAD530BC81EFA00598F64D975B2959B680A0BF8C91F914145AC2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280339, "uuid": "701e696a-874d-4fec-9903-eeee38c07efc", "value": "6144:wM/OW71Bf5sSRbPIjgTdiegRYJUV5uaadBnTSzriN3KIMlrOlYSWoApcnSa:D/XBf5sSdrRJUVQ/nuzrs3dYwSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280339, "uuid": "7764d55a-c1d0-422b-976c-d647dcd40028", "value": 350968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280339, "uuid": "fe82b7fb-9cab-4f6f-a5e4-37a0ff0f18d9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280339, "uuid": "cad7f810-c0fb-4303-a5c5-52158fd52d8c", "value": "OCT 15 2021 - PRINTABLE COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4966cb-2d99-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634289803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289803, "uuid": "c450bfd3-7416-430c-9b0c-007433b5ebf4", "comment": "Malware payload (Loki)", "value": "441146b5213a0dbc452c0d4b9a593960", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289803, "uuid": "fa577efb-8283-493e-8fea-692705109690", "comment": "Malware payload (Loki)", "value": "36857eb0ecb3aa41e3733cac136894823742ff36c9100cdf80a01748e1ee104f", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289803, "uuid": "e28a8c50-7f7d-4c7a-adf0-d433f223f8af", "comment": "Malware payload (Loki)", "value": "054b65b0ff8b9a24f026961030952c54c24581a6", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289803, "uuid": "1d5d3951-024b-404b-afab-2d7897eb3bf1", "comment": "Malware payload (Loki)", "value": "b5efefd94295dfb4995ba7dab6c19ac490fd1ed2911ceef4c40cdaa73f950b2142174f1675477ab61ccb65585844904d", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289803, "uuid": "2d6a9e67-65a1-4ef1-ab42-db05f9e60872", "value": "T16E24CF9037E4AD13C5182BB92166A7D51737C348BA33D34B78AC6A392F837C96640BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289803, "uuid": "07d1a876-57ba-4e3c-98da-236eabf12dba", "value": "6144:YXmnBGcuWe9iS0hYmuQ4pfKSMiShs6yy71y7:+YGcPVYvQ4pfKSMiKwyRy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634289803, "uuid": "c1166ba5-c55d-4228-acb0-994cb9916889", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634289803, "uuid": "d47f4a28-a36c-4c21-8eec-d16d483c6bed", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289803, "uuid": "6b862dfb-d111-497f-9571-cdb1851f41e5", "value": "Versanddokumente_75876245.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a910d895-2db4-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634301449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301449, "uuid": "413e5eda-38cf-41a2-b111-967fcfe420eb", "comment": "Malware payload (BitRAT)", "value": "e044878117ab697ed31740a1dbd65581", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301449, "uuid": "445b0108-5bb4-4291-a4a5-47c787a24a7c", "comment": "Malware payload (BitRAT)", "value": "375b217d1a94daf3ae58ed7d4a82432c6bfa856dea25c62dde7ed8188e734f43", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301449, "uuid": "9f2fc998-b7ed-407e-8883-0dd009c42c64", "comment": "Malware payload (BitRAT)", "value": "041beb413bb31ac609104c9eeb52a0b20dda1098", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301449, "uuid": "be5921be-57de-4344-8dca-de371040bb4a", "comment": "Malware payload (BitRAT)", "value": "075763c4cda6c4c0a83a19d5cd2e65b376665e8fb51e984b4c6c69fc155b39d24af9f9d20b0a79125e0c6ddfeb3cac38", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301449, "uuid": "9629b9cd-9f68-486b-91ac-7af92797baad", "value": "T1B016017C262E6E4CF794947CB1798EFF17A1782F45A774F7900CB2D70AA9BD05902222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301449, "uuid": "43d29cd4-4e56-4c8d-be0b-0f89aab174ca", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301449, "uuid": "4c3e6e30-e338-4cff-ac50-16705af66258", "value": "98304:XpEdtLiNZG93jfpSP1atPI/nRl+WY05grrYyLr98D7:XpETCZ6TA1oPcnpcrl/98D7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301449, "uuid": "331cfd2e-a253-4e75-9780-0228db629c4e", "value": 4324744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301449, "uuid": "d7c18882-221e-49d0-93fa-ad62ba6f0bc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301449, "uuid": "edc8a7e1-2636-4977-a60d-6251304846b7", "value": "e044878117ab697ed31740a1dbd65581.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcdd5be-2e00-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634334176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334176, "uuid": "c9c51493-5d05-449c-9dae-05e22adcfb3b", "comment": "Malware payload", "value": "e7df91ac5f161f54e3fafe18e92f528b", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334176, "uuid": "7531879f-fb09-4683-bc12-db3fee736d45", "comment": "Malware payload", "value": "39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334176, "uuid": "bd4c5218-2840-4f82-9099-a440a2697e14", "comment": "Malware payload", "value": "b441934c695c87b462cc27dbce9910bfec8b7b61", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334176, "uuid": "599b7ec5-ab77-411b-9ec8-0188a7294920", "comment": "Malware payload", "value": "6dbc9e4b9cdde30dbe61349025d25d5eceb8aa22ba755f8c8dabe466ff83ad53c81c757291ec9f71bde8938cefc4b679", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334176, "uuid": "af92a1ed-ae20-4ca8-b7b7-73268c8c70c1", "value": "T17854AF503F000CADE305F227969679E891C4AB5F3892C65568E9B69828F4DF4BCFD2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334176, "uuid": "68b643a8-63a2-4e8a-916d-4029fb0e39b3", "value": "6144:nts2XeH8QpZEy+BrVdo2p5G4nsrz5DXsFKd:+cGZE97doE5ZshDXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634334176, "uuid": "91bfe409-030a-4a6d-86a7-76a9f3aa09b3", "value": 280327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634334176, "uuid": "13f4808e-8e8b-4e39-8c83-04f426b6a29c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334176, "uuid": "782026f4-286a-4042-b81c-dfc0b69df5ae", "value": "asdfgh_.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81f1f7e-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634280402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280402, "uuid": "8b0a38c0-0f59-49fe-bf3e-733d0ac65d93", "comment": "Malware payload (Loki)", "value": "92f02cc5b7d38d7370ead53131e4f855", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280402, "uuid": "d9c35fd0-14e3-4aa0-813f-049dca64bb58", "comment": "Malware payload (Loki)", "value": "39d66bd82c289a5b91600f5959a3bf0689ab0a1142d30c096b5aebc9444f4eaf", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280402, "uuid": "e203b55f-59ca-4b1f-9a08-97240fbad139", "comment": "Malware payload (Loki)", "value": "ef05189f252cf0761ff7355c3213a078a4c5bb1c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280402, "uuid": "53f2a3be-67db-4a7d-805a-078aea7c75c1", "comment": "Malware payload (Loki)", "value": "ae3da6d2e02b3e5351e1fb13ba1ab04e6bc3b47dbfd53094c2aa591dd6161f18b0305f3464f0502ae24ee78fa7163fca", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280402, "uuid": "f1c3e7ba-a5f2-4900-ab96-dee34a9f0fe3", "value": "T12494E0607F86ED22D18B21BCBA16C57F050B6CBC8B56CC8182387E76FBB1E109647D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280402, "uuid": "6c08765a-1352-43d7-a92e-c6f2b7bef135", "value": "6144:z1CZK5WKHh5DEAhb7HYgxLbwAnr87ZB61cGIVs4AnYCHkE4Fe252pMF5uPdtWGYW:pbdhf7lfweGscGIC44YQk/e252iCkqrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280402, "uuid": "1a7d580f-d95a-4d80-8fd4-1aa553e8a4fa", "value": 426072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280402, "uuid": "f842a69f-c8cb-4187-b4bd-9aa67823ff02", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280402, "uuid": "9e980edb-0a0d-4080-981d-e4839aafa70d", "value": "VDI -Qoutation -payment D210.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c060a9-2de7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634323368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323368, "uuid": "eccbcb07-84a6-4ad1-8f4d-0ac0ad0065ca", "comment": "Malware payload", "value": "3d7d4ced171a608319381205863c8789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323368, "uuid": "46c68f25-4a73-4ca2-9a9b-7799040095fb", "comment": "Malware payload", "value": "3a0b3da99b6c5f838bd0efec535f635e2d19d16834981f727f12a4539b61766d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323368, "uuid": "bfc9de22-a006-4106-b3f8-1843e8190ac0", "comment": "Malware payload", "value": "f4ec81158f766f5fed20b936637ae6db1bcca2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323368, "uuid": "03d4cb2a-24d7-4626-bef6-f0c35965eb92", "comment": "Malware payload", "value": "ab9b283a6dbf89d39cd0884ad9c7c19b6f4535c66cb91e2c8203cb61a3034e9566165347e0861c9cdc6d519290b7a73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323368, "uuid": "fb4fc9e3-69ef-4a43-8b0c-cca824f93e04", "value": "T1146523854FF9E1D7D8E36A32AAFBAA3105356B24D5B48014A144F37613A331BDC6BF09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323368, "uuid": "818685f7-811d-47fd-94c1-fbda0e653b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323368, "uuid": "3029d49f-8fbb-4941-8025-543cce755602", "value": "24576:NKRW6x7LrxYcu2/Lth0U8a1dD0ut69+cbeIBvLURuvh//xYHegwEPs4RB+9:NKw61DzTdvdDN6tbfU+U9VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634323368, "uuid": "ce95de7b-aefb-482d-aa39-c1693f142cbe", "value": 1445376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634323368, "uuid": "79c068f8-3fba-4f70-a62e-6c9cc6e3b697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323368, "uuid": "f0294279-e667-45ca-8b87-e4df348b583b", "value": "IMG0000030_Pago_SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50283f1-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1634301013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301013, "uuid": "923b69f5-482d-4ea1-9e77-82d188f92db6", "comment": "Malware payload (STRRAT)", "value": "a48b574b2c632614531204d20a729a75", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301013, "uuid": "e631a01d-2aa4-4650-bc76-3af25b9ad8c6", "comment": "Malware payload (STRRAT)", "value": "3b2102abbf78379365b363b87ee057c4877d1cc69801a793e84ae18c086eb05e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301013, "uuid": "a0c73baa-15ec-493b-862d-9c6e67e3e2be", "comment": "Malware payload (STRRAT)", "value": "637736ea8ea29607fecd2433712fe68494d6c60e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301013, "uuid": "13fa4e72-6dc1-4707-bbeb-bfa5fa78ae46", "comment": "Malware payload (STRRAT)", "value": "ae1c334f565c7408773fec6dc772f2cabab9c2a856b511952986a88bb2574c783816ebd6290315d6f1004bcf2ef9196d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301013, "uuid": "e56be74e-9797-444f-bb36-4b4b32d0e265", "value": "T12B04028EED8AD4F4EA2F52728B4C9137D60D569DF81BA07B15FD011919B1C5D0307A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301013, "uuid": "727b7984-1e82-47f3-a030-75e14b33aff0", "value": "3072:Te7T+I56AQB0ZNOLwySHD2rGOV0sUjD6G+vhiq93pJ56jIlwy4x7VXlldZg5:Te7TTunWSr30sUqHv33pJKVt179Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301013, "uuid": "9fa6a31f-29d2-48e7-8a5f-e071b1170fde", "value": 188631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301013, "uuid": "91fe4729-867a-424c-b054-5016da56d9b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301013, "uuid": "32475b98-41df-4f0e-9700-6587d5cc2b81", "value": "PO#5432013.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b982f6d1-2dca-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634310926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310926, "uuid": "4e995852-43fc-4e25-8136-468ce4c970fe", "comment": "Malware payload (AgentTesla)", "value": "6a0b5847e9f478801ed0a8705e0b8639", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310926, "uuid": "703e9225-8dce-4310-a6c7-0950433336cb", "comment": "Malware payload (AgentTesla)", "value": "3c7d808408e9f03adf60b3f467a0e99ebaef329e2e11296a5a4968939d69b5b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310926, "uuid": "0ea3330f-988e-42d6-b1c6-a3a422c56ef9", "comment": "Malware payload (AgentTesla)", "value": "2a6c9497193ff928fd913faec2e71973f09c5e50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310926, "uuid": "000323b1-667c-4010-ac1a-a1b0e5915268", "comment": "Malware payload (AgentTesla)", "value": "c43ef244e19a26be368e4b7473a082ac5b1338e1b53f507902d5b8e15c381919b7a1b49c049d4d12d7c41664fe0de6c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310926, "uuid": "ddcb7e56-d8c8-4c38-ad13-f79c4d1e6da5", "value": "T116940271B2DA4296ECFA4B7A0C73529113B56F6B7A11D34E28A1310E5F333434B21AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310926, "uuid": "dcc7c6ef-8d92-4dc2-8c24-ff27ccd9ea73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310926, "uuid": "f49000fe-c4ec-4ff4-b62a-5f5a6338edd0", "value": "6144:JhUgMkhBx+gqHsHiua2xh2MchOs7q1E7XnrVc2rqkIZlJif8u:kSBx+gq7zhws7q+7Xa2ukIZ3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634310926, "uuid": "0774f6a9-5507-42d7-afd2-4d1db4a93881", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634310926, "uuid": "fef9655d-faf5-4cf0-b1c3-3ee24b592522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310926, "uuid": "1d7e36b1-bd52-436f-996e-63b07b38aaeb", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6160666f-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634280283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280283, "uuid": "ad86a658-5967-4337-b224-72b420eee1ea", "comment": "Malware payload (AsyncRAT)", "value": "fe350798e5ed689e7c680e0bebf0bbbd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280283, "uuid": "9b7a89dd-4c38-43b9-991d-f8cb8111ae52", "comment": "Malware payload (AsyncRAT)", "value": "3c7f0357b60497d0e3cdb06921da81bd6f7535669be7269951e137457d8b7c83", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280283, "uuid": "9cbc00e3-fdcf-48d5-ac21-e530c5d16a05", "comment": "Malware payload (AsyncRAT)", "value": "5aeb08ea42403aeaf039d2d0f1b217485f123fa0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280283, "uuid": "b4fc7a12-ec75-43df-b72c-8b5ce2177bc1", "comment": "Malware payload (AsyncRAT)", "value": "cb088228564db3dbeb67a4aa28c2d1f2ac0ede0bb6707ec640031a5ee8a650f25780ab1ee60c49f4992556b5e4e41d48", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280283, "uuid": "f45c24e7-6ecf-424a-90b2-16e9c8a39f6b", "value": "T199B43019F343AC12A557567354E451E3910868C7E8888338EFB3BAA358DE7C45B8CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280283, "uuid": "fb1d122e-84d0-492e-89b4-d14d936b46f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280283, "uuid": "d18c36cf-1c07-4c5c-8cf0-9ba1e8a980a1", "value": "6144:g2vf3w7EFBLL/nAWKzNNGgIhp3ht0j69lsLOYYRGHlFAAnbehZZQT2su:Lvf3w7ILnKGg0h6IlU1Ykxnbenw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280283, "uuid": "e9d053d5-e4ba-40db-82a6-e82443dbb013", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280283, "uuid": "495bdda5-ecfb-4919-91a2-61e46644f671", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280283, "uuid": "108aa9a6-428b-43df-94e8-bf2999319fa2", "value": "scan095330678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b69467-2d87-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634281984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281984, "uuid": "3b19c493-ec24-4f56-a335-c7b7ddf7ad92", "comment": "Malware payload (NanoCore)", "value": "3c408c5b2786ce75a25bc7f160a517a1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281984, "uuid": "2810639a-478a-456b-bb3c-f4116f81eabd", "comment": "Malware payload (NanoCore)", "value": "3d26e23308d6cc2652e04e9ef6ed2b50530399bff85b8220569580ef9e4bf01d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281984, "uuid": "6c4c91d7-b3bd-4cbe-933e-cf12e15e5035", "comment": "Malware payload (NanoCore)", "value": "0444666e63a5dde5eed7a92b11dd0b17dd7933b8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281984, "uuid": "d9621e4f-f528-48d1-bb40-732e5d2f5e3e", "comment": "Malware payload (NanoCore)", "value": "629d47969d6ecb168a7535f3e1cca28b3533f08c01cb94c1e374a05355b699ed67c838d139945af405205bb2b279eec1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281984, "uuid": "e8fd1267-d122-4829-b275-b63a2bf4d4f1", "value": "T1AF7423B813173292CE4678E57946D7C26E8FB38DD4A0A9B2A44F22C4E37BCE41D51638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281984, "uuid": "35ab7d9a-a190-4b30-9826-536e6a3b95e9", "value": "6144:K/QMAoX69IrZcIP05LGRcLGK2KybFMqmtQ55bzdCMn+nwSZoqSkytEUbd:zMX7rZcdJGRNKybFMA5nCDn3ZZGtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281984, "uuid": "55cb3658-5f9e-4f7e-befb-0f27a0885fcd", "value": 349574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281984, "uuid": "b8d05974-d5e7-41ee-9c18-d7e1bea2e339", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281984, "uuid": "87375516-0663-4d8d-93df-6e7717dc3752", "value": "Circular PSSB Parts Disc Credit Term (Dlr) Oct2021 (1).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c333bad2-2de9-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634324256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634324256, "uuid": "6ad218ea-8162-438e-9059-677c69f08f25", "comment": "Malware payload (NanoCore)", "value": "b7f79b7fef566bda7ab6aab42952bd25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634324256, "uuid": "3379b698-b160-47ed-9e54-8ac56fe0cdd1", "comment": "Malware payload (NanoCore)", "value": "3d432d19660d5b38e4b0eae0f962c4a13cdbd7988f9bde2d71808bafe6b72f7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634324256, "uuid": "98d9e1f5-852d-46a5-b77a-332d6c12f730", "comment": "Malware payload (NanoCore)", "value": "6837d4c6ed2c8fc2d6e432cac25aaccd795524c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634324256, "uuid": "86781f2f-39c7-4fb2-accd-40e42f4f1f10", "comment": "Malware payload (NanoCore)", "value": "77cd0e3cf759aabd875887e242f5b3384ed38aba96c268c0d62cead3985ba8b288e9cce0c44ab2e03caf8539b226d6f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634324256, "uuid": "8b1be4ce-a138-45a8-9cb4-f37e9b3f6247", "value": "T19BA4F192F28842A5D47E0B31A4774B8207727F6F9695D31EB088755C8DB3392072BF9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634324256, "uuid": "62490f4c-6e41-4b79-b2cb-3844bc072f10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634324256, "uuid": "48c62497-d7a8-487b-a862-c6ca15cfba42", "value": "12288:9xSBu0pACZseIccyxFoM2iDk2r5FbnVe:GBu0pACVJxZ2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634324256, "uuid": "ed6fbd19-2dc5-4dc6-8599-54631cbccc10", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634324256, "uuid": "bc7e8b4c-ba68-4c46-8734-7fb292337da6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634324256, "uuid": "b8eb3b66-31d7-4803-922d-8b2038e09cbd", "value": "Proof of payment.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59e85a4-2de0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634320448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320448, "uuid": "095b4485-346b-478f-a0ae-f49151eb91f8", "comment": "Malware payload", "value": "0ccc05a4b4fd0ef85d92b7adeb326471", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320448, "uuid": "d77c79ef-c489-434c-908a-b9253263e23a", "comment": "Malware payload", "value": "3ea2d75dbec1efa39d08d81c87b8da9643279a9401d5641d98829beab9008cbb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320448, "uuid": "01bec8e2-eaee-44eb-a7d2-1707f9158cdf", "comment": "Malware payload", "value": "8f2b6b11f2d6e8869de6cc620888e319675f8c1f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320448, "uuid": "f697ea55-225c-4eed-b920-63261ddecb75", "comment": "Malware payload", "value": "21c4011896908ea34edf241862f429f75170247c474e63f7920048256e53e7005bef54189bbc959d508a5f3d6f05522a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320448, "uuid": "df0c3742-40f7-49d1-b0e4-875d48183075", "value": "T1F1B58E22B2D18837C0777E38DD6B63699439BE501E38494B3BE45E4C6F397807A292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320448, "uuid": "63eb71dd-f873-42ef-94da-eb90a04898b3", "value": "49152:jeACCZxb8BdL6BxUgAMmvR+OTPs3ZfC+YLEA:vCCbbhxUgrm54C+YAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320448, "uuid": "4efee037-a16c-49a8-92db-5bf50b986795", "value": 2394624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320448, "uuid": "75146a22-4ceb-4316-9430-4085ea915c83", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320448, "uuid": "ecb4b298-86c1-4282-9eab-e23129a1a973", "value": "_-njdp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3f1f56-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634280141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280141, "uuid": "35bf912a-60cb-4f71-83a4-60fd2a302296", "comment": "Malware payload (SnakeKeylogger)", "value": "8eaf10ebd8fe8f8ceb920085a1f97cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280141, "uuid": "266d70b6-6f7b-4f27-9efd-28388de4b56e", "comment": "Malware payload (SnakeKeylogger)", "value": "3f641ff78a120b6e4ae7ec7142a7983854afbba7b5d7cdc452578c5297fd27d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280141, "uuid": "8624f415-377d-4a0f-bad4-2c63511ef899", "comment": "Malware payload (SnakeKeylogger)", "value": "4268fd354b60d1ae929474d90e3822d490b59f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280141, "uuid": "1cb5dfac-6522-4531-bb21-5b59796485fe", "comment": "Malware payload (SnakeKeylogger)", "value": "44574a0af94c0e431321c82dc97992b548489839626ab73712a07ac43d6de799e5400f2961e0f071dba7ee54a534dbaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280141, "uuid": "6d1258e1-9e6e-47f5-aee5-0494504890d6", "value": "T1E7731900B7489E12C7AE363E86D3590553F262D36626DB0A7FCD96F028863D72E0D79D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280141, "uuid": "9ea8ef9c-66ae-44a9-b874-a2efcbcdc281", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280141, "uuid": "06685533-fe90-4e14-9373-d121ec156bc9", "value": "1536:zo/Qbzvi0iHvfRKYCv7Hi9zCR/BUGAMN+s8q81epJOrA7kGYOs/n3lcqNd2:zo/qzvdi3RXCv7HdUrMN+081epkX5hvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280141, "uuid": "d782e79d-c080-4234-b73d-e1216d108268", "value": 80424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280141, "uuid": "65264626-59b5-4162-ae9e-43f0902c2d7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280141, "uuid": "1a8363b1-fe34-4cd3-99b1-27581d25ba31", "value": "Proforma fatura.pdf.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a5313c-2ddc-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634318484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318484, "uuid": "479cd6d9-a7c5-4524-81b7-9355d321f7d3", "comment": "Malware payload (AsyncRAT)", "value": "46e3f3684a52c6a09bbbe56333dbe1fd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318484, "uuid": "f54d5ded-05cc-4dff-9026-405315b58d6b", "comment": "Malware payload (AsyncRAT)", "value": "401c39f159ea8cadf438a9cbfaa9624ce6cf138d3522b5e684b635a362c1dd34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318484, "uuid": "0778a914-f54a-47fd-8abd-0f32ea7ddd95", "comment": "Malware payload (AsyncRAT)", "value": "2f92e1c40a44f7afb9f6bafbd13dfc783ff0a977", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318484, "uuid": "f183a5f0-5524-416f-ac7d-0f4650a3c696", "comment": "Malware payload (AsyncRAT)", "value": "6d961ee4e512300a63d9d9bd695062af2f9142b96ef716cc99f1702dda927b8dbfe56cbc7483b711e6085303b694a87c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318484, "uuid": "1a41a1c2-8382-4f6c-933a-5d0f75334b91", "value": "T168646CA12E16EC09DD2829B6CA73D4E522357E2CDCB95606708DFF1F4B3B18AC54473A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318484, "uuid": "4b8a7b52-8054-4bd5-b0ce-860cedd009e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318484, "uuid": "cd265954-74e5-4a0d-a572-d413216f4d7a", "value": "6144:DrmUICeh9IuiHfpFxZTD/THyh4l7V3XR1nPtBOVTn2:2UICerPiHfpFxZTD/THyql7V3XR1nPt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634318484, "uuid": "577b663a-5bcb-4a14-bf07-2c3d8836a8f7", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634318484, "uuid": "e53f6572-f2de-4b8d-9b24-7c5753d852e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318484, "uuid": "5b1354e4-9752-43f7-aedb-28a5e6f0d851", "value": "SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71603bc-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634289125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289125, "uuid": "c784095f-cb1b-45df-9b0b-17075323f40a", "comment": "Malware payload (AgentTesla)", "value": "e06ebc2ef46a58e9e2840683a0f67262", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289125, "uuid": "85079b0f-9be0-4ffd-a79a-3162d0f26d6f", "comment": "Malware payload (AgentTesla)", "value": "414ed373a18ff550783ab36133ed42041530bec1cd18c2da7dcb3b051488113c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289125, "uuid": "a58ae60d-3d24-4d3b-a4dd-bb9531fbe495", "comment": "Malware payload (AgentTesla)", "value": "c97c2cffd8ec24b26782fe5ecb7521e3e3d70f0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289125, "uuid": "5deebce2-b158-4caf-81d5-9652ff8e8acb", "comment": "Malware payload (AgentTesla)", "value": "7c0901b96a1d1ac074979d7514b05d49dcec4273ecfbc7cb38d64fbe8ea65e85498aafa807c88b7ff2588852d3fe845c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289125, "uuid": "df5371ff-a260-4a55-90e0-406e22f45c36", "value": "T183040279C6667DA1C38D517ADB620C9AA304275E01C1B78F39BE5D8E7F423219E2F18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289125, "uuid": "3293ad49-2fb1-4d9f-bb84-8fd6c6f901cb", "value": "3072:Mf520RF2VoN2VUtD+qEQdgsQT7vJnpCpQNqZeV/BRFpat/PNEgk3U:0EU+qEupQT7vRpCKNse3RFot/PNE3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634289125, "uuid": "63c67219-0e67-4810-9906-5a07eec05214", "value": 181785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634289125, "uuid": "b3434b77-838d-466f-88f2-a8ffcc185445", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289125, "uuid": "c35b5dca-156a-4651-b5ba-c96beb0fd163", "value": "INQUIRYPO4500060446_19H.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9146fb6c-2d7b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634276928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276928, "uuid": "3556dd5a-dd8e-4a4a-861f-2d41b1bdbc7c", "comment": "Malware payload", "value": "055db9a47d18151bc7bce54985e93150", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276928, "uuid": "748c0796-6ace-42cf-b1dd-a8241840db5e", "comment": "Malware payload", "value": "41e35586c44810891de06d96470a2a939ffabff6f3697900467e109f5f8535de", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276928, "uuid": "4680c83e-c85c-496b-97d7-4e25b4e4b277", "comment": "Malware payload", "value": "df2300b19d72d8f4e923f0d85444bb529f98ac45", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276928, "uuid": "3870853c-c373-4e6d-a224-86b671c91403", "comment": "Malware payload", "value": "e1f77fae1468f1922681b4b3578dc2c3698c9a37c05169c046869a8b1fb48b34994c46a5b1ad67c423ca0ea3b106683d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276928, "uuid": "156cb9cc-4df9-482a-902f-22971d166602", "value": "T11313E1ACCFC74E68D94B8074782FB9918155A9868281DF4B0E2CD24E1544EF1572F9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276928, "uuid": "f2f7c655-94e0-4699-830a-c0f859dd7051", "value": "768:gvjMavSssn7iBIJYfTH+niSpSvDHyCFv+nWZFFiKk/f/qtNZ/lRd+nwV9Tz3C:gv/vST7iG1BuTyCFv+OFFi3/HqfRlSwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276928, "uuid": "10db4fa6-4e5d-4875-a4e0-e857fd2b82a9", "value": 44110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276928, "uuid": "81cb671f-5a21-4af2-bb9d-96a1a0a298c1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276928, "uuid": "b9e47db1-950a-4772-8227-176eba7951e3", "value": "ORDER NVL09284.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aeab473-2d59-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262234, "uuid": "27f970bc-f520-49a4-85f2-51710fe0a16c", "comment": "Malware payload (Gafgyt)", "value": "34d7d95c0a3b9138805688e1bc586a16", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262234, "uuid": "4a24cf15-da6f-4d6c-a056-74f0fb4c2c26", "comment": "Malware payload (Gafgyt)", "value": "42f7733efb9299efd82c35a95c0de1e5cf1726e057852500851179d7eb86464e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262234, "uuid": "6410d075-f1c7-4be2-84bb-b22bc9d9429d", "comment": "Malware payload (Gafgyt)", "value": "7e8f143756dfc577305fce8678fcd2d2ace3d285", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262234, "uuid": "11b4c3c3-8e43-4f02-a4e8-1759dfe194e7", "comment": "Malware payload (Gafgyt)", "value": "db08b1adeb0574a326a93e8d69b6d3c9128416af7ad62c47fc93585edba6562e006103c0c765d5ea17c78ab5c3212d49", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262234, "uuid": "9be84944-a12f-42e0-a7c4-92907251dd5c", "value": "T110935C27B552C67BC0C752B42BDBEA615833B4BD0B32720B33E47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262234, "uuid": "f8d8fd02-93a4-4b92-96c5-319187175f5c", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3CO0QmA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKSCm/KWOXF7aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262234, "uuid": "fa56870c-e642-4f17-a8b0-040ad4f7dfc1", "value": 94680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262234, "uuid": "20b6e11b-57fa-478f-ae97-330d7c2f00a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262234, "uuid": "04773d0d-57c4-4d2f-8d65-61cb32ee1aef", "value": "34d7d95c0a3b9138805688e1bc586a16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43596002-2d70-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634272073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634272073, "uuid": "9b23550a-7276-408d-99fa-e922d69dc652", "comment": "Malware payload (Formbook)", "value": "98fc6998c7943f10c6eab32dd5f87e92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634272073, "uuid": "e66a461c-264f-4452-be11-9d526b8f6883", "comment": "Malware payload (Formbook)", "value": "4312338fa3a54a500f4ad22298d914752370161989187183b296255478f189c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634272073, "uuid": "2a733bb3-783c-414f-b2bd-a309675c5194", "comment": "Malware payload (Formbook)", "value": "2ab5119448e37c64af23c0bcd73f0694b00dc0e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634272073, "uuid": "5474626c-0968-48b9-a43f-b243bd64157f", "comment": "Malware payload (Formbook)", "value": "a95d36d4f88dd30ab88d7b256f1390b3beeb6288cfed05299689d3424986313383ae43f1f017cf91979b283b3edbc915", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634272073, "uuid": "5721cccb-0a2a-4a2f-a5e2-e4562e2f5d4b", "value": "T13F435B40B7889722D7AE35378297914513B693E3663BDB2A3FCE54E828833971E0D74D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634272073, "uuid": "5baa5b09-5d72-43ec-9c4b-41b724e83458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634272073, "uuid": "1526bf5c-5fa3-4fcb-9a12-e8d5e955e1c9", "value": "768:ZWEWY9JUu8x4ssAw7EyeiFuh84wmlCW69Psf1HBKNnp5r/A83U5K21AJJ:YLGSxnDAD8l764nctA83W1uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634272073, "uuid": "f6610b66-508b-42d8-aad2-50345e15c8a0", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634272073, "uuid": "10d39cd0-fe5f-47ca-ba72-eb1c6056e3b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634272073, "uuid": "0abbcc52-cfca-4dc0-b12a-20e10bc55ccc", "value": "98fc6998c7943f10c6eab32dd5f87e92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4761f66-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634321306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321306, "uuid": "52e32cd3-c0b2-4c36-bc86-037fa1e2faa7", "comment": "Malware payload", "value": "60be38e452d06d7ed7ef572b66352577", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321306, "uuid": "ac87fedd-d886-4633-8a1f-9e5063b9d65e", "comment": "Malware payload", "value": "43393c4b4dc45b4a736e2553cadcfae7e929b13e32b487e6e2bb316e614a647f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321306, "uuid": "e7b6c309-3637-43f4-9735-c0d8b6b50572", "comment": "Malware payload", "value": "40ad170e828ef11a591581809b78449de4f657d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321306, "uuid": "0282e0cb-b5bb-4792-98fb-6bd9df23e6b1", "comment": "Malware payload", "value": "c41a759f9472432ccdf8f65bd1e222fbcdc39a6315c86f1da2911749751f31226bb1f593233d1edb6f5ad2637cdb797d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321306, "uuid": "4ca07e3b-0708-45df-9ce6-74c9ff01d7d7", "value": "T1C8948D46F3648CB6D876913984539B5AEBB2BC11CB74E38B4360675F1F33790A93A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321306, "uuid": "ffcbf1a2-dc67-46eb-a9b8-9cd70d0d656a", "value": "68c230b8576e348426b78db150c8e808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321306, "uuid": "7bd52462-d2b3-4368-8a9a-8c9ec0887f27", "value": "6144:7LK5+tOyf0hVLdr3EyuOLvRWWt9iMU/1EoQPFWRkgj2Gr3sv7kMDQ:3KEUyf01FpNWFV/cg+gv3sIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321306, "uuid": "6b66055f-c5c2-49a4-a2e9-9c8ea98aa04d", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321306, "uuid": "31c8e8d7-f66b-495d-abd2-1ea990f1740b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321306, "uuid": "6dbe88d4-7134-4176-8f9a-faaab1902559", "value": "60be38e452d06d7ed7ef572b66352577.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1dd907-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634321293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321293, "uuid": "48470388-4688-4c8e-b74b-2f4e63cb8980", "comment": "Malware payload", "value": "f479a0b3c07a701127b732968a321645", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321293, "uuid": "1ce21356-984f-47ee-81f2-6e9fe359e452", "comment": "Malware payload", "value": "43f8a66d3f3f1ba574bc932a7bc8e5886fbeeab0b279d1dea654d7119e80a494", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321293, "uuid": "dc5d5240-c247-427c-84e0-691dac138f7a", "comment": "Malware payload", "value": "27e3ca5b22353a9ed97c4326cb26fa96cdeea36e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321293, "uuid": "1d6d5b52-cb47-42c2-b285-c6867a719780", "comment": "Malware payload", "value": "adfa69ebbfe44340c1ae502f159d76a152b77e6a1f253843a29a30aecd226a5f7e3d7de803894ca05de9f34e13ba9b29", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321293, "uuid": "1791a713-3663-4412-a3d0-54fbd71e0785", "value": "T1EBC44A06B7A440B2D076E139C9638A4AEBB1BC554B31C38F4261F77E6F737A1592A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321293, "uuid": "30382688-f552-4c2a-afee-e04ce6a3095c", "value": "8d22e25e0903f5902cac29c98bab0689", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321293, "uuid": "245e3e8c-c32f-4e59-ade8-1aced1d6b26e", "value": "12288:QdhUIE5cQ0FMXiFL+DgpdjFlisGhYEpDfRLYxL67dn:C4NeMy9+spdjFUjJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321293, "uuid": "3edb571b-d958-41c5-9413-a2df4c7daabd", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321293, "uuid": "7c58d1a7-f1d6-419d-9f92-f59f7f0fb024", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321293, "uuid": "35021d4b-4065-4d7c-a435-aad94ffd9c83", "value": "f479a0b3c07a701127b732968a321645.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7ec393-2d87-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634281993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281993, "uuid": "eb1cfe95-e49e-4e5d-a38f-772f09d7fa41", "comment": "Malware payload (NanoCore)", "value": "c977de46416ef7524584b88654542edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281993, "uuid": "071e2e47-8904-4e3c-a998-bad7f49e3a79", "comment": "Malware payload (NanoCore)", "value": "4560fe3afd5f2b78a9e9686dce317e32d5bec313315568b82c8a386297811047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281993, "uuid": "5bf0e524-6337-4cde-9f6b-4bcccefb754c", "comment": "Malware payload (NanoCore)", "value": "d1843a868c6238925a607be3676a8995d24e8d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281993, "uuid": "10786c04-88c5-4f00-a233-246e95600805", "comment": "Malware payload (NanoCore)", "value": "3561f094e57aad6ea61329c18a6c9ecfe3ecd87dda03a7f8aa5878c5f7b693d1ac10f2f7234d6c42d876e7a78f4b0bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281993, "uuid": "18103bfd-188c-40bb-9556-811bd2c949a2", "value": "T1147423986B66B36FC9876FB46841068107B6B206CC53EB6AFCCE31C88E733951556733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281993, "uuid": "f53aa2c7-257f-472f-b44d-cb51a2ce71f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281993, "uuid": "8a40f870-0268-41aa-8143-1e91816cd767", "value": "6144:Cqb/MkhBN9IrZcIPe5LcRcLGK2KebFMqitQ555zdkMnsnwSZwqSkyhXMcI3s:CnSB8rZchJcRNKebFMy5tkzn3ZxGhcc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281993, "uuid": "fc2f9621-2ebb-46cc-9f86-8abccf4c7f24", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281993, "uuid": "efd3b3b3-6371-429d-821a-096e6d36d738", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281993, "uuid": "829aac9b-edb1-4ec6-a642-dbe01b7c0204", "value": "Circular PSSB Parts Disc Credit Term (Dlr) Oct2021 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be69a55c-2db5-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634301914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301914, "uuid": "fc97f37b-a1d8-407d-95bd-dade9c2ef719", "comment": "Malware payload (Loki)", "value": "098208b00c17484d174d1a85811a8b73", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301914, "uuid": "e55d8289-292e-4ff0-8157-5dd20708d84b", "comment": "Malware payload (Loki)", "value": "45bf39b77ce8b035e919790c631a7a02ab9f39b084eba8bb655d4c75a4deb7a8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301914, "uuid": "576c9268-425f-4523-9279-00febadaba30", "comment": "Malware payload (Loki)", "value": "10999ae1620530f9c979bcb35cb81120800a8e4f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301914, "uuid": "1eb02959-f1ad-491f-baf6-110b08e99e4c", "comment": "Malware payload (Loki)", "value": "9ae0496c3c131fd8adcc156778abf9eb416e841830497494064f95fe0e836fbbe8ee2b4e16fbbf34454d4b7ac9d96bfc", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301914, "uuid": "b9b865cf-6b81-49ea-a720-8953117be42b", "value": "T12794DF43CC068E43E969C3BCFF470DB92B5E2648E59677FE05710DDE6B612220D8B52A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301914, "uuid": "e2bef443-4943-4713-b40d-09a8a84ff3de", "value": "6144:xT11uTK6qZi3rRXbbDrZEjDPcxura+rE1DjltlNW0jhQgKkk:xT3um6qwbRXbbDrKD0gra/DZX96kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301914, "uuid": "ed9d7655-77cf-4400-a0c2-95b57576375c", "value": 417868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301914, "uuid": "5764a453-2c4e-47a5-8bc9-36ff4055f812", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301914, "uuid": "7b0a18aa-329f-4949-916e-9532cb97238d", "value": "VDI-Qoutation-payment-D210.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090c4965-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634300322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300322, "uuid": "c5d6bf9e-4361-46b2-b6e2-951bc5769394", "comment": "Malware payload (Metamorfo)", "value": "d658fc04f5eb9b2f7984579d4b8d8322", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300322, "uuid": "25be6e16-e7db-4616-9197-e99c6124f901", "comment": "Malware payload (Metamorfo)", "value": "472e40357bbd9c18824abf10157d6482b8d853cdef7267b723e5d887b54e00ee", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300322, "uuid": "0f638f77-0a59-47f4-843f-1b6262323776", "comment": "Malware payload (Metamorfo)", "value": "905e42f62ce86570abd70081185c969574fe64ed", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300322, "uuid": "106e6ae1-529b-481b-9a6d-e70a1fdb0933", "comment": "Malware payload (Metamorfo)", "value": "0314fe4f2c137cfe8ea471fbd8604763d29f0597d1ddcfb450a8b7d422213bbce42c7e4a5fefc3cf38448d81fba3aff8", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300322, "uuid": "ba34a1c2-465c-45a5-a5e2-fb26db8384f4", "value": "T170447D06B3D5437AE4DB03325B8F93628A72EC788673412B1649790E2EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300322, "uuid": "2289a7db-2ea1-4553-bab2-d44444782dab", "value": "3072:vm65Lk903DaYlAYwgz88ereWn/7w05g0dMcB3RUN46ILJ9+ZB5yOanhS:vmo3DaYlAJ8er1nzTMriS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300322, "uuid": "db620c94-707c-4910-be80-0094c689c27b", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300322, "uuid": "2e6878ad-62cd-427a-891b-ad7719b7bc8b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300322, "uuid": "7296ff15-1d5d-460e-ab2f-a8c1b779e383", "value": "d658fc04f5eb9b2f7984579d4b8d8322.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cd078c-2d8e-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634284873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284873, "uuid": "7680c194-8f3d-400c-ae07-fd866b1c7a28", "comment": "Malware payload (AsyncRAT)", "value": "1a52a2c59180c610e16dfaf106225a79", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284873, "uuid": "01d8e43d-afbc-47b3-8430-fc76019247f5", "comment": "Malware payload (AsyncRAT)", "value": "473ec1feecb822ff680a584beb55ed77037e86c576b9b2b48f6041d648556610", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284873, "uuid": "42df6dfb-b6b7-4b4b-9667-370dd7c0eb82", "comment": "Malware payload (AsyncRAT)", "value": "8ab1dfde49c257cc1af6fe23a8d1f318995d1b48", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284873, "uuid": "b5e13277-f681-4659-b92b-53fa45a0cc9d", "comment": "Malware payload (AsyncRAT)", "value": "287d97eb8eb1eb8fa7683c32fbefab44ae61190f2fef65eb36840d8db7ead1494474e0821a337b4ec2cfab022b96b65b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284873, "uuid": "3065288a-96ad-4042-a4b2-0e45c159ba05", "value": "T10DB43055F343AC12A557567354E061E3A10864C7E8888338EFB3BAE358DE7845B8CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284873, "uuid": "ad071ce3-61c8-41ce-a4ac-3348599672cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284873, "uuid": "0a9b10ff-9ed7-45b3-ae70-e76bc8117f9c", "value": "6144:ak2vf34NEFBLL/nA85rgYi/LCK3+0BCDJj/f4FjqS/WrrlkUNX2z5PU:Svf34NILj58Yi/LCVnV/AFWSeHNIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284873, "uuid": "9ec692e0-f15e-4b56-add9-6a30843a94ce", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284873, "uuid": "a0607f86-4400-489e-8293-554903da1422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284873, "uuid": "7b2d82d2-2dc9-4fe8-b843-02a43adbdb0f", "value": "PO-10152021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8152ac62-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634300523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300523, "uuid": "ea546750-0ca1-4f3f-8619-32e31b1af272", "comment": "Malware payload (SnakeKeylogger)", "value": "14270af69f9b788c6c7b47965a0338b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300523, "uuid": "5ec5cf96-854a-4b75-b194-3597a880e9a7", "comment": "Malware payload (SnakeKeylogger)", "value": "48b31bf2d16152db5c71ee01e89ef136da7ef9d430d0a947c38ad1985510f668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300523, "uuid": "6426f128-2d1d-4f02-82a0-71c09dad6008", "comment": "Malware payload (SnakeKeylogger)", "value": "e27f139fa1ae267dfae88dbf7df508ac65215c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300523, "uuid": "f271db83-43dd-42af-b0e5-4cc130312421", "comment": "Malware payload (SnakeKeylogger)", "value": "7ce5f7ffa2a65df1e47714b5a3b44cc5871a0e18f2e51fa939cc3c1611ce778441993820520fb2c1212baf9f4e1bc7a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300523, "uuid": "061373f2-b396-4210-b95b-009d8def9c12", "value": "T1A5639D50F75C5952CB9F3A3770A156061376A3D3662AD75B3E8ED0E0A6C33D30A2C29A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300523, "uuid": "da046f35-2e5e-4a7b-9586-cabafc8e60ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300523, "uuid": "96360cf3-9210-49cb-b9a1-2873df248b37", "value": "1536:J3YdwZo9cKyu5cAnNpwycZS04hYASN4ZdpXitCN:J3Ydwi9T1NOycE08SNKdpXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300523, "uuid": "4fa4b688-7e23-4949-a1c2-20e3fd6ea3b8", "value": 72432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300523, "uuid": "ccc446b8-043d-4474-aeec-ec1cb36e3705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300523, "uuid": "d63b95bb-ebbc-4858-a6a9-12e0cfe441c1", "value": "YARN FAIR CONTRACT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4d205a-2d80-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634279146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279146, "uuid": "7722f807-b44b-48f2-a594-82158c4d7ba6", "comment": "Malware payload", "value": "23b14120aecb4d67d836727c729340d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279146, "uuid": "85d2f59e-401b-4afd-977a-18c2075b79f5", "comment": "Malware payload", "value": "4af123558afa33de6944a4766fc63c6ed31b661cda5a1162f89e8f1edec0b0fa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279146, "uuid": "0a3e9e9e-827c-43bd-a20d-5d0ae83b4324", "comment": "Malware payload", "value": "225be6cc75963513c72b394180a1bdb5418d9a06", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279146, "uuid": "fd38bdad-81a7-49ce-b27e-b5c45e29cd79", "comment": "Malware payload", "value": "3971232ab032749ac86f6194579b385e0ac9bf954851b53e191ac00c7eda4d1d9b02e4e8c9957c4a8bed0dee11434f99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279146, "uuid": "7281a418-d877-4cb1-bf97-21ffabfe4f3f", "value": "T1000417BE81CD883ED2A138768CEDB3556CEEBF211B62449E1896052DC85B3FE485C5C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279146, "uuid": "c0945082-6eb3-485b-af67-c9254d48bb66", "value": "dff70760df100c458b0db69ca1196715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279146, "uuid": "a6c14c18-bd8a-4a15-bee8-0047ce19d12e", "value": "1536:leKfXcBeQXiQrJY+Brkk53AgZeOGTlbR30oNdJWc6FPfwnS3c1NwGqbQMgsjinUI:gKd8OMIOGMEnYs0iIVZuqDSo7Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279146, "uuid": "66f5136e-9779-41aa-8036-1ed8bfa775f9", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279146, "uuid": "ac7d4aa5-5bf5-437d-9081-f85847b97fdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279146, "uuid": "ec285dcc-236b-4d80-a8f1-31047c7f2b7b", "value": "Spy Guildma ctfmon-dll-decoded.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39851ab-2d94-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634287830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287830, "uuid": "d1ea7454-d819-4a7c-bbd5-31cfd89ad488", "comment": "Malware payload (AgentTesla)", "value": "0e32c4f71b960fb4540a3c09133adf54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287830, "uuid": "bf9c56ca-f6c2-4012-a014-88a1ca5b4496", "comment": "Malware payload (AgentTesla)", "value": "4afaf7828c6fd5370e554ae2ccea42b7bdab6d663812e54e9681150b2db80ecf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287830, "uuid": "eeb71923-7a2a-4c5d-9d9d-53356c717c10", "comment": "Malware payload (AgentTesla)", "value": "edc011bc3f31eea55583fa17a8d99676bc39ea02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287830, "uuid": "400e82b5-97ed-4a3c-8832-4d1423ecffbc", "comment": "Malware payload (AgentTesla)", "value": "ccc9c545a5f99deb6656ecbd1fa25f53cd8b51bd55ea64e31c21167e8cf09c20c4c530e014b3198ef603f58e2de7e262", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287830, "uuid": "8e6b4a24-b49c-4095-868a-31f3ef518fdc", "value": "T1027423159C70FC407B1793DBFCACE00BA2F6A75BA13BA884C36A17910B9579FDA14913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287830, "uuid": "7a880e9a-07d2-4139-869f-d641750aae80", "value": "6144:FgM1sVu3YnB8QRAAeMeoKRWRsUj0YcY7bzg5OqxWmIRlmoYxiWUpZwTAIFU2Q4v8:Fr1EYY2WxAnUrjbzge73R2Tx62bVRDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634287830, "uuid": "9a312d43-24a4-4e0c-91b7-8d2d537e12a6", "value": 361428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634287830, "uuid": "01bcd927-42ce-42fb-b40b-771ee623eeb3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287830, "uuid": "d9b046de-6ef7-4e60-9f60-fc9dd0826e4b", "value": "Bankslip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b532e9b-2d90-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634285749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285749, "uuid": "f55fdbd5-e0f5-4e69-b950-1d965f75b098", "comment": "Malware payload (Formbook)", "value": "c62a556b445ff8cf1b9e0b038a13137e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285749, "uuid": "9ce97dcb-e855-43a8-8b15-e0a1c2736cd7", "comment": "Malware payload (Formbook)", "value": "4b3af4ebfe94ecb1730c15620080935f619b6592fad681921968f986c030c0c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285749, "uuid": "22082606-6698-49e5-9e37-8a0ae4ffb1a0", "comment": "Malware payload (Formbook)", "value": "7fefc1609a4e66d234abb47a1536857317bdb31b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285749, "uuid": "a3e01a0e-cce3-4fad-879d-2ebe98e57bee", "comment": "Malware payload (Formbook)", "value": "f9c5992cb086bc5493ae3018d5665042cf34eda1fefb72d80c03d6eeaaba937ea3bbaf10185e55e4e82828f43ff4140a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285749, "uuid": "bc6ddb6c-f5f3-46ab-8fb4-01902d9c53c2", "value": "T19274023072EE932AD9A64B7A083742C55BB536A67709E76F2464304CCE337078761BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285749, "uuid": "d5d0b16b-a4e5-4ada-942e-638b4ee2ba9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285749, "uuid": "1eea23c5-7714-4a71-bc64-99c92c867af1", "value": "6144:RGvSgMkhBRG37a+v4HASv6MqvbQfkjQS3MhZg2+UZ295OiPd9QcEJ4m1x7:FSBk3e/v6MqvGBSo+A29siF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634285749, "uuid": "c9d11ec5-1a75-41ab-91d3-2997e310f4b0", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634285749, "uuid": "4ae3c635-9826-41f6-be2a-bb0b8da11dcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285749, "uuid": "8bc3ac37-b8ae-4ac0-a650-3788e35c72ec", "value": "c62a556b445ff8cf1b9e0b038a13137e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa71583-2d86-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634281749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281749, "uuid": "82600247-2096-4130-b670-5988f631b753", "comment": "Malware payload (Metamorfo)", "value": "95c6bd0987a3a9758dcd75aa77513833", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281749, "uuid": "411924b6-87b1-453a-a97a-5e670989295a", "comment": "Malware payload (Metamorfo)", "value": "4c24db024f8513ac5eaffa4e98740c57b4f96a81dd8f1c491ee2e698042e06a0", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281749, "uuid": "80f720be-febf-4061-afff-5458999752dc", "comment": "Malware payload (Metamorfo)", "value": "fa16697d0a11071c50770af7fc08034f12b4dc8f", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281749, "uuid": "8f0060ba-2ae6-4571-9ddc-f57a9b7d9dad", "comment": "Malware payload (Metamorfo)", "value": "5f409e00c5ec3952da7b6a856dba5c8c2f30a9f99a0dcac734604f204ad2af5359fc4388183c3866008cff13f0942978", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281749, "uuid": "390fe678-059d-4160-96b9-269ea6585da9", "value": "T19C31EE092AD70726C2F3CF7A10B6A2428A76BC51ED939F5D41C48BCA1865505F834E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281749, "uuid": "5267446a-cf85-4c55-9290-55f0d04427b4", "value": "48:8PX7om/lMilsK1cGxqtpXv3KaIqiHkb6NS6:8PLjd72K1cOqttvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281749, "uuid": "b70d5701-b8ca-4206-b2a7-34bae86e8536", "value": 1554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281749, "uuid": "f61c0a38-7feb-412b-9b16-3aa4f43d063e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281749, "uuid": "c0d1d6fe-c441-4ef5-aa5e-d45a85ccae41", "value": "Foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e369900e-2d79-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634276207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276207, "uuid": "d24273ba-7960-4cb0-9670-bc8cc4e26d6a", "comment": "Malware payload (AgentTesla)", "value": "7a3de14502bb91eef86fb02c964c9e3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276207, "uuid": "1c6202a6-98e6-4588-8be0-52f1c2821da2", "comment": "Malware payload (AgentTesla)", "value": "4cc7c34dc032e79be56d8cfae117b82d741093b2078ad7a40909eca48eb599b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276207, "uuid": "a4c7686b-573d-4d9e-8e2b-0228c5eaf2c0", "comment": "Malware payload (AgentTesla)", "value": "9809755487472a1de95831e506762f8e6fb420ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276207, "uuid": "2bdaed2a-09ea-41de-b0ec-9b480810560b", "comment": "Malware payload (AgentTesla)", "value": "3afbc946d7e3a0fb60ddbd37b5bbdf94dbd858ac04398ad3569c4f2c7dc22411c7fae9de30bdc10fec10e585182c6108", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276207, "uuid": "3ca56860-4727-4302-aad6-cced48518630", "value": "T1DD45CF647F89D84AF36A98785271DF44C73E664B3713C625E9BF507A93A8B803CC2187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276207, "uuid": "eace436d-094b-44fe-b925-d3d4d28fce75", "value": "12288:It7WyuqDnhdETTtplYjEELNxMd9/rFf8OqAtPkSBY6:mqeTEFplYgKNSrFfWgP5BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276207, "uuid": "cfa54a35-fcd7-4c82-b316-d9dca69ebae0", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276207, "uuid": "9a96c710-02ef-4801-9048-19a9e57c00ca", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276207, "uuid": "04813f5a-50c1-4467-824e-63750a674d04", "value": "New Order 5225198491.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187a6955-2d90-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634285745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285745, "uuid": "4323aee8-ed29-4a6a-ae52-97efab0cc0b3", "comment": "Malware payload (Formbook)", "value": "f1d94fcc611053cd5162e70dc36fddfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285745, "uuid": "4dbc4b24-ad7c-4065-b6c6-cb612e29ac2a", "comment": "Malware payload (Formbook)", "value": "4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285745, "uuid": "c1b95efe-5848-4361-aa29-491a3b30712c", "comment": "Malware payload (Formbook)", "value": "52ecf628c9fe25f2eedca8da56aa0785958e2638", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285745, "uuid": "8e361499-7e17-4888-be37-82ec7039ce25", "comment": "Malware payload (Formbook)", "value": "78aeeba2b4bbd566d072608d2993c236bcbdf36f7947ff9421106f377607cce74f71f341f77773dc0ccc16770e13a78f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285745, "uuid": "d823a474-4219-44f3-9a05-30bae2bd4d0e", "value": "T127E4A455F343AC12A557567350E051E3A10868C7E8988339EFB3BAA358DE7C05B8CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285745, "uuid": "ae5784c7-7443-422e-b266-f97b10dc2ab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285745, "uuid": "cd2d5c39-dc10-4d53-bae7-4628f7dd4df5", "value": "12288:Mvf39PILzSNmLaryTrp6WQmJmcS32fKt:KIXSNGaryTrp6WjJu2fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634285745, "uuid": "27838f4c-a78e-4cf0-8f4a-c08a991b0284", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634285745, "uuid": "d325ee6b-cc43-4658-9b84-52c5785c8544", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285745, "uuid": "c050eb82-d359-462d-8b70-e42343dccb91", "value": "f1d94fcc611053cd5162e70dc36fddfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170995a3-2d5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262549, "uuid": "d692237a-c2df-4064-8f7a-1cd819c843a3", "comment": "Malware payload (Gafgyt)", "value": "a187d1a8428009b0a29ddb39c8ac2feb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262549, "uuid": "45f4ed6a-3568-4fc0-afea-0bc8cbb1af91", "comment": "Malware payload (Gafgyt)", "value": "4d3b970b55d3362c78cdf2b3d996e494a216f624ffce708ab7428941bb9105e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262549, "uuid": "df6081d0-3dee-48a1-a978-c676c53977a5", "comment": "Malware payload (Gafgyt)", "value": "903a68e2b11b34bd2234f2c75f6b56edfe81bc3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262549, "uuid": "105c6b7e-3334-4226-a852-101299ce109f", "comment": "Malware payload (Gafgyt)", "value": "adc24d145979ea89e93917f07c2da7a962f55fd00ae614cb20fac26eec49664945dde40f50e331da2839f35a2bfb6bbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262549, "uuid": "1443a1fa-93ff-447e-abf5-922bfbd38bb6", "value": "T11B933A07B71C0B93C59B5AF12DAB3BF08B69B5E113D76185A10AEFD00376EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262549, "uuid": "db474122-9ecc-4712-b67a-53a160a9f34c", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8YMqumXxVqDrstKfz9e:Q97vk51RcG7ASrumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262549, "uuid": "6f91ba03-597c-4e89-8113-eaece62c847b", "value": 93908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262549, "uuid": "f478cee7-48cf-47ce-aa6b-fbf16d6f91c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262549, "uuid": "d36e8bbb-fbe6-4d2c-9340-10073ad00d88", "value": "a187d1a8428009b0a29ddb39c8ac2feb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671fc4d7-2d8c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634284159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284159, "uuid": "9be7bd08-cb4d-4108-aa9b-5130fb4926cb", "comment": "Malware payload (AgentTesla)", "value": "010f80df7a72425b362d0b1277927787", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284159, "uuid": "136ed22e-f753-4ad0-a40e-e543b48b947c", "comment": "Malware payload (AgentTesla)", "value": "4d9c697132182f5795aba830f639662f8d0b05db7b263dc3a29457911b5c888d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284159, "uuid": "1447ca8d-5a09-449d-86cd-09a2922deda3", "comment": "Malware payload (AgentTesla)", "value": "bdfea60a590234af4bd22b8acd31b6b52ce9b16b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284159, "uuid": "47130659-007f-409d-90be-f555093f28b8", "comment": "Malware payload (AgentTesla)", "value": "0b5f4bf8881c5ef31a02a68b5e4b33f3c72cd94b873c21fa20a819fbe2f59f066bd4a3afcf5b7f687332e68335ed8345", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284159, "uuid": "f9ef5ff8-c758-458b-9418-4491f9fcedb0", "value": "T1EDA4D0A0F2D9C4DEE82757B4987ED95012B2666FB561C71E2096372DDEB33030263B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284159, "uuid": "88fd698e-1478-466f-aefd-765f92239459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284159, "uuid": "fd90a445-be90-47e6-90e6-32446cd08d7f", "value": "6144:r3RgMkhBDIdJ31AkwLYO24oKDmT7dkv1Yfk14yNspy86mf+YqiRSIj:pSBDIP3m/q4dmT76dYM1bklf+YqiEIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284159, "uuid": "b3325cd5-acf4-406d-9ac3-ceca216c86b8", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284159, "uuid": "77ea03f3-e316-4590-9383-0ac4b48e4b9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284159, "uuid": "cde55612-674b-4591-ba12-1cefc4751f48", "value": "PO141021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21731dc-2db6-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634302323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634302323, "uuid": "e0ef4947-7863-4a25-b163-c92ba5a27c33", "comment": "Malware payload (Loki)", "value": "b2fdec3c92a41a4e140b334184ef4e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634302323, "uuid": "01cee4b3-0223-41e8-ab11-98160cb93733", "comment": "Malware payload (Loki)", "value": "4e51be51b27ae05959149ff78aa3ebdf1010ce97def9882590b843816318faa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634302323, "uuid": "0bc5df18-ff95-40cb-afcc-e6738c9cbaa9", "comment": "Malware payload (Loki)", "value": "b809aa5e43f468cb44afb0fa0c158cd79c563442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634302323, "uuid": "b465ed59-6727-4f8d-9b07-6eae2f73ab8f", "comment": "Malware payload (Loki)", "value": "4700079f0353f758d2238f24147b63f5f61f7f5d7ebe54b8e219ba1ed7a5e6aed135d6492c778cbcf52db345e468d350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634302323, "uuid": "bfedd668-e8cc-452a-bb23-0f0bb379ed80", "value": "T18B647D10B7E0C439F5F316F949BA936CA93EBAA1AB2890CF12D516ED46346D1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634302323, "uuid": "d56e5848-8412-427b-a579-e7e02c64a813", "value": "fca1d58205e9c77175b87324501ec95c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634302323, "uuid": "ba9b12f5-8671-44a9-9d7c-ddb9cc204c86", "value": "6144:evf+e1slJosNCqvuD0kp8LbMord5+UNoWtL:ep1uCGCq2xp8LVj+UNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634302323, "uuid": "67d676af-fcd2-420e-944b-00d558595f1f", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634302323, "uuid": "83eb5154-6553-46ee-a6e7-389a3c6e39c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634302323, "uuid": "71cf214f-67a2-4fbc-9bea-be4e9419dbca", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1deb9c10-2d8e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634284895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284895, "uuid": "72cab2ff-ce19-4309-b4fe-2dcbcb9a78a2", "comment": "Malware payload (RedLineStealer)", "value": "5ed623b2795141d11167a4785c72ae87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284895, "uuid": "121b6e78-2cc4-497f-b2c3-3a50656945ff", "comment": "Malware payload (RedLineStealer)", "value": "50ede175d4df27f31064649bdc8a6c94bddcd553aec5059e0f1c6e7b3cb5e97a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284895, "uuid": "37a1f878-c5fb-483f-90ed-a86f58e22548", "comment": "Malware payload (RedLineStealer)", "value": "83d57f35fc517a3347327c788be73529c57adc49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284895, "uuid": "f4508cf6-1788-45cb-a268-899fb888ef49", "comment": "Malware payload (RedLineStealer)", "value": "eca6e22d7dd543aff3ef772cccc71278545b0d9f5790fb2f9146c3de76a6d3723c093bcdc0e86da1522aef559bd38ea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284895, "uuid": "e742a23b-8100-4e00-a708-c2842b996a7c", "value": "T11B041AC1F18498D9C81B02B95C3BA9211967BF8E5476460A36393F1E7FB37832566E0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284895, "uuid": "d31f4a49-79e5-4908-8434-f87e5b8b8f45", "value": "3072:6ku84YfOU26pCGVrM6Da786D9ckvA8L8jsPMVsVZpKxUf4RRf2vi+LtqPQpHkOeP:Jc7D3Y8ojsEVsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284895, "uuid": "8ec1621a-c496-4e61-80a0-748eb0db12b2", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284895, "uuid": "94878a22-e0a1-4421-b678-c6f54ad92f8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284895, "uuid": "197726f7-a7a3-4768-8a71-6040d3964026", "value": "5ed623b2795141d11167a4785c72ae87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc864949-2d5f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634265028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265028, "uuid": "96ac89af-9f80-4769-8d45-2e428e38ca05", "comment": "Malware payload (Mirai)", "value": "7cea96fadb3fb4fcfe7b9f2eefa37fee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265028, "uuid": "d8b89a25-59d7-44df-aded-2e4fc65f772d", "comment": "Malware payload (Mirai)", "value": "525a71a87a0bad82fbb06ac54664622456eee8c5d9773a5df4221bea89d83790", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265028, "uuid": "ff2f6330-c29a-40ec-b947-b5b3ab586d77", "comment": "Malware payload (Mirai)", "value": "de381d06a2f4d54f723f97ee39d166d90dd22900", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265028, "uuid": "da46db5f-0424-4a4c-911b-a5094b240909", "comment": "Malware payload (Mirai)", "value": "fafc7c8d65e7d66e5f9a8fc262d29a8958dd6e5baccb7367f4db2aa54fa555dee59bf9724312d5eda6ca39ce7c7a7e18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265028, "uuid": "284193e7-96a3-40c4-ac28-da1d956209f7", "value": "T10163971A3E219FBEFBAC863887B78E20965833D616F1C584D15CED015E7038E645FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265028, "uuid": "fe725c34-c7e8-4b15-af3f-1f21532b4fa8", "value": "1536:2VVUIa+SzL6P1rNVHV0vaEfKOYFRhOJmuE79ywo8eFpV:2VqIfVBNf0STDhO5PPHrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634265028, "uuid": "ef7b46ee-4ceb-4db3-a2d2-bcb1193fc179", "value": 68804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634265028, "uuid": "341440a6-1315-4605-b352-f339aa75c765", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265028, "uuid": "107c59ed-7cf3-43c6-b672-6513a45f6a74", "value": "7cea96fadb3fb4fcfe7b9f2eefa37fee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808d8997-2d78-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634275611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275611, "uuid": "ac9f5614-33f4-45e3-b3e4-a404a6ced602", "comment": "Malware payload (Mirai)", "value": "ae008dfc9a8097c93603e0770aefe32f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275611, "uuid": "7eb42f1f-d5f1-47d9-ae30-8c7d2945cc6a", "comment": "Malware payload (Mirai)", "value": "52adf1ad71758049f86310dd059b6491a3460fc2f9627ece7504321962ff1da2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275611, "uuid": "036df978-53be-4331-beaa-4ddd9f74d7c0", "comment": "Malware payload (Mirai)", "value": "e2c1c17be24ab704ca89da8f19aaf4f2d3e22206", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275611, "uuid": "0b053670-c554-4600-9020-5ce1a2ddc9c8", "comment": "Malware payload (Mirai)", "value": "0afcd5b00eb2069b5e33ea94296623b51cff2c5e504c54f0f637e4f25da5b6cecc43858d894113cf24845a3c9ec5e0b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275611, "uuid": "c55d1247-b90d-49df-acd1-53d73dd97496", "value": "T1DA333C86B800BE7CF95FD6BB8633490DB920B2548183073777BBFD976C362A85912D16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275611, "uuid": "7d9af93e-243d-4ee7-a30c-899303472dd2", "value": "1536:XTQDPX5aC6KVZATA4IfvJIokdghLM8WaO:XSPX5aC6KVqElXSg9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634275611, "uuid": "b37678ec-6684-4189-bf17-4f9610317803", "value": 52284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634275611, "uuid": "0af3a59a-bfcc-487e-9d39-8f28aafb7634", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275611, "uuid": "ede62590-196b-476b-ac0e-9439764bce37", "value": "ae008dfc9a8097c93603e0770aefe32f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31018002-2d79-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634275907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275907, "uuid": "ad51dce5-f7e8-4e8d-a271-4d62e2dc92b1", "comment": "Malware payload (Mirai)", "value": "cc8a42d7ad0c0aa93362cf2f2409a852", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275907, "uuid": "17f6e884-6b8f-47e8-98b2-2551e7f69462", "comment": "Malware payload (Mirai)", "value": "5458b3a21716be2dfc3124c54ccb499c3581e24eb6778016488386047a613b25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275907, "uuid": "be724847-2977-4db8-9e27-bf133ad2253a", "comment": "Malware payload (Mirai)", "value": "a01aa5361f4ffbbad05e5a09d1f17ef7af34f5b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275907, "uuid": "cbca7977-eb21-4896-a1a0-efd4d63bbd48", "comment": "Malware payload (Mirai)", "value": "1afc99b51170a40f25968bc8217992763618039c285c1f24b7072adfdb424f527b08b1155f88901a47b2d84c49733ffe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275907, "uuid": "4cb05d53-a986-4607-aee6-35c4b9aaf293", "value": "T1E6238D77C8691ED4D6968574A12CCA3A1733D408A29B1EFA1E47C579A00BFECF1093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275907, "uuid": "1cb055c1-4fd9-48af-82cd-125bd7dcd86c", "value": "768:qa6Z21e8mofzVh/HVcL/CWuWo3taxzMCYAuaH/:qa6ghXzVh/HVMop3wwCYBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634275907, "uuid": "2f3eee96-f016-45e4-a820-0d33e70e26fe", "value": 46116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634275907, "uuid": "817efd5d-6ef5-42d9-9acf-50cabf06fa0b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275907, "uuid": "6399e03c-706c-44b8-b6f5-b4289764f637", "value": "cc8a42d7ad0c0aa93362cf2f2409a852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e986d2-2de3-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634321394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321394, "uuid": "8f99d4da-3ead-4d59-908b-c6385f4e8f7e", "comment": "Malware payload (Metamorfo)", "value": "318749cc276c1d4b9a8911bb35abad59", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321394, "uuid": "2980c5d8-249b-4f92-ac55-b6e1d78c3532", "comment": "Malware payload (Metamorfo)", "value": "55b9da2a2756eccf09093ef5fa7637f616c86fef999094bc7d8432a1f1250533", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321394, "uuid": "1eb99f93-cd35-4048-aa6a-1e85375c7e5b", "comment": "Malware payload (Metamorfo)", "value": "73f3e511bfadeeaf9d593765ade9a072cf85eb1c", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321394, "uuid": "9b897f20-ef1c-476c-b994-acdc3302ebb9", "comment": "Malware payload (Metamorfo)", "value": "8e559cd73ac6a40acace7b2a40fc551078cdf5e4ac5606e1821dda5531354aaf3524ef6ae9cf0609162223a060479c28", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321394, "uuid": "331b47bf-ac07-4eb6-ad38-ae673c6611c2", "value": "T1D241CF181AE60325C277DF7934FA72968EBABD51AD835B5D4080478A28A1180EC35E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321394, "uuid": "21501903-f0d8-4d4b-996f-ed9a27b91778", "value": "48:8+uH+M+1fVwfClD91cIXv3KaIqiHkb6NS6:8+ueF1NwOD91cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321394, "uuid": "faee172d-1309-48b3-a21f-b66cd4b08754", "value": 2022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321394, "uuid": "5c8e3ebd-94c3-4e48-9ecb-1d7fada35d96", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321394, "uuid": "423957bb-a837-4260-9789-4cd7401fd2e1", "value": "Anexo - 15102154890.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18995ac3-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634320964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320964, "uuid": "6fb428d7-4748-4d60-8ad7-1daee616075a", "comment": "Malware payload", "value": "78e6707f929c7160162029f1617ff8bc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320964, "uuid": "47ebb041-d392-40b8-978b-9c6bcdd4e703", "comment": "Malware payload", "value": "5639cbc032b6e2b948d84bbb73446a6dc5e1472b4fa364cff56a32339da7199b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320964, "uuid": "f3d1ced5-d076-49e9-91a7-a96a27e28924", "comment": "Malware payload", "value": "788b1952eea4419e4745313077f732ef22f9a4fe", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320964, "uuid": "0d8ddc93-7969-446f-abda-43c18c8a52bb", "comment": "Malware payload", "value": "8addbe4387534551f8a7bf69f86d89e97139f4be1080213281f1d577028bf5e501289009a89eba2101b2388e4814295e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320964, "uuid": "ac8aa2bc-3d57-49df-894d-3a5018ee1b7b", "value": "T16EC31962CE109244E980597D0B77886F34257402F44FCEAB6ED1A7386C74F53AEADED2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320964, "uuid": "37325a1f-c970-4f71-9c3a-37986c2933cc", "value": "c2070b5db66b8ad5bbe884438a468add", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320964, "uuid": "63d4540b-d9c9-413e-afea-2e96e5f6d6d5", "value": "1536:tMLJ6WkbfMf4zJP9ERUEPUnUwIF/SBxCX2jTTD:qLJ9Rf4zJPvb1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320964, "uuid": "3ea453f2-ced1-4560-a9be-a5481c0937be", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320964, "uuid": "eaa928e9-6c81-460d-9bd8-235da2523bd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320964, "uuid": "9deade7a-902a-420a-afb8-f65f78488c4d", "value": "DHL DOCUMENTO DE ENVIO 10152021BCE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daef2130-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634321290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321290, "uuid": "19761387-ca89-46d5-8ccc-82a4ed86a24a", "comment": "Malware payload", "value": "6bf2a52b5755de865d691045806936f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321290, "uuid": "4aaca33f-a741-4b8c-93e3-0762344de86d", "comment": "Malware payload", "value": "5a7d360225defcc80b5d30efb865f76d377aaa044b5ec42c2c40a3359c968f3e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321290, "uuid": "da83ab4c-d8db-4997-99d9-92385c8fc7ab", "comment": "Malware payload", "value": "70c164d08608478ba36e1479f0277dffc4fd951f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321290, "uuid": "2d95a155-eac8-44e0-8e67-694f22ee172c", "comment": "Malware payload", "value": "d37fdd7b99eb17248ce40f38e7ac2544f8f72fdce382f9c0cc6105abfa77dc28306de10c5976a4489bf60fe861efaa04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321290, "uuid": "50f64235-0915-449e-a34e-44321df102e7", "value": "T1AE74BF5932940CB9ECB74139C8535946E672BC164731DABF03A0436ADF2F7E1693EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321290, "uuid": "7b490351-6731-488a-99b8-191605ab9e0f", "value": "180d12f9cbd4e7ad2758d212b7c02930", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321290, "uuid": "a66a9a27-32e0-4295-9e62-359ef3bfe121", "value": "6144:pHJGKt24zrhvsoWb9BHohiA2lZYjQ7B6TuvJ0VPRevpyB4LvW:pHkKFBsoeoV2lZYs7Duap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321290, "uuid": "2d2bcc72-cb89-4634-b73f-d9715e8defe2", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321290, "uuid": "64b1d567-aa04-4359-b2f8-60b81cbc9bc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321290, "uuid": "0bd2a34d-c0f3-4a04-9af6-e2fc9e960a44", "value": "6bf2a52b5755de865d691045806936f9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ececd91-2dfd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634332731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634332731, "uuid": "4237f137-6c3a-4639-82fe-56ef7e20cce5", "comment": "Malware payload", "value": "ef946df7574b283bf24b349d2cb679bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634332731, "uuid": "d654c16b-05c1-43d3-8715-07bd960c408e", "comment": "Malware payload", "value": "5bb8975c8a7e8080a8a68034458adfb7b8e9812b5a1fdd15f891656b03d086e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634332731, "uuid": "b10ba432-7217-411e-b556-ae4a814d9bad", "comment": "Malware payload", "value": "5100dfe4456adfd5cea41b5c137ea9e2fd10c7f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634332731, "uuid": "7dd54b66-bb74-4b62-977c-f95a60335c66", "comment": "Malware payload", "value": "3185a5e19fc4e2847e1558b8350906778350ffb55fcc42b49b2900c8d939d5b897f9c75171466cefb691ac1e51c22481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634332731, "uuid": "14a9d805-a057-454f-9fc0-42e9172d5423", "value": "T10274014AA31D612FCB714CBD941E110E73B18A3676D1F7EB48A7F28B15AA7C348123D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634332731, "uuid": "7de9986e-cd27-4c83-a9fb-27a5d9bcf211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634332731, "uuid": "3945ac8f-5315-49ba-8efe-cf1e617f7b7d", "value": "6144:8FubMkhB8ROd6i8G1RFLmw9mNCPr3KZ/GEvL4XG7PRlYXp8Rs2JHn9y5aHgLIeV:9QSBLDRFLmwTr3KZOEsXG7IXGRs2JH9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634332731, "uuid": "ba487984-739c-4102-9a9d-b73575d4feba", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634332731, "uuid": "a195110d-ea5a-47bf-a7a1-38ea7e6228e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634332731, "uuid": "3ec22202-30be-4fd5-9893-25ab288a33aa", "value": "Quotation- urgent basis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc89e63-2d7a-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634276469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276469, "uuid": "a8e30822-79ee-4559-ba29-52dd92407977", "comment": "Malware payload (RemcosRAT)", "value": "fc977eba1667fa73a28477ecce72fbdd", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276469, "uuid": "a097eb19-0b4f-422b-a762-507586e9a9d5", "comment": "Malware payload (RemcosRAT)", "value": "5bdc507edb2b1703c5f0ed66591094b4f2923935a70fd237b76e7230de78ddc9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276469, "uuid": "0136fd24-7739-47da-8dde-bfdd514e193d", "comment": "Malware payload (RemcosRAT)", "value": "0655e13919a7a2d092725b9e5406df094fa63721", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276469, "uuid": "f56107f4-b8e1-4db8-9612-0239a8ef0f00", "comment": "Malware payload (RemcosRAT)", "value": "4f6bf506a9681c5aac4d08a7d9e74331751f61753551fc2ec1bd83f36128cef2e0252bf349117b8e5ba4595819a973b4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276469, "uuid": "99001a8b-ade6-4f79-ad8f-2b503fae8d69", "value": "T1E8558D56BEBC1839C15150B88D4F87F66922AF303816AD812AD72D4FCF3676179313AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276469, "uuid": "1b22f466-2d8c-4652-b36f-1fe111dcba16", "value": "12288:gP3Sd0k2b6Yf1ls9oJ2mF6LIosXFHJ1kUk1N+BfZ8fQOwm6V:gfQob6CEoJ2OpXXpImZ8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276469, "uuid": "d4f234b8-39ca-4cad-b5d1-43b7f1c577f6", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276469, "uuid": "139dc55d-7daf-4c32-97a2-a8b0c99a159a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276469, "uuid": "5c968495-d333-4f37-af74-a6425db1e72c", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82b46c7-2d9a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634290334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290334, "uuid": "82171449-4c39-4a32-aaaf-a644a1315e24", "comment": "Malware payload (RedLineStealer)", "value": "378ac48d542736802ce18f7d57bd3a52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290334, "uuid": "64eec2a5-ee82-43f0-b186-e83ccdfe1ad2", "comment": "Malware payload (RedLineStealer)", "value": "5ced62a4d85fd3bd2eaa51c44e5b08c4f57672de89782fc8a002172db3e8ed2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290334, "uuid": "a7d01289-ab8a-4120-9516-394ab56ed830", "comment": "Malware payload (RedLineStealer)", "value": "2a051fc803ae13c4791a8e879377a688835ea349", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290334, "uuid": "0373a55a-9758-447a-931a-d65f53803eeb", "comment": "Malware payload (RedLineStealer)", "value": "ac085c5e53cbb811e8767f4bac71bf43eb401b3c1e3a0e3c6bd228c67e84bf517ca1d4b1e7e3dc7302c807b8924eced4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290334, "uuid": "8ba4797d-95f9-4f26-93fe-9080e2637e92", "value": "T19F84BF00B7E0C034F1F752F846BA9278F92E3AA1A725A1CF52D516EA9734AD5EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290334, "uuid": "2500d676-28dd-406b-b530-a8fd01c6566a", "value": "9e2cb00668936ef8a66a623b516f5f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290334, "uuid": "c8b826c5-9b98-4759-9357-5593d8910bc5", "value": "6144:/+1fYzo2YFtv7XfkLR55Q+ONHlyj/tftlyooBg7eV:Gn9v7XcV5G+Odlyj/tDyoom2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634290334, "uuid": "51b694a2-f8c3-45c3-8596-41412de116f1", "value": 375323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634290334, "uuid": "eec82b9a-c915-4ec2-b127-f5b1832ae1be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290334, "uuid": "b820d2cc-30e5-4f9d-8ecd-14efd08d8359", "value": "378ac48d542736802ce18f7d57bd3a52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cd6243-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634300338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300338, "uuid": "64a195ff-c668-42ed-a687-6c5d2ad801f4", "comment": "Malware payload (Loki)", "value": "53a2f7929366218575e076cfe676a9e1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300338, "uuid": "17cb6e0b-4c07-4715-a2f3-7e8443c1bd6c", "comment": "Malware payload (Loki)", "value": "5fda5a6194132251eca26425c6818930ae5800cd39a13741dbd27163b128ecbd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300338, "uuid": "4e6eef0e-a592-46bf-8ae3-d2d8cca09c64", "comment": "Malware payload (Loki)", "value": "b039449a74015f58d5fe24af2dd6820596c3bfe8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300338, "uuid": "65a08983-09f4-46d1-b99c-f81f639f89ff", "comment": "Malware payload (Loki)", "value": "42e0df59fe1bec0b092fa6a06a4264dd815a17e0baac9cb588193b3cc6d91876f617bdf83b9b92bef04798b919f40617", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300338, "uuid": "f554c8f2-3fb6-452c-99b2-00b586648de4", "value": "T1D874C054BB96F6B9D9D359F8F17FEE3BF1326D45866850813C1A721A0A3220CE6D21CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300338, "uuid": "a257f6c9-d088-4b2d-9edb-375ad2168a87", "value": "6144:GOOEo2ng80qD/Y1UR3o7vAVVxnmLeOEezivTKvRCa8eeSEX3rHrAXA:1Q78RD/6Y3o7kVJcRzibKsBXDrEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300338, "uuid": "16c54345-ff69-4607-8fdd-c877f6b7152f", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300338, "uuid": "50cb15cc-ff0d-438f-8a55-0941c59df635", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300338, "uuid": "0a90aa63-2e38-44be-a437-e31db332c5d2", "value": "PO20080956.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e807a433-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1634300696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300696, "uuid": "e7399ae1-babe-4e10-a747-1d8f08457984", "comment": "Malware payload (Hydra)", "value": "7433796ca18baa6386c024c07cace94f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300696, "uuid": "57214f0e-8188-4b56-916f-dbc8e15a493c", "comment": "Malware payload (Hydra)", "value": "6005f5569a6240c36f07de53438df1615ea6f000000fa5452d5a8870afe6336b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300696, "uuid": "dc335d16-61ae-4a20-83eb-1ff1a1946a0b", "comment": "Malware payload (Hydra)", "value": "68ea3944453fafac292c15d7ac439a80bd8cb89f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300696, "uuid": "8063c6cc-a4e9-41a8-a5b4-d15ffaf58752", "comment": "Malware payload (Hydra)", "value": "b2b7a6cbed826814ed6a1c0c7ed95f42fa3a0d86e9d87d3fac906762dd03bfff7479d0ec39e35b41313802f761d1d5bb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300696, "uuid": "32203dc2-c9a7-4f96-a4eb-4952b9f8f623", "value": "T13B76338CF180C3C6F73695B682833D917A95167369C6D0BFC2483EE45DABDCA064698F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300696, "uuid": "f57a8ada-02a3-4627-86e3-f8e09b900e1c", "value": "196608:ERx1tdBaJ5/MK7Jtl2DWx0RiQdyjynFAL973X:ERxdkJqgJD6Wabyj407X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300696, "uuid": "301b5cc7-a325-496e-ba0e-b3e8676d8e17", "value": 7693386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300696, "uuid": "050caa04-80ce-40de-bcbe-dd9d62989341", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300696, "uuid": "7158def8-1c33-4fdc-8e40-1fb820c807b8", "value": "43891_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4101bbaf-2de6-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634322749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634322749, "uuid": "0e61ae52-9691-4fb9-bd1a-6879b0b70362", "comment": "Malware payload (Formbook)", "value": "962ae24141e7b1abf36ae99d1fbc7315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634322749, "uuid": "86f94dae-1c8a-497d-899b-3d139ef1c084", "comment": "Malware payload (Formbook)", "value": "61a69b0eb00727462d5599153fb2acb617d15fcc2e9e4ec3270a5fca8837a3ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634322749, "uuid": "297221df-8485-4f99-92b6-d3de76db843e", "comment": "Malware payload (Formbook)", "value": "bff36581aae1b402d2542190d89faf07fcdd2680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634322749, "uuid": "13370892-1aed-4430-906e-d256a0763f68", "comment": "Malware payload (Formbook)", "value": "9aec546382ad6cb51157dc5ab79f1367127e034985208bf49c457363dcc6005f9de5567cf0af37061564b4e24471ec40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634322749, "uuid": "3d1aeec7-b2d3-473b-a8b4-99ddd21f3acb", "value": "T167552331F3E3C990E8704A74291BD6791B39CE9EE9322D4E2134B67D4DF1B6196428BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634322749, "uuid": "cf1779e4-9f7b-435f-86be-4777f314efff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634322749, "uuid": "a7a9441d-2459-4c26-b18e-f9c8bf6f55de", "value": "24576:196uxv82aMVxkN0m9KYR665AoUv8xmlBp49Ax5v7WPDFIgY:19zjalOm046IArUqi9A7v6ZIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634322749, "uuid": "0887499e-f588-4e2f-b0ee-74928a42fd05", "value": 1338368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634322749, "uuid": "83d5b066-2c74-40c1-abfb-863deeb1be77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634322749, "uuid": "2c7512e5-68fa-4011-b407-6061314b5f37", "value": "DF_Nueva orden _WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564b7937-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634300881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300881, "uuid": "cfbe1342-2051-49a8-8b82-6d2f0f8fc692", "comment": "Malware payload (AgentTesla)", "value": "1f3d4f5346f708174bda1284ebce17f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300881, "uuid": "340c38f0-953a-488e-aa32-a708eca79f96", "comment": "Malware payload (AgentTesla)", "value": "624ddc18fcba299a476269baee8177c71304e9f9a4b89cc22e07d0a4726cc43a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300881, "uuid": "14eeec63-2022-431b-aec3-11ab1f5de6a5", "comment": "Malware payload (AgentTesla)", "value": "683d3f1c0636833c5be730ff6bdcd554f99795b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300881, "uuid": "031a1abd-8061-48af-afae-57a0f430812e", "comment": "Malware payload (AgentTesla)", "value": "387ba120926f95c680049d88024d49f0f10e46602daa166d3a225fc3ae4f60f5f70bf0f647f07b1b609f1926ae9fed05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300881, "uuid": "41f248c4-a3c1-400e-bb52-5c7367909301", "value": "T1938323A1B656DD98E8574BF20C77966000676E4C88B9940D20ED3F2F77B331328A6F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300881, "uuid": "aaccada4-e5a8-4920-92a6-d0f1d0160933", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300881, "uuid": "92b1854c-f0ee-44f6-b885-d902b18e6f08", "value": "768:EUczGF6u/NiMjfY88ohSU2Ip4jBqltCF0AxEjenoB69+Fxeg:EUyGF6Odg88ohSFHBWAxEjc+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300881, "uuid": "d04edf2d-3caa-4630-bddb-6a0255481441", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300881, "uuid": "f1ef25e0-6bad-4ab5-9d3d-2c4efbacd3eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300881, "uuid": "489f1401-404e-4597-b91d-3048c56a7142", "value": "Kopija Placanja_Banca Intesa_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec696634-2d5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262907, "uuid": "8288e63f-37df-4ae4-ad99-95b8236c6161", "comment": "Malware payload (Gafgyt)", "value": "0b68f766f8c12b91213d9c5219997a71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262907, "uuid": "6f4bddb9-b2cc-4188-b0ee-f93b3841572a", "comment": "Malware payload (Gafgyt)", "value": "62fe4263c435324eb5b3cb3911114d69e5c5b24f337ff3c5937e1ee3cdbfd99c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262907, "uuid": "791a52a4-ede4-4048-b06d-e4af61b95be0", "comment": "Malware payload (Gafgyt)", "value": "c7d8d5e915617410184b9174b0df78f357a09242", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262907, "uuid": "c59c3e48-80f9-4e5e-8b6c-60dcb4dd599f", "comment": "Malware payload (Gafgyt)", "value": "473b631ac68607b41ed923ecbdce034055c50605251b9afb2be4610c308a1ce3f701f4afff558ec9fdd9a31a73776a23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262907, "uuid": "6c2170ba-83a5-4e24-9a40-e25c2f85dd52", "value": "T16A833A47E9A19FB7C0866AB565AB5D300B13E9912B4F1B4A303CA6F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262907, "uuid": "b4161bcd-605f-4ba0-97eb-3187ed9a12be", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCkfqJPXwamkxVqOEeofzee:g7OXmMSr4krG3JDEPrmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262907, "uuid": "190821fa-a6d2-4217-8857-8003eb497c15", "value": 88734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262907, "uuid": "e2eab724-8c4b-43ca-9a58-0f377b60fab6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262907, "uuid": "b7217dd1-faa1-4d78-97d9-1dc2dcbcf1eb", "value": "0b68f766f8c12b91213d9c5219997a71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834ea082-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634300956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300956, "uuid": "99abf209-6ab9-4352-8b61-e3ecdee716bd", "comment": "Malware payload (RemcosRAT)", "value": "a93b301cfac96aacb0d751d9a75f88dc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300956, "uuid": "3b694bb4-27c7-4f1f-a178-cf7dd3968090", "comment": "Malware payload (RemcosRAT)", "value": "636abbcfa39fd806176a81b1b72a3d55b6d2c04e32863eb33d1324382c3d79cd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300956, "uuid": "3e136768-02c8-4cd0-9e7e-9adca804f107", "comment": "Malware payload (RemcosRAT)", "value": "c75b30c2bcce56676166e7596d8e8eb0be9d0211", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300956, "uuid": "271c1088-8a59-4634-be2e-691385539ad7", "comment": "Malware payload (RemcosRAT)", "value": "e764e7c2f8df2618ebec1d0e36ff3af531d16af3688571b0e4b7ee2ebce261f11f05bb6310f62d2b2e07ab8fcf91ee45", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300956, "uuid": "8fad2d0c-9b78-401b-aa02-19fe3990cd3a", "value": "T102E48DA3B3800272C013AF7D6E9F74A54D0F6F26272C94C359E84E6D8F4E6642651DFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300956, "uuid": "0b915da1-15f2-4803-abde-6de5128ac491", "value": "12666343f95da9cc22c238274d75b6c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300956, "uuid": "38932dda-20cf-41d6-b9e2-632694304ddc", "value": "12288:0SvSsA2JxPaLrNgLGKXhfLeoZ10VicVpD+SnqyUz:0AdLzPCrNgLfXhaoZuVTXpqyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300956, "uuid": "e2b1843e-3df9-4d98-93f9-e556015cd831", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300956, "uuid": "0da51a80-9680-4ff8-af71-b9b906e6dbd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300956, "uuid": "9a10fac3-32c0-4204-965f-6cd1c6701834", "value": "dokumendi sissetuleku DHL_119040,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141f1aee-2e03-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634335129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634335129, "uuid": "682c924a-ae5f-423b-a1d5-1faa0471efca", "comment": "Malware payload", "value": "6c22a69dcff9df6a612c491c1b07083d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634335129, "uuid": "271b4032-bfab-433b-a1e9-78d5e9c54d44", "comment": "Malware payload", "value": "63b2eb04f5ee9f31febc724c9f46f8a95491d4a55a1a4cc6139718258e953444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634335129, "uuid": "7e1e5ba6-7646-4202-9aed-95d0ca490fbd", "comment": "Malware payload", "value": "ddcb2fd1ab67384bcc6341f558fd467343d52e2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634335129, "uuid": "1cdfd060-202d-4db7-8f23-9c82b3bd42dc", "comment": "Malware payload", "value": "1d897e7a7c9bd248d4375f6525c6319827a7cd3441b3fa7123a913fe35ea44222e7886e3b97ed92668d327b60af2e791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634335129, "uuid": "1f2c10a9-ffbf-4da2-bef1-301f0320b197", "value": "T16AA4FEDC31D132DEC95FC936AA687D78B721706743CB0653982B21A99D4EE57CF280E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634335129, "uuid": "62646806-a100-4734-82e3-e5d3335f5b91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634335129, "uuid": "d45e509e-f319-4e07-a242-4d2ea5230b0c", "value": "12288:DR7FXuUtKavCkdLJ1tRKtyjWJrPwNjG5pAv95cwbXSgol80dJm9PkFNArNGwge5m:DpFPxRdLjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634335129, "uuid": "c31918b7-be91-4433-8c0a-6773be14f1ae", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634335129, "uuid": "50279ae0-04b3-493b-b15d-520118cdb148", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634335129, "uuid": "0381eb0b-c268-4e07-a91a-03eaa9d29780", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb238a25-2de0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634320458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320458, "uuid": "7790efce-ce6a-43ac-87d6-35b17ed781a5", "comment": "Malware payload (Mirai)", "value": "e1c6e7fc59cf27f15e1249439756f37d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320458, "uuid": "a0d3d9b2-fb64-4266-9754-43f9f3440a19", "comment": "Malware payload (Mirai)", "value": "63e7e513816c7c57a6180117a0cd7532d1f9907fe70fde72cac38089e00d5e3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320458, "uuid": "852a0489-9447-4dd3-8e53-e7375f64d934", "comment": "Malware payload (Mirai)", "value": "b39187f06f2b7971162c28f29ae49fefc7cab661", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320458, "uuid": "049bba44-ef85-4b88-b7fb-7dde2e9d8c19", "comment": "Malware payload (Mirai)", "value": "d334d777f44ac83ca7ba2fa89d549fd4b45d195bf2b9763b70fb58c69dc0fed8b246076cc76f465b1ea931c090ef110c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320458, "uuid": "ff29ff7b-d408-46f2-ad3d-ba3031be904b", "value": "T198634B9AB401AFBCF99BEAF941110A0DF421E25460530F27B72BFE937DB10A5DD46C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320458, "uuid": "46b3d255-b369-4059-82b2-5400c3fe0371", "value": "1536:m3Fj+WSxuz5nAXX8I9GrOzWeZWuTftMh2/b8OK:YjvzNI8IIrmx0mMh+VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320458, "uuid": "ed2dba6c-7d5d-4e3d-9d8d-32e48965031c", "value": 67204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320458, "uuid": "f1eb2085-6916-4175-a70f-918360918e81", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320458, "uuid": "fe10af2b-79c0-46f9-9951-ef21b9d80ee0", "value": "e1c6e7fc59cf27f15e1249439756f37d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c03e06-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634321064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321064, "uuid": "6fd05d4a-a8cc-4173-8580-df1588aa7d90", "comment": "Malware payload (Mirai)", "value": "c744a8f95246825f7f08530ae4141179", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321064, "uuid": "b283faa0-df85-4000-b352-a21119e25486", "comment": "Malware payload (Mirai)", "value": "6661542e1799a03369252ea4b5f6e96941820fae78a30030a3cc9a53fa51dca4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321064, "uuid": "d04adbce-bc28-4325-8f59-43f2b1a8fa6b", "comment": "Malware payload (Mirai)", "value": "40fcf09fc4a8d0e159585eff7694811b5b2abe14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321064, "uuid": "1ba487a2-d761-4fa4-8dca-7e774bd279f4", "comment": "Malware payload (Mirai)", "value": "9b98ea26d436380101fd08c7d5aa2d7fce86ad2a4cd19449fd36714c3a5d9b052e938e1ddc7650eb330594111b7f486c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321064, "uuid": "a6c69030-31e3-47a9-a24e-837297513d5b", "value": "T1D563F985F8C745F5C8074A3460BBB23FDB32D6BA40705A6DEF59AE32DA37701521239A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321064, "uuid": "a2a66470-9efc-4199-8b2b-af0730d16e16", "value": "1536:HzrP7QIlOudSxvw0qXWwTL1Y3JpajqOf:HzrHlOuslqX/cJojH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321064, "uuid": "51682924-37f5-4de7-b610-42ac61d8579c", "value": 71312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321064, "uuid": "d06a027a-26ac-42ff-8439-a2ffdf68990f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321064, "uuid": "9fef29ec-223e-4339-a0c2-26abbb518d1c", "value": "c744a8f95246825f7f08530ae4141179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0256282-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1634301005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301005, "uuid": "2356a5ab-194b-46f1-829b-f13c4b1a87eb", "comment": "Malware payload (STRRAT)", "value": "6f8a0a71fa4e9b4f871bd262dda7c0c1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301005, "uuid": "298c74ee-bb31-43f3-b5ba-91ebf17aa455", "comment": "Malware payload (STRRAT)", "value": "6c0658315b96ee5b7c95c60279714f9c95017fb22f451c5a73af91583889f1c1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301005, "uuid": "d204ace9-cbcb-4f3f-9f33-28b6c95453e9", "comment": "Malware payload (STRRAT)", "value": "8ae0166ac5d5a98cd379fd124829a5877d16e770", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301005, "uuid": "df2203a8-4727-4fbd-921b-c0038c987382", "comment": "Malware payload (STRRAT)", "value": "6267f64ba680fba9aaec3db6a5a983d43ad86a7593c88dd0a1a2ae884bc045d7de2b5064ea2d18b0fc08d63607ff242d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301005, "uuid": "350fae6e-faf6-4502-81bb-36094d3f773f", "value": "T12804016B7ECFC0F8E11B217799059132A18D45D8E015E52FA0FC1A990E71C6E4B62BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301005, "uuid": "794c104b-4d91-47bd-a306-e33df8f119d8", "value": "3072:UvUXwAKU6YzXgPkGh7Hs6E63edIo6ieoZlQhgl1OJiotZR5N1PJQtIcY7GG/q+7g:pXiazwPkGhPE63A6ab1mYWflT7GGyqs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301005, "uuid": "050db011-433d-4920-9f04-f87c76c19e98", "value": 188943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301005, "uuid": "8d179bf7-a238-473a-b4e3-68ed67ab1774", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301005, "uuid": "6c9da507-50f2-4df1-aba2-e43fa39acff8", "value": "PAYMENT SLIP 2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79c9d83-2da1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634293286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293286, "uuid": "2cde09dd-4f31-4490-94c5-e4030134e13a", "comment": "Malware payload (Formbook)", "value": "bcc531c74609f1a72303456fdd6742c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293286, "uuid": "6fb4cf7e-3dcb-431d-a39f-dce5cef784f0", "comment": "Malware payload (Formbook)", "value": "6c6411e168c6e04022e9314130b25ae03380de6791d6a801f150679fddb64934", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293286, "uuid": "839dcaeb-ef33-4486-abd5-ba85b25f49c6", "comment": "Malware payload (Formbook)", "value": "d884bde893054a94e5c59b3a4038c350f62a98fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293286, "uuid": "a35c12da-c47d-4858-a807-5120d576092f", "comment": "Malware payload (Formbook)", "value": "842f20893221511cda0e1db818e4f2796f211159878e7090e37399b6a4ffbf272107f921a15b79bc41fba6131bbb04d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293286, "uuid": "6ac237a2-3a65-4d2a-b9c3-d16ab20f642b", "value": "T1E1057E3171A09437C0331A7C9C4B6279B82F7E122D45B95A7BED564DEF322212E3639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293286, "uuid": "e6d0e5ab-9a70-4527-81d3-911ec3ce21f4", "value": "7f309c2fe70697383ea743a5dcfe57fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293286, "uuid": "13416b0e-408b-4d0e-a21a-c7d78115d767", "value": "12288:QliYkcYgDmJ/Kb0dGGTJ4tzGsVlHrurGdvylqvVcgU9SKw9S:gNqOnb08+JUzG2HCrGdva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634293286, "uuid": "239c0792-5328-4da7-a32b-f8626c0a0b89", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634293286, "uuid": "32c23a21-4807-46d3-962b-463124618dd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293286, "uuid": "1bb3b36b-4e1d-4778-83ce-eeca9c850789", "value": "bcc531c74609f1a72303456fdd6742c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f17f9e1-2d5b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634263207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263207, "uuid": "b3802af3-1f6a-44bf-80c5-64df4a77aa78", "comment": "Malware payload (Mirai)", "value": "dc25fbf42504eab1c9eca70884a230f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263207, "uuid": "04b9c7d7-a8af-4252-b522-0e1dc67dce22", "comment": "Malware payload (Mirai)", "value": "6cc86b617cddc2ee640b151e4f3db058b83f846a64022ba621d0765d3fa554d6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263207, "uuid": "19d0062a-1203-404a-969f-47aedaff0195", "comment": "Malware payload (Mirai)", "value": "b340b6b6d040e4ca66a58a2f92c1c8de671f247a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263207, "uuid": "3e9d2b0d-0406-4903-9e63-ce8cb3c61260", "comment": "Malware payload (Mirai)", "value": "4a32ae0212c0efb4b80c8d3c75c2c13d0d2de251646097100a00ed8c3e9c98f5de9d01af68e2b141cf65c0b05b72ea30", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634263207, "uuid": "e05d7b45-a549-4b69-b09b-9816b671ebf1", "value": "T10B23F8C27892AA39C3D0577BEEAF418D331497D8D1DB3357C8281B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634263207, "uuid": "c1fab29e-fc90-4342-912a-251df48d83f6", "value": "768:HR7nhgvz7/a6M1yyj69CFLUEZmY89ntf2OfFGv3kNmekTtk7wCVy/rCxHghW1/K7:VhgHLM1oBY89zGv3kNmekpfhWE5kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634263207, "uuid": "ce6223ab-c05c-4c39-be7b-905c2f8bacec", "value": 48792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634263207, "uuid": "c95b5699-2b0a-44dd-8c02-e189204e2783", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634263207, "uuid": "c5e5d698-e0de-4cd8-bd5e-67061d0f2d7f", "value": "Owari.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0e7d30-2db9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634303627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303627, "uuid": "1480d50c-4a2a-4a16-92fe-f3df806bbe17", "comment": "Malware payload", "value": "bc79e5809c9457102cb9dc5222b5e0be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303627, "uuid": "c9fb9e65-626d-4596-81b0-ce07ecd854ce", "comment": "Malware payload", "value": "6de025fe880bef1967fb742becd8884b9010ae7fb00c1c3a77d4dd8143e3ea67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303627, "uuid": "5b5947f6-6009-4d69-bffd-f5154c7cbf5f", "comment": "Malware payload", "value": "4f0c3571b52e3b87a85775e484a3f65b8c702981", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303627, "uuid": "1900fc74-b4ad-41ab-bf80-1cc98cb361a4", "comment": "Malware payload", "value": "307ed582c6b4b7520060e8a3b0b7587b1d5600886c8c9ba8ef013aa75f8a99e0141316ad92105f5dfbb17621e962fb5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303627, "uuid": "18e03128-7dc3-4797-8f5f-b67913b26b3b", "value": "T1D7D6332EF16FC40DF6865135CF3ED6A36D64BE52840204ADA804F9683D12B2F176F9AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303627, "uuid": "fb614e70-f728-4d57-9423-cc727834f51b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303627, "uuid": "6b2142af-36f5-4687-99fc-1f50e8cdc4d7", "value": "393216:WMk53Eo2vZ8lsSHpUrsPJetEXAGZAKpwsL/i:AJEUOgRetRK2sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634303627, "uuid": "c1b62d88-c17d-457b-9155-459782404629", "value": 13619432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634303627, "uuid": "7fa88744-dc46-4bd7-8a08-9c45c02779e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303627, "uuid": "298240db-00d9-4157-b5d4-00ff9b55dc18", "value": "bc79e5809c9457102cb9dc5222b5e0be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a957b4-2d80-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634279143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279143, "uuid": "727fbe33-0f5a-4f0a-b5be-ef83b91d61ff", "comment": "Malware payload", "value": "8f03f7ee05c78eb5fdabb6df801a9f76", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279143, "uuid": "2fa27bed-94ce-4a02-a93a-5270970cfa60", "comment": "Malware payload", "value": "6e8a08d6caf0e0ad6a555da452f403b0bcf2e8fdf8f968130eda3686a4e1555f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279143, "uuid": "190e8730-8c0e-4c12-b4e6-97bc6d852117", "comment": "Malware payload", "value": "e64d150e76a7f389f928c8632e8f5e04637150bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279143, "uuid": "0a59cbac-5115-487d-9768-95123f03b848", "comment": "Malware payload", "value": "3d1bbc46272c490899ae0d1f6c1613e5bc715b7aff609f353b3d6fe2b1574f6cd617d57dd6d9be973eef5ee62a7dd964", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279143, "uuid": "ba745e11-5456-43f8-9f10-6e6ed2f92dcf", "value": "T1083633C95B6E303E34E03FF68A075FFE721E3B0A26D8F4ED16C58AD9821157A314615A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279143, "uuid": "ff216f6c-b1d2-4747-aea3-1a598491a04d", "value": "98304:dYUYX7LFEp/niZuZMPcvCxcuyrO44C34GrrrvWN5j38II15CjB2TKR:dYPLFEptZvxukDZ34eWPjMN15cB2T8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279143, "uuid": "40ed0cda-05d4-4d9a-8d43-dcc9b061a6cd", "value": 4892389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279143, "uuid": "e9896e87-d439-4a02-806f-f2892e6b75ec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279143, "uuid": "5092b6d2-aa86-4703-99a7-737e5fd7ece0", "value": "Spy Guildma TUP32980638916Y.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3fd399-2dae-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634298606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298606, "uuid": "1f35d1fa-bc2f-4b63-a4ce-5a5427b2cb20", "comment": "Malware payload (Mirai)", "value": "27d4c347c33570b7f61bbc33ae01ae7e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298606, "uuid": "7a2ad0db-661f-40e1-9ce5-9e5e10c23ef0", "comment": "Malware payload (Mirai)", "value": "6f4b2d8469cb4fd7ddb656e4ccc331aaf5d65ef185ccc4b148edb506cecd31d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298606, "uuid": "6f79b619-d611-4920-88d6-91f4daafd97d", "comment": "Malware payload (Mirai)", "value": "f005141d6c3eed38c3acb3c3bd89157c81aa9d79", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298606, "uuid": "ed1f81d9-ce4c-4b74-a2db-86319eb1b6e7", "comment": "Malware payload (Mirai)", "value": "958e5bc02a39e7e5626fc3da78fe55ab0b8b106c258d9e873e38fa425d6f49fdcd584e197321514021746799895f593d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634298606, "uuid": "293d6ac0-c5c7-4358-898c-6736138eda03", "value": "T1A5D32A46FB408B17C0C61B76FA9F424A3322DB5593DB330689185FF43F86A9E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634298606, "uuid": "b19e0c01-e900-44a0-9eee-66a0d6e5c105", "value": "3072:ed41dFnOf0k7QODqr1U/bC3TS4FUZdgacvwM/9rfPr:oAFOf0a2U/bC3TRUsacYM/9bPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634298606, "uuid": "7dee043f-8cad-4b2c-9fb7-41e1b2a29cbc", "value": 134423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634298606, "uuid": "a9cef011-d61f-4afc-acae-415a7c675dc9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634298606, "uuid": "71267bd3-62e3-424a-91ba-c322a79d339c", "value": "KKveTTgaAAsecNNaaaa.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bceec3ef-2d80-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634279149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279149, "uuid": "06c9fdff-07af-4cc7-a4bc-a7950f0241b3", "comment": "Malware payload", "value": "ac36e2d401e28f231c2ccb580add7742", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279149, "uuid": "52295f74-17ea-4d59-9a43-17f509d734be", "comment": "Malware payload", "value": "708a687ac41584ea1d8d567334ce441a5214aaa601c1a6214475144abbbd72fe", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279149, "uuid": "46f80288-2b7b-400b-a7d8-d11e263ba870", "comment": "Malware payload", "value": "820be6a472e0d7b2e6049a7034096d9d71b9fa74", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279149, "uuid": "ed681038-3f80-492d-9a8a-0934ef7d36ab", "comment": "Malware payload", "value": "69e19cb9e1003a660bdc6920f5dd72b0ad90120280f8c686fa839bac8b136548fb9d34e32f43d40250ba44933c24644e", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279149, "uuid": "5bbaf47f-8702-432a-8978-3e3ba2de5420", "value": "T16E01825AC1289913DE2F03FA440487F8D2B95740B6D55E8B6D64A7914D481BF6C52067", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279149, "uuid": "cfe7b06f-edf1-48b7-b5e7-3b2d14250861", "value": "12:5Kx6T1jVPxruTNwHV4JONRf7vJ6MxnjxFgrviQ/3VF1GKMxrwRta8VslxxKRtav:cx6N9xCh84kNRfLJHjx+13VF1GHxA0x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279149, "uuid": "ebe90353-e233-4d21-a6bc-a477d3fd1dfd", "value": 817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279149, "uuid": "d8bb05c2-3d31-4553-b8d2-73fdffa420bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279149, "uuid": "a8331625-42be-4127-bd05-d8f7f9446081", "value": "359168.783.30258.81261_857.62608.08524.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6530cd-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634300492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300492, "uuid": "8c90a5b0-e2dc-463e-842b-c5d096330b3c", "comment": "Malware payload (Formbook)", "value": "09710d31266539047ea06a076def89e0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300492, "uuid": "c59d9f3e-d6e1-43d5-b90f-3012a8e8e03f", "comment": "Malware payload (Formbook)", "value": "71674889ab48713edc93358506033b66eb4ee6dc45cf64275b786d05569ebda7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300492, "uuid": "4568e0ac-267f-4380-a680-fc8d527a1a5d", "comment": "Malware payload (Formbook)", "value": "75cc102911047ebddbe94dcfaf5b5a27aed980b2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300492, "uuid": "91d40b1f-f1a9-46ba-a27a-5db995f62f83", "comment": "Malware payload (Formbook)", "value": "a88294194cc8ce354bcb59465365c84bdaa0091cbc2c38c6390069f60f715810df025ebb4f610de30d2e510c338ee6e3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300492, "uuid": "6c4bf0b4-b189-4511-bc98-e64171e1f800", "value": "T170C4E08428C4B7AFDB23D9B54691600DB13FFCF1D82CEEEA48B875945AB2F31A4144D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300492, "uuid": "01d792ce-5319-489d-a1b5-f4a2cfdfe944", "value": "12288:SNynTLoskn63124a/fHV/73BNgIQvD/wQTkaK/RZrj2k8+B:SNgMX63cdHVv4DoQ3YxjL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300492, "uuid": "00c8324d-3c2f-475a-a5cf-4d7b3b867431", "value": 560296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300492, "uuid": "f302cd76-f2fb-4f03-b68e-8339ff46c5a5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300492, "uuid": "f384fd5a-3ec1-428a-975c-5881fed061a0", "value": "Bill of Lading 11402423.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad922f0-2d86-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634281668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281668, "uuid": "84901f62-f753-4b46-a4d0-cbceba439592", "comment": "Malware payload (GuLoader)", "value": "f3db46b0739301c317eecbdb00aa0a78", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281668, "uuid": "c16c06e1-de1c-4d94-b21a-f438757a3a0c", "comment": "Malware payload (GuLoader)", "value": "71980fbb34231915020512134ca38d3c5f19fcc463542e3106d5c73b02ffbcf6", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281668, "uuid": "bc29e5fb-c9f9-441c-bfc9-42d2b8332dfa", "comment": "Malware payload (GuLoader)", "value": "7614fb4393d2ef879f4d90a9bc93b2fdb76fe7aa", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281668, "uuid": "ae4c128e-17d5-4838-8525-8dbc8c26ef1b", "comment": "Malware payload (GuLoader)", "value": "09abd4fb3a94345c500cab0bdc80d4ac9a7f785e6422d1e47c1225380ace455af329162d1143b1049189d32a40004da9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281668, "uuid": "a1d217f3-ce50-417f-b819-b166d9b55d26", "value": "T1F26302A58C0FE3AF85AD092364AE837D7F914CF189A58B84B78D1C9BD4707350876F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281668, "uuid": "cd682fed-4332-4c7e-9f16-234ac4056e7d", "value": "1536:FTClrClYjp507SuP43gohCnz7kAKnIMmmZH7Y0s2R4fx:FKCWw4CHNKnI3mZY0sHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281668, "uuid": "2d5fa260-b6ba-43e5-8b32-004ded4d4cd3", "value": 68854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281668, "uuid": "b81d90b7-a5e1-45e4-85a9-8b365889a30f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281668, "uuid": "163c2f34-84ad-42c9-894c-64699880f482", "value": "correction HAWB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fab9f72-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634321056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321056, "uuid": "e562e204-741b-4000-b64c-6adc1873f62e", "comment": "Malware payload (Mirai)", "value": "6775051a34e2f0acef33fbe801ee62c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321056, "uuid": "44b8e992-c0f5-4406-b0a2-1bcf151ee1eb", "comment": "Malware payload (Mirai)", "value": "7212ef3aa7a7a8e1daee58a711cf5d06a4e2efa1fd9eff8d55cae065cd2651bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321056, "uuid": "5883217c-ea6d-4700-b5fe-a02493c47f2d", "comment": "Malware payload (Mirai)", "value": "849a9e974a47a23af005a0d4b5bc7c0248a0d13a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321056, "uuid": "a912e403-7bd8-4055-81e3-8f5e721b5a84", "comment": "Malware payload (Mirai)", "value": "0c40f31c6c75ff85c88d6820e5eacf477edfd4a3a3069a4758d583d7a36586eba4b3a289b57695eaa5bf6df5475794ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321056, "uuid": "4e51f54f-ece5-4b62-9fc9-5548b642fafc", "value": "T18A63F6753845F2ACD5E94078F4436EE92D1209283EDCD0E76483143BFF71B89A62DE9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321056, "uuid": "c488d05c-55b4-4a21-b270-814402035652", "value": "1536:BWq4mXBnUM+mxqIKoHIZVBIVCCfy0K9UpJ:dUM+/I4un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321056, "uuid": "8c379710-eccf-4dd2-9375-9b1a9f75925d", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321056, "uuid": "fd9b4fdf-0e50-4b06-9dca-a2b5a4cfa4e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321056, "uuid": "f82c15d9-37b8-4593-963a-874de82c0b38", "value": "6775051a34e2f0acef33fbe801ee62c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7cceba-2d81-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634279446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279446, "uuid": "4a240efd-7125-4eb2-9de5-e4a5d1a5a937", "comment": "Malware payload", "value": "69fc46b598f457a784750fa714f72ad7", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279446, "uuid": "fe83d9e6-f1fe-4c17-93f5-810044c61faa", "comment": "Malware payload", "value": "7230956f4c915842cc3985174a1b05906ef53308a4ae0755ca9ecc96fe400df8", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279446, "uuid": "ed305dc7-6397-4179-aecd-8697a9d3af40", "comment": "Malware payload", "value": "5b61858aaeb100db01826d55ddb7b73689ca26c8", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279446, "uuid": "fbe2faec-9cb0-4165-800c-67a988cc0031", "comment": "Malware payload", "value": "ed1ceb673bbe8347a53401be571b010cfd3d9adff76d2d4c3dcd62549ad025cfcc0d95bea3a9c9d7ab2f882e6e2969ae", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279446, "uuid": "26ca22e0-083c-4b48-8f7e-e6ab6e6dc6df", "value": "T12DC2E0C959652E68E71E8AB1A6B8F226039815047D0C856FBFF0798D82E6FF65B40C18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279446, "uuid": "935b3bf4-e69c-4b9d-b097-81b70a11cd94", "value": "768:1TEW+2XPTCQqXjNuCK/pb0lprro6G/z/tMIMYp:1TvXrLQNvspwrroraIMYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279446, "uuid": "b20daa04-2b43-4a35-a1bb-8b3b758180a6", "value": 27934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279446, "uuid": "5c06479f-4def-49fc-b18c-241be9a1e1ce", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279446, "uuid": "814529c6-184d-422c-a61d-69d756a8de15", "value": "ctfmon.log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357aba31-2d8d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634284505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284505, "uuid": "3c1a89db-5cda-40e8-b71c-e21d2951ad3f", "comment": "Malware payload (AgentTesla)", "value": "17277cfddf40767bdcb59d1fb94ba059", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284505, "uuid": "1f2f6698-70fc-4594-b83b-6efcecfc291e", "comment": "Malware payload (AgentTesla)", "value": "72455e04d1234af9ffeb7c73dced2cd582287ca397db6c2fe77ca6e45f5008a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284505, "uuid": "71189866-1ce5-4cab-a843-e53982f3a2a9", "comment": "Malware payload (AgentTesla)", "value": "3eff7cfd74f03fde5d88c6372dd2df6678fb323a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284505, "uuid": "c803a6a4-0f15-4577-8a66-d08d3fbfae87", "comment": "Malware payload (AgentTesla)", "value": "53fb5b1780aaef3162563d752b458bdc7904207a84feefd6c640abbe7b11e1bcc2f6247bb43b977bd3205108ce54f5e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284505, "uuid": "784ca5bc-0121-4091-a21d-46cb9fa04a2f", "value": "T14E74236199EFCD3E32D62EAAC3087551CBEC31130573AB617D9B19C4B2C081FED5662A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284505, "uuid": "9aec25b8-824a-4ed9-8c1b-b795192205a8", "value": "6144:2AxjQmpg5iVWQ0icwt+65A4nj+BuHkzQa8LIXvCsQcaghINDnepplfXCLkpVE3IH:2EjBsjicJGOoLI/VQlBUPfyoI3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284505, "uuid": "6f044d31-19b0-4ec5-9839-8295453389cd", "value": 345413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284505, "uuid": "c4049e6e-4deb-4824-b34c-9425bbac93d9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284505, "uuid": "1ea7b562-1791-4fb4-b536-9ddf2ae44ee4", "value": "2021 NEW CATALOGUE-Eaglesmounts.BZ2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307fe244-2d5f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634264740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264740, "uuid": "b0f2768d-b9b6-4e41-a4bd-f11bb9a1ce1d", "comment": "Malware payload (Mirai)", "value": "dbfdca27c874fa641adb0a66029d0b17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264740, "uuid": "acdfa671-7b82-492a-ab2c-ee27282f3b60", "comment": "Malware payload (Mirai)", "value": "7261b7a6bbb0fccdab7ecc26f53e3e3e2a04b2f007cfbab9642c1b6a3d9f5b5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264740, "uuid": "9285c06a-cb6f-4f84-96bd-586038198c42", "comment": "Malware payload (Mirai)", "value": "06f4a6363b9b527b175f72879f30d8b86bef8521", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264740, "uuid": "d0a8f389-bfb1-43c0-b9e9-92571e8516f9", "comment": "Malware payload (Mirai)", "value": "5735dda16bda5f6619b2fcb974b6fd47607e26da04febf989432ebc73aac94367934317dee0c8176e7b2428acbb2c289", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634264740, "uuid": "00896875-e2bd-4c3f-9893-c9f83eaa16fd", "value": "T11353F986B8819A25C6D117BBFE1F018E3316975CE2DE73128D141F647BCB95F0D2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634264740, "uuid": "09e16be1-a29d-405c-b6c1-66e47d449d59", "value": "1536:4dnd2Gvoqc/Ljzazt9otOFzVLp1pvCMLZIticljoQ6/:bVqGXzst9QshLpPWljoQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634264740, "uuid": "0de0af0b-d4ac-405e-84a4-ff61594c2c96", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634264740, "uuid": "2f48fd0a-3c53-4c27-9535-a9c264c590c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634264740, "uuid": "59c06465-a80c-4b88-b203-a8a79b4240a6", "value": "dbfdca27c874fa641adb0a66029d0b17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8329d27a-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634300526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300526, "uuid": "6965a9c6-c9a3-4c04-86a6-a006c86d6a36", "comment": "Malware payload (SnakeKeylogger)", "value": "5e42f2defcfbb847ef4f79196851f5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300526, "uuid": "2e2bc7da-e90e-4342-be1b-a898af3e9901", "comment": "Malware payload (SnakeKeylogger)", "value": "731e69b5c58c82ca85a2d49a2481d951f6092f26680b882f7b8c0389d29a0efe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300526, "uuid": "8b168e77-9e86-40a4-b365-adb7ed4df01f", "comment": "Malware payload (SnakeKeylogger)", "value": "fa79e61bb7761e5f6c3e62e9a752adfa8f138375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300526, "uuid": "6a6b2038-eee9-4845-b35d-b01a990dcec5", "comment": "Malware payload (SnakeKeylogger)", "value": "3538bb82aa537547dcf13390f8236ca022b420d48cd91f5d13e53dd90db586d6f9c68ece77e72b7f5cac9b906ca6f17c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300526, "uuid": "ae9451d8-0966-4a4e-b878-ee08ac3c2093", "value": "T1B1E4B59C7E25A77AEE1ED0B08482C6B47B130F57B244894B27CB3EC6B76A1511C79EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300526, "uuid": "c65427e1-1e66-46ff-9412-5ae58676568e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300526, "uuid": "e3d0450c-bbb8-47e9-8d35-13376eb19605", "value": "12288:pyLxO4oOeAgFdHO7nOYZG0pAwNaSctMX:8oAgFdHcOYZGGEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300526, "uuid": "0ae462a0-e25b-4786-8ee7-1fb01ccbce63", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300526, "uuid": "ad89959a-5e0e-494e-8f10-c261ff56ebae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300526, "uuid": "d6c9d636-fab2-4184-b822-fb5b3df54457", "value": "New_Requests_5011555089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b22c50-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634301066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301066, "uuid": "a6118973-7dd3-4cfb-8f44-cda3bd8ca143", "comment": "Malware payload (BitRAT)", "value": "843ef5805c67e4c8ab6eff537b88524c", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301066, "uuid": "1f2a5905-daf4-4088-b82b-26b5e92cd2ae", "comment": "Malware payload (BitRAT)", "value": "74ceabffa2f56bc92e1fc4b30053f3d57081ea9ecd183f558d38ea7d45b25022", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301066, "uuid": "70e599db-9c7c-4d9e-b891-dbc5f340e9fc", "comment": "Malware payload (BitRAT)", "value": "14c08da157617dbce98665c63e9140e131b48b9b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301066, "uuid": "79c4e9f3-b175-4cd0-beb7-a627bc4a1941", "comment": "Malware payload (BitRAT)", "value": "e54db492ce3bbde9f2cac2163496f61e99f6ab31b534378191b6b5aa2b28a33ddb97d6df2eb6c08ae7f6b27f0c98806e", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301066, "uuid": "513cfb42-da48-46dc-b152-48a68c0f8ce7", "value": "T1CD7241013068F158F763E642479BEE216BCFB7D0A3395499249423A46EE1E834A62F1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301066, "uuid": "4ce490db-e40e-4db2-9bfc-d17083d91c76", "value": "24:PErQupG5x/X6X6X6X6X6X6X6X6X6XPXaX6X6X6X6X6X6X6X6X6XnX/tXMQOXaCXD:8rJG5gFcQv90oYGM9ToJMnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301066, "uuid": "745a85b4-5a3f-4a0f-a755-8679a324095d", "value": 17126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301066, "uuid": "17e0dd6f-5c08-47ee-85ea-2d6b8415f3cd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301066, "uuid": "5621fed5-0848-46a8-a582-ebb673193e5b", "value": "PAYMENT COPY.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1301dd24-2d61-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634265549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265549, "uuid": "ef82b924-9619-4ba4-a530-dc84d69c86c2", "comment": "Malware payload (Mirai)", "value": "1523dda71d4a67f796e35578ac031902", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265549, "uuid": "6e09134f-be44-4f65-84ae-08ac59bf3821", "comment": "Malware payload (Mirai)", "value": "7535335a7b034094b419d2b957829940e04e61772c4ed2734bf95b0cfb31a8f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265549, "uuid": "b1a71875-52f5-4e40-8c49-3fec2dc459c0", "comment": "Malware payload (Mirai)", "value": "c109d567ec353e53f9833a9a4ecd95bd51f4f5b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265549, "uuid": "e95a8beb-f4c0-4d93-9e2f-969a167f49fa", "comment": "Malware payload (Mirai)", "value": "97a9edf03606647cff6af47a2a60a58a038c25357abeaf09d9e459a8d617c942e098a37d74b483f3af53cf688189159e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265549, "uuid": "bd9d5904-bee5-4339-b5af-48a09a17ff06", "value": "T11943F7C17881A626C3D05377FE5F018D33199798E1EA33568C295FA47B8AC1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265549, "uuid": "253827c8-9ed9-4c75-ba97-00da3cd2cd23", "value": "768:K/9qJEBv+zFvDLtU07KuucD056SRmYKrI4ekVrZBfV7nKbwvTLwCVy/rCxHghW1A:Kq+WFbpnJYKrnj7nKEShW5i5m//zqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634265549, "uuid": "b0c4b9ba-5c05-4a49-bdde-ac3b4b59b447", "value": 56332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634265549, "uuid": "f71885fa-90c3-4373-b0cd-42854a154aec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265549, "uuid": "0ddce1e8-ac45-4928-8acc-e67057cfc621", "value": "1523dda71d4a67f796e35578ac031902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ace95c-2d92-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634286624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286624, "uuid": "1b2219f1-98f4-45f5-af67-bdd5d28707cb", "comment": "Malware payload (SnakeKeylogger)", "value": "c843ac022eed05fb12eede5274dbf9d2", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286624, "uuid": "3952efd0-e73a-4914-8f2a-62a3c57ac49d", "comment": "Malware payload (SnakeKeylogger)", "value": "757530eea4bf8409e6d2408d7064e77dfa7ee2b8bdc2341e560f98014b18c7e8", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286624, "uuid": "beea3a93-f7dd-47a9-98cb-63fed25031fa", "comment": "Malware payload (SnakeKeylogger)", "value": "1719140c7baf67c0fa9067d9d2461b453af8cffb", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286624, "uuid": "19d95ce3-8fe4-4506-856b-951f85c1f78d", "comment": "Malware payload (SnakeKeylogger)", "value": "342d5fa5f61b6e0be1d6552a6e7e597ebcfb473c285ed12b2672f10e789b0fd9b9a377283497f8736adf830550bf8ac8", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286624, "uuid": "8eaf5240-5e01-4b1e-99c0-347c031e19d8", "value": "T1F8442208B79B7B351D6D8B91B216C5DEC94C60609604C7FB0EF88BE26C31D2BD96079E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286624, "uuid": "d5cc1362-a868-4252-89ac-cede97fcc6c0", "value": "6144:8ac44hIdcyoD9K3lE0sNaSoJRBUJgPQUpR5rrgllMaO8IzDfLp:8944yq7D9a+//oJRBUJgPBtrglSaoDjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634286624, "uuid": "87e346a5-5dc5-4364-953c-4f51af270baf", "value": 270096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634286624, "uuid": "781d47ec-8553-4b32-8e3c-7a7c765f1608", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286624, "uuid": "87773008-9360-460b-85e4-d2fb31f3caeb", "value": "Sheets007911.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbea746-2d5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262564, "uuid": "120ee117-d100-4e73-a5a3-3c42961c90c9", "comment": "Malware payload (Gafgyt)", "value": "28fc2d25a63c17ce9906ef6b5e0af457", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262564, "uuid": "c55ebfba-9afb-4ef5-a281-1fb8af8c8f61", "comment": "Malware payload (Gafgyt)", "value": "7645f980ab077c03baf16068298e4f83f34a37924d0a64bf420f5c6b5ce68e91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262564, "uuid": "27f23032-1956-4ddb-92d7-4f6d92455003", "comment": "Malware payload (Gafgyt)", "value": "4931477688457baf7f3b1069e381cb0b98eae22e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262564, "uuid": "28e2ecf9-fe23-4b0e-acfa-a1cf5e34095f", "comment": "Malware payload (Gafgyt)", "value": "472206aa6f8bcc48ff58219731f5e52efc9a8096f3e4e22201f3c89b81cac726a1abf7542a7ec7f45bb23cc7f8b11ed4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262564, "uuid": "e7c47ec7-cd2c-44ab-92db-3a8da1c5dfdb", "value": "T184F33905E6408B57C1E2277AE6CF824D33339B94A3EB33155938ABF43FC27991E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262564, "uuid": "c2b0040a-af91-4444-ba81-b96202770eed", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvB4YnyLRM/91RzmFwfBxKQodn:hg2hNNlzIkk/MOa/6YnydM/9fzmFwfBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262564, "uuid": "d13b3c26-548f-406f-9ac6-3f8a64d57738", "value": 159889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262564, "uuid": "8562ee60-f8c8-4e80-9577-130d1bb9b9a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262564, "uuid": "8a8f92e8-76f4-45c7-8dbe-1de074d947cc", "value": "28fc2d25a63c17ce9906ef6b5e0af457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b15d7b-2de3-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634321492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321492, "uuid": "96d8e291-1a1a-4cde-bfc2-6794196e1e25", "comment": "Malware payload (AveMariaRAT)", "value": "d91e915bf5abd3695cd7f2266085f028", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321492, "uuid": "23c9c38c-9e62-4509-bb0a-8a9574aadd9a", "comment": "Malware payload (AveMariaRAT)", "value": "769e0535be94d49014ad1172bd657142d54f43e963d0805a11aedc0f42260cbf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321492, "uuid": "83654bbf-88f1-4302-b984-350f8d1f6d9b", "comment": "Malware payload (AveMariaRAT)", "value": "0cb87274fa9ef0c70e9e36773c770562dcbb2546", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321492, "uuid": "f2cb90d7-b9e6-427c-9b45-5add8b4c319d", "comment": "Malware payload (AveMariaRAT)", "value": "cd55051f306cf0bdf9c22ebc9f1e0dfbd3b0bc2bd4225e306172faf449cab33ef04e8fbc3bb4bb1ae07029674f74ac49", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321492, "uuid": "7a403943-c8bb-4764-8b08-4d7ad723d6f9", "value": "T1CA345BF89C33D9A8B44961A7F9C1A48514D33CE8716ECF944128BF7735E24A4DAC889F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321492, "uuid": "084d1c71-4c7a-4d89-9ed8-cc352fcde883", "value": "1536:u0RFPyaKSmfnDIYPqP3NUUS1mzIwGcNub+PwBdpuWhJq/O0giEa5QE4EEIEIEXEh:u0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321492, "uuid": "eee15a2a-c7bd-4221-a071-40ae884c7c6f", "value": 251457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321492, "uuid": "f14f8b37-433b-4abf-b682-5027bef243d7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321492, "uuid": "1be8ac17-0b10-4a63-8903-c8e43e920cfd", "value": "Shipment Document BL,INV and Packing list.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde06b94-2d92-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634286908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286908, "uuid": "51884739-0dbb-4a19-8d9a-54c537336a1e", "comment": "Malware payload (Formbook)", "value": "0843bc912b1a4b9a4f41be4fb5f5b3ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286908, "uuid": "50303bc3-6647-4648-a4eb-8d8af12e7c1f", "comment": "Malware payload (Formbook)", "value": "777c86a17146921e06f4ac7ab01da50e0e3fa657160bcd49e8c99c63f3bf4de4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286908, "uuid": "7ecb4de9-1903-421d-a328-168b4bf897de", "comment": "Malware payload (Formbook)", "value": "68c8657051a0bb979d0c1db69be0488b844f391f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286908, "uuid": "de1841ad-2530-4427-bbd1-ca388101b9d4", "comment": "Malware payload (Formbook)", "value": "828ac6676beaf4288c5b1cae047d15ba8740791d18fcf0fa0bcc6d0e166bc5d6a4774e46ec1ebdada7bb8e95770282c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286908, "uuid": "122a95d6-4aaa-4091-a34f-14a6cf9d27e7", "value": "T1BF94CF98769572DEC817CE76CA681C64A631757B630BD30BA05322ACDE1EA87CF111F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286908, "uuid": "51189cbe-5b0e-4e46-961f-ed698f5e3a37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286908, "uuid": "749f2ab2-2578-441e-9e70-2e7ca35437e6", "value": "12288:/3wSBi85FyJtYP9gN+2w8WvZ7QY+Ij5KikZ03QAXKP/33IX:/39BFUMgNglvZjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634286908, "uuid": "63d4818c-f0fa-43ff-94cb-8ec01423b9fc", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634286908, "uuid": "aacd83b2-693e-4d72-b49b-7884cc9b90c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286908, "uuid": "50e5f9da-f657-47f5-9745-618a9d6e142e", "value": "0843bc912b1a4b9a4f41be4fb5f5b3ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0116390-2d80-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634279154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279154, "uuid": "ca3623f9-721c-4ee5-8033-b0af05713dbd", "comment": "Malware payload", "value": "57050773638b46dfc5f60930cd1cb266", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279154, "uuid": "67c4ff0b-70ec-43ad-8fbd-1f001bf8e5f8", "comment": "Malware payload", "value": "7ae01fd7aa0b5898eb36548024f2cc8156216322ea6402eb8f04180adfc9539d", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279154, "uuid": "76a8e234-1748-41f6-93e2-183d4014a9a2", "comment": "Malware payload", "value": "3219f88ea28c525eb35050939d2ecb01d6fa7282", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279154, "uuid": "00ceda19-3c5b-48c0-9d06-1e2aa48e2227", "comment": "Malware payload", "value": "77ebecdb366464001ec48190719455293bd0b9c72523c0d94d1781300b882955315b87e1e29079ec8bc2e5e71bdb24ab", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279154, "uuid": "73a7c7b9-c406-4526-aa74-d96126ca420c", "value": "T1C9F097990BB027C8C094173FC4798E54A67A2D9F8D807B67B2D9A994D0084D0BFE946A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279154, "uuid": "938d07cf-9f38-4835-ad5c-5905f4aadb67", "value": "12:8DpOB+PlyWfgEV75FRh0ZAVnbF9VowwdGrgSh+Y:8HPlDYEVbF9VlL/+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279154, "uuid": "ffca28fe-21f6-4f90-b9bd-8b58d8dc6ca8", "value": 561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279154, "uuid": "21045fbb-f025-4e56-b671-4997ae00eec4", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279154, "uuid": "89099b99-6cf0-4b74-a49e-6694e4dd830c", "value": "3219f88ea28c525eb35050939d2ecb01d6fa7282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafcd1d9-2d99-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634289883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289883, "uuid": "496ee009-b8b6-49c9-b376-78ebb8d71047", "comment": "Malware payload (AgentTesla)", "value": "ca489dd8f8d050f3d98b46a7f7df00f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289883, "uuid": "20106bc7-a9d8-4a8c-a401-0958009fbcd6", "comment": "Malware payload (AgentTesla)", "value": "7bd68279cf4cc59ba39b3d6709bae5312c55b880562ad88b606516d415b2b8a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289883, "uuid": "e2edad84-a52b-4c86-b3e0-88a7e37fe5e6", "comment": "Malware payload (AgentTesla)", "value": "b02283b6c1b144a3835119ced3a4b986e665cb1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289883, "uuid": "c73af345-7477-457f-869b-b948a76246ad", "comment": "Malware payload (AgentTesla)", "value": "444e9dda1094c110fa760db2f1dfe5b874c33e017da19d44ab444281d7b659ea5db78b51a615b7e21914d6c06e661fd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289883, "uuid": "1fc5296b-adc8-4d06-9f3d-16ab4da393fd", "value": "T1F3B4BE13B99CA2ECDB6F5AB464709E623270AD736E13C608B5C4736CD9722C5D2087F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289883, "uuid": "7da29ac5-1042-4a3f-a0d9-8f3e5462f619", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289883, "uuid": "0b82ad44-fe47-4b64-9d94-4e79f6f6a049", "value": "6144:Dm0gMkhBXBQCdHQaGxxwc17dYhk5CtNvmoXU84G+R0AZCDdHslEDlURTG:fSBZ+V17dRqeoXUjbG5suWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634289883, "uuid": "2b5e3d81-8b19-4be2-b005-3c639635bb37", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634289883, "uuid": "68f355a9-3e1b-4ac5-83cd-ab542c1e291b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289883, "uuid": "9a9bc7a9-2f86-4d06-9a71-ccc547153f0b", "value": "\u91c7\u8d2d\u8ba2\u5355 _6376627627737_______________.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4c4dc1-2d84-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634280891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280891, "uuid": "73abee85-f9ba-449f-a8e0-a2ce1856dedb", "comment": "Malware payload (Metamorfo)", "value": "f9c6c290a49fb1406846e306ed78642d", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280891, "uuid": "7bdbeb77-5d3a-49e4-8ffc-fb7e5e841ef6", "comment": "Malware payload (Metamorfo)", "value": "7c6be664ab81c2511d952c49d9c008464d5ac5dfa8b1650caf63d1d6c4c5348f", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280891, "uuid": "604da11b-a289-4987-9be6-0215ba193eae", "comment": "Malware payload (Metamorfo)", "value": "33ea3532fa88f2ccf6ce5120d23d5a9b47b47e71", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280891, "uuid": "d1788d5b-6b68-4914-b86b-9afceceb9801", "comment": "Malware payload (Metamorfo)", "value": "ff6ce4a589294118eba9abc91798c73883d4d0f81baf5806df95eb658670719fc9e55c241cdc20ed06758704a3a5fd62", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280891, "uuid": "6e823dc1-7876-4895-88fd-5953fec43f64", "value": "T17C31D0092AD70726C3F3CF7A10B7A2428A76BC51ED939F5D418487CA1865505FC35E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280891, "uuid": "0391e6a3-c85e-4e55-b20e-63c7b02821a2", "value": "24:8zJF7oqUa/kQRbAkO+/P+PLOMw41cVExqtpXQaR3+habMq1UHktoiB6N+/xmt:8zX7om/lMCK1cGxqtpXv3KaIqiHkb6NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280891, "uuid": "277c9530-afef-4eb7-b7dc-44d987b73bc5", "value": 1526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280891, "uuid": "f0eb406f-412f-4e0d-9c83-ec8bf93feaad", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280891, "uuid": "2f4b0e8b-9320-447a-acb2-0e156cdb4d6d", "value": "Anexo - 1410210054.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b5f9a8-2dc5-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634308715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634308715, "uuid": "d6040120-d896-45a9-a7dd-de5b1dc9418a", "comment": "Malware payload (Quakbot)", "value": "dbf66cf845c6af2445cb611215c84282", "object_relation": "md5", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634308715, "uuid": "dd601b1f-0c76-461b-87c9-6013232b5d26", "comment": "Malware payload (Quakbot)", "value": "7cd8216e129493641bbe7f573b13425bcf52923bad83ee532abd66fed293d9fc", "object_relation": "sha256", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634308715, "uuid": "2f7a9470-d0e5-4dcb-bd37-50a52423a4e5", "comment": "Malware payload (Quakbot)", "value": "ae1c4b5d117e57bf8d541edab0e0bd100db07ea1", "object_relation": "sha1", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634308715, "uuid": "223501dc-a43b-4fc6-86ec-044d2919ac60", "comment": "Malware payload (Quakbot)", "value": "8a5b449d827807a450b7f4eca323c0701f44f65c7c359cbcd7c66424738c66beb08a8735d20257cf777796f55e45a0a2", "object_relation": "sha3-384", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634308715, "uuid": "44e2f27e-d720-44c9-8cf5-4a646e6a4964", "value": "T1B9159E2132A1D015D027743ACDA1E0F81B9A7C258E787C4B31D93F6FAA7E6C29E0575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634308715, "uuid": "6b49e4fb-fce4-4ce4-bd89-7f257e9977d9", "value": "f91de5efd2cec623341b057ce3d397d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634308715, "uuid": "ceee1590-03da-4224-a0c0-9c4361b857e6", "value": "12288:dU7AzcO18OcZtc98uEE8aPfR6xa7jg0Ii3pSGdSJbbIclZg5i0WBRLuMdgX2rbnj:GAzcO1T0yfR6lxcYIYZDqM9n7Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634308715, "uuid": "033f36e9-bba3-42ad-bdc9-6bbaf6768e75", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634308715, "uuid": "59b6cb3f-4ba4-456d-81d4-7861322ec7a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634308715, "uuid": "10a9b2cf-0f8b-4142-91f4-144b2cd61d67", "value": "1.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e24dbcd-2d87-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634282050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282050, "uuid": "9653d638-627d-496b-9d1b-f88ef19fcb3f", "comment": "Malware payload", "value": "d3cca23661c1dbed873738b5b3139c17", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282050, "uuid": "2fe5abc5-d2c4-4833-a351-383200da67ae", "comment": "Malware payload", "value": "7ddb396891451029c2974391c477e943b373eb78f0f5ac56a80e1e887913a65b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282050, "uuid": "081b9fca-a581-4053-983c-acfc3089a355", "comment": "Malware payload", "value": "b898615a181e439b4a70bafa751a9161fc23b6fc", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282050, "uuid": "79f904b9-6557-4307-bd14-526b9941e32d", "comment": "Malware payload", "value": "13b99009bb0d50665212d0c3e536a935a61e47ad297bf0a84f888d53f5b935c98e93b03db67f6c8a75df999ee98b0d3a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282050, "uuid": "e9f35500-b72e-4b0a-9d38-f6d3e3570452", "value": "T18DA423583D9C7E78D4FFB47585E83A74DF2CA11C2982A09C2EF4256E0E66DD022CB358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282050, "uuid": "95772ffb-5753-4a16-b2da-4a2d05f20e43", "value": "12288:HOhmt51spL11E3VShd+qr1svgrruWS4Lf/LYxc3I:HII5sJ1iVS/fr1ugryWS4Lf/LY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634282050, "uuid": "91e9f2d4-05e6-4cba-acd3-2f94829f6ed0", "value": 454791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634282050, "uuid": "4c8c7182-498c-40d2-a96e-148ff8784c28", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282050, "uuid": "17616c7a-7ed1-4d4c-bcc2-9afaece5fe08", "value": "kuronekoyamato.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6b8dbf-2d79-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634276173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276173, "uuid": "b38f0a5b-180f-48a6-92df-508231007a6d", "comment": "Malware payload (AgentTesla)", "value": "717f8592d62935d143b96310c6b5732f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276173, "uuid": "7ef43cfb-62ed-4df1-832b-a6fe54c5f20a", "comment": "Malware payload (AgentTesla)", "value": "7e4f7912a2422387613ef544deba8bbf3c2508206153f74b1ccbb40b85bc8a4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276173, "uuid": "7c27d265-7da5-4d76-9caa-fe3f59cab452", "comment": "Malware payload (AgentTesla)", "value": "15dc0e711fd9e2d8ba1f9e2fa0a7f70affbcd00a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276173, "uuid": "7f42bacd-1c9d-4c1c-95e3-c6c5b58066ee", "comment": "Malware payload (AgentTesla)", "value": "51b9983934c22289f9649fd53bf328b62eec615faabecc689c05cf43e0e42721f26c041f30f070589d2d3be894266ccd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276173, "uuid": "522acdcb-6bae-4ca4-9dd1-5ba996ca7c4c", "value": "T13545CF647F89D84AF36A98785271DF44C73E664B3713C625E9BF507A93A8B803CC2187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276173, "uuid": "b286dc26-a8f2-4ae7-aee0-c75d3f2cc14b", "value": "12288:2t7WyuqDnhdETTtplYjEELNxMd9/rFf8OqAtPkSBY6:oqeTEFplYgKNSrFfWgP5BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276173, "uuid": "cc78853c-2ad6-4f83-9bda-87c02fbd5471", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276173, "uuid": "817348a3-552d-4da6-a3f0-969aa7347888", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276173, "uuid": "7654216c-3a71-41b3-8011-a3f4540519c7", "value": "New Order 5225198491.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae2786f-2da6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634295439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295439, "uuid": "ca014b11-9a69-4cc5-8e2e-601e0bef56ca", "comment": "Malware payload", "value": "bd12b3601bd72416d9520e41963125ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295439, "uuid": "3f361bf8-fcc7-4906-91ba-ff11ffbbfc2a", "comment": "Malware payload", "value": "7ef9667e73b84b6a031e28b6279e04cd8abe82d69cd836043a7cfe0978cb8a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295439, "uuid": "63f23aa0-40b7-4684-9b4f-5c19cae9f7de", "comment": "Malware payload", "value": "de0ce050117639effbce198f6e3d5f72c1978352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295439, "uuid": "7e11f0c2-9cb2-4dc4-bfe7-4a08ce373fa4", "comment": "Malware payload", "value": "62ae510682b20a6c59402cbb379905e19eea15e02f7da2361a27e1addf5adaff82957c71285c91449ddc14c4fa46fc21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295439, "uuid": "3d3a231c-6657-417f-a08b-bf9585f98726", "value": "T11CB56B42BCD624B6C6BAE23045A292A136717C650B237BC72E85767E1E76FD42F3D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295439, "uuid": "a12b4dea-4ce3-4e6e-ad32-72d3e0431f91", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295439, "uuid": "8c9a7fa0-0e44-4de3-b46c-6eb94d551703", "value": "49152:kfn0QZ9e7GSUYBGE1siw4y9fvBfQZTowhO+8L0N:uHe7GH54yQVowh8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634295439, "uuid": "43611a64-115a-4fda-a809-4af92be5f26d", "value": 2457088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634295439, "uuid": "97fe991b-0cab-4b71-a69d-0ac102a408b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295439, "uuid": "1c4c4fc1-1c5d-4638-a075-dfe6ca39961c", "value": "goransom_windows64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4611a8b3-2da2-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634293552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293552, "uuid": "5452b610-91dc-4db6-a409-6a1be6f32430", "comment": "Malware payload (DanaBot)", "value": "4dcb2dee2d9fdedb4e674467886d307c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293552, "uuid": "0d5d6424-4ce8-4b80-9905-90f199458d60", "comment": "Malware payload (DanaBot)", "value": "80bed6ab0b5b8714354e174beb3be2c10a749dd8133c2e74f3ebdb4936e6f411", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293552, "uuid": "0b4f0d14-ed4e-420b-9c08-d1892106f499", "comment": "Malware payload (DanaBot)", "value": "93e73077957479b980bf710159314cca0ff2cb6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293552, "uuid": "3b8092a2-ba3e-4430-90f9-6bb68e8f604a", "comment": "Malware payload (DanaBot)", "value": "53ece872e2a736e4ad114b3925f73aae7a181c5659841999544ec4006b8bb07eea30ccf8592d0f1c8d66296273dfd7e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293552, "uuid": "ff471121-b2be-4ad3-9d4d-6c8913303b9a", "value": "T14756335428DDFC50FDF98639C9765EB38802BFA58BD0D10A5780FE1F3CE1A07A1A1996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293552, "uuid": "3fcda638-d38e-45dc-9153-21d60c6d2743", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293552, "uuid": "0ad9169c-0775-47c8-bcd2-bb4a7bd51d6c", "value": "196608:HNTKHhFYysPThFzr8n2s+gBgcGo8BDPgf5x97gkq:HN+HQxz0n9iBgfX9Ukq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634293552, "uuid": "d4ed8331-ea61-47cf-a0e4-f0dcc8e6674a", "value": 6325366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634293552, "uuid": "e5861ec1-8bb9-4354-ace3-c0251eb6e304", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293552, "uuid": "a447380d-5592-46bc-af2f-e269fbc1c9dd", "value": "4dcb2dee2d9fdedb4e674467886d307c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4688c961-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634300854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300854, "uuid": "618b7afe-b787-4cd9-b71c-47e65517ab8a", "comment": "Malware payload", "value": "678d3f812d74d81d138f026156c10687", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300854, "uuid": "8a1b6ace-1894-454f-beaa-bb72df255c5b", "comment": "Malware payload", "value": "818bbf28ed1b57f6b62a4a4cf4260f51089cc68b4ec0dd040c296e6671de872b", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300854, "uuid": "923127d2-27be-4d22-acef-ec35796fc75c", "comment": "Malware payload", "value": "84fdae341ca87570f306b1c3256f0e551cd2cfe7", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300854, "uuid": "e5b88a6e-2206-4836-9a93-e3d37f160c85", "comment": "Malware payload", "value": "9e1d06d5dba1b64d8b13ae37692c2f6d4da17ed2c38f398b1326da45a81334549fcfd8d2451e54633656ed2be57d5ec5", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300854, "uuid": "958fedec-7803-4f2f-987b-174f0d08dd44", "value": "T189F3AD55B290E956DA5417320CEEDAE53732FC159E67830B7294FB1F3E333E0861225A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300854, "uuid": "7d7173ee-3895-4e69-8053-558f500e7ec5", "value": "3072:ZFxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAOeQjCWdeejdsREUZgR3oHOj7tYWfL0L:fxEtjPOtioVjDGUU1qfDlavx+W2QnAOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300854, "uuid": "448bf231-9697-4993-b5c0-d506a4fa9b58", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300854, "uuid": "db1ff696-467c-43d4-99da-f2d395ac8ff5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300854, "uuid": "da11fe2a-0815-4c98-960b-e11ca1572860", "value": "Odeme.swift.Telex.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c468d1b4-2d82-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634280020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280020, "uuid": "b1a64b38-b6d3-435f-9884-2994f976c70a", "comment": "Malware payload", "value": "c0eb2bf6e15fd395fbf07a1648a5a914", "object_relation": "md5", "Tag": [ { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280020, "uuid": "19e453a8-7590-447d-956a-acd7b7fce652", "comment": "Malware payload", "value": "824588324892fb7b7d7200dcaf002cbd15df4c693d08efc84a5b2078faa4ba75", "object_relation": "sha256", "Tag": [ { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280020, "uuid": "782583dc-8de8-4f50-99bf-e73ba86fc260", "comment": "Malware payload", "value": "97afa03883943472b12c728213602ff4acd42430", "object_relation": "sha1", "Tag": [ { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280020, "uuid": "cb9865b2-b3f3-441c-9874-01251a5c22b5", "comment": "Malware payload", "value": "f85c9ff3f835134ba0e9e99213ba46d4d02b713100a162a4249d344ee7a998ccd2e8cec214ac24a66ec6fb954bfa1fe6", "object_relation": "sha3-384", "Tag": [ { "name": "bitsadmin", "colour": "#885359", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280020, "uuid": "cf69955c-b84f-4517-a0d8-8795de6027f0", "value": "T1FB4295AC243E874BD5B20635E9BA8D04FFF1242B649485F7BCD085686B7157432F6FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280020, "uuid": "b1abdc6e-8d7c-4029-be65-a0d3c48ff886", "value": "384:I3AC0gWfMjgZZMVwkrVYzu6XRnxe8CZeiwsrKRJPEWylVb3mwjG4A2wE7qhEyUfD:k0gWfMjgZZMVwkrVYzu6XRnxe8C0iwsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280020, "uuid": "4c3903aa-05a4-47ef-8d00-aa7703eea0f1", "value": 12867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280020, "uuid": "a8e5b457-e638-4589-9600-13524639b3bb", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280020, "uuid": "e8b30b3f-65b3-4b02-a40c-22a0f15664f3", "value": "c32aa480-c437-4070-84b5-1189acc5ab57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db707b7-2d5b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634263205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263205, "uuid": "c8fc7c98-5d8a-4e9a-a19e-b0f09ab357af", "comment": "Malware payload (Mirai)", "value": "16102ca6b676fe2aa77d73db58942a00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263205, "uuid": "8623d12b-0048-4e9d-a62c-6804c0a40718", "comment": "Malware payload (Mirai)", "value": "828a12014a41b30bcc36011ddb2dbe479915ecf8da867bd91a11013b287f4029", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263205, "uuid": "71a2e667-a650-4370-89e6-6c620b13fb60", "comment": "Malware payload (Mirai)", "value": "d5fbced7efcdfa93eedaecd1506bb29c9a1e832f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263205, "uuid": "26c12197-198d-4aff-9105-166dafad2be5", "comment": "Malware payload (Mirai)", "value": "3fe8b0ed3002636bbc7a6e2556d0b9951a138f4d24e4abc264e158d32e040d2539f00bd3749be88297e37780d721893f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634263205, "uuid": "12fee9a2-5fb3-4b79-ac48-26b604d82894", "value": "T1A62329C47482F9F8EC15057C317AD7729EB7F43A703ADDABC39994239815A01AA072ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634263205, "uuid": "16827def-0bd0-40f8-95cc-626cc7023d6b", "value": "1536:SZ4pyHAH8TgbrnOIjuqxqBNcnvkm92kdrkEU:qHAH6arnOIjugqvAvkmAkZrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634263205, "uuid": "d13fac7b-75db-4066-bb77-66c6bbe8924b", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634263205, "uuid": "bf40f7b5-e78d-4d33-acd9-e3aeeb0ff5b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634263205, "uuid": "8f5bdf18-76cf-4c22-be32-675a98db7f06", "value": "Owari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c143c7-2d86-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634281824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281824, "uuid": "7f270fb6-d824-46ea-a812-842d29233e01", "comment": "Malware payload", "value": "46f72bf255e49386c7d6af6d116b9557", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281824, "uuid": "cfe86e1f-8a05-40da-bbf1-58955ad752a5", "comment": "Malware payload", "value": "82fb6088a9531991825fb4464ce197e4304cf3c3003d7acfdced2dde11d0fc27", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281824, "uuid": "2e372d8b-f732-4963-925a-d9bf16de0135", "comment": "Malware payload", "value": "893d5268b057dd5f2bfb084df7c3d02a7b43f7ee", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281824, "uuid": "b501736c-cdd2-44ce-8dcf-d5884174640e", "comment": "Malware payload", "value": "c16d2af63ba90a5f2a2f8e1dc196901110d36106f1a83cef5f06b95c27c640852a0ac50a84bf60232dc428da9270763c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281824, "uuid": "4a869c85-cb48-4ce3-a91e-40ad79cca05e", "value": "T147429D7AC681F16EC386987C5A3DC2F0EB440906C261E40F7105B64C5B608AB5BDEEEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281824, "uuid": "9c5c1588-7365-4aa1-8a5f-8c45bf1d1edd", "value": "192:ScIMmtPQx4CDB3Fcf8CY05bv/0iptiPsHrWR41c57Qw:SPX42EBVZlMDiiW75kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281824, "uuid": "879aa0e7-41cc-43a8-b7ea-f7ae686d9440", "value": 13030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281824, "uuid": "d76091da-23b3-4cea-847c-f9ab85cec124", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281824, "uuid": "ef09162a-88f0-4b8d-a33e-38dfe8530634", "value": "CONFIDENTIALITY AND HONESTY NOTICE - Copy.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5b1329-2d90-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634285863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285863, "uuid": "466efe87-4368-46f0-b610-e3a510df20a3", "comment": "Malware payload (Formbook)", "value": "c1334561fb31974921383dfad2583192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285863, "uuid": "48ad1911-7246-4bfc-a57b-a790e833e207", "comment": "Malware payload (Formbook)", "value": "8436ced3953396414f8b719973ff09140f3909e188260e226c7b4b58fa39ee44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285863, "uuid": "7336f189-743a-4ec2-8627-edbaa163503d", "comment": "Malware payload (Formbook)", "value": "2068527228a3a742623ae471645dc86f1d82ce0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285863, "uuid": "fe114afa-af4f-488c-8876-e38844df2f38", "comment": "Malware payload (Formbook)", "value": "2288943eeeb07e11a07875ede018487511d0ee70a7e2410edace611b374fdd5d228c5a5078b8eedfbf1ddd78792680fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285863, "uuid": "cdbd3425-81cf-4975-80fa-b695e5db38eb", "value": "T12074012072FD9259C87A4B7A1CB602E567B97AA73F01CB1F1498228C9D73B4787117B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285863, "uuid": "a983ec3d-d0d0-4bcf-b561-980336dd4f98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285863, "uuid": "a3ecc66e-8a8c-476e-ac2e-b2e8dec71308", "value": "6144:PWoxgMkhBZUJNGGVrl66B4De9izV5owUUrAFyF+mwzamGB/q7SBT:PNSBa5V566WDFV5owMF++mmanPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634285863, "uuid": "3faf34d7-4b42-47cd-a46e-97114d6ce39c", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634285863, "uuid": "eda2afa1-8175-4dca-b898-c86487fb9bfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285863, "uuid": "cbd0b862-5e2e-45c2-b43f-bb0af60763a2", "value": "Payment_Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15ca6e2-2da6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634295557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295557, "uuid": "e1ee48f4-db56-474d-86ad-7ec4853c15a7", "comment": "Malware payload", "value": "0e3dc5ad55829e35e8b0b668fffd2658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295557, "uuid": "1df774c9-31c8-4763-a75d-91acb9a1ff14", "comment": "Malware payload", "value": "844e4b052686851b8d4312c509616beae70398bd59d0c22468d3fb48145296d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295557, "uuid": "9cd3433b-6315-4736-b9b2-961fbcc6e7fa", "comment": "Malware payload", "value": "c23d17a238e678cf47386f9e7f61085678844ad1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295557, "uuid": "a1013ae3-1933-4589-aee6-325342e1a121", "comment": "Malware payload", "value": "d3dbb390f681d79ebd1bf06f1c7b7ec1ca8b5c7421aaae7d2b06d53e37c22832eaeed2ab70e9f282b46351a35b542d82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295557, "uuid": "1b474015-db4d-4e1e-9d4e-a3e5e1b66e75", "value": "T1F2B56C16BCD164EAC0BAE2314EA293A17771BC65433273E72E907A7D1975BD82F39304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295557, "uuid": "a2db9679-4179-4ecd-81be-e772de3b8d7b", "value": "24576:/Q+V8kOS3DZKkQw8RPYzscGdswE1PrX09ZU2Y4jlkxGBpHoqh4WdL:/Q+ekDDqxdswE16U2l7FT4WdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634295557, "uuid": "7b9f5c00-c6a9-4061-9c92-a021b2c6a11e", "value": 2303449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634295557, "uuid": "be7dc027-2007-4e21-8e88-4a71b5d75c5c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295557, "uuid": "4614e89a-b01e-4e6f-b1ae-eab16b96ea01", "value": "goransom_linux64.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f7b42c-2d8b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634283885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283885, "uuid": "22d801e9-7a2d-40b5-9e1c-dc403c3b5238", "comment": "Malware payload (RaccoonStealer)", "value": "4adf9c89320348237cc3921c19eb2cc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283885, "uuid": "f238f9c0-0acb-416f-88c4-51940ca9cb3f", "comment": "Malware payload (RaccoonStealer)", "value": "85a36b790bf6afe574fe90bc06e56c1a5b0380d987026d2cd7c75f795a8de73c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283885, "uuid": "60d6557b-7728-4543-9153-1dbe77ef4625", "comment": "Malware payload (RaccoonStealer)", "value": "90d66f6c09d3c7d5b8ddfcba3692869e25d55f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283885, "uuid": "3d80f9e9-6911-4faf-9780-3cc8c968939b", "comment": "Malware payload (RaccoonStealer)", "value": "7a81f8a27f1b21137931c75cc151b6478f048dfbe758b97966c5c2004137862e1a1c56278582f30c0f119d155b883738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283885, "uuid": "21aa988e-2f98-46da-9871-0fbc740976d9", "value": "T171647D10ABE0C038F5F356F949B9936CA93E7AA1AB2890CF53D516EE46346D1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283885, "uuid": "7dc074c6-3f57-4aa6-94cd-7d2ab522f88d", "value": "fca1d58205e9c77175b87324501ec95c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283885, "uuid": "851600c1-a085-4afc-975d-7f74e711caa0", "value": "6144:48yB2vLLlTsypGIjvfqKdpaZbPSC4CsIOv36fA7:4RBINsysIjnnpaZWPCsI0cA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634283885, "uuid": "6a96295b-91f6-42e4-8ca6-96814572bbe7", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634283885, "uuid": "23bc2b8c-24dc-4f21-bf74-e1b0886a36df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283885, "uuid": "a2989328-1a7f-4609-b6fc-76120a183f22", "value": "4adf9c89320348237cc3921c19eb2cc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bccbaa0-2d92-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634286690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286690, "uuid": "1e55c2b1-db53-44c8-a50f-0d0873df8730", "comment": "Malware payload (AgentTesla)", "value": "bfeb5e335da4ef0f0b24c892aa0023e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286690, "uuid": "9851fc33-d7ab-467f-9391-d7fe74ad44ec", "comment": "Malware payload (AgentTesla)", "value": "85b580fc9c82956212145424c8974d85b0d1b2418544b3ca691b0c040011782c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286690, "uuid": "7c5d41a0-b7a2-4ef3-999a-d95d959b5b5e", "comment": "Malware payload (AgentTesla)", "value": "6dc6427e57190cca2297aab5ace8d1438abec281", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286690, "uuid": "5f462136-9df5-4a82-8e1a-f1c3fd48fa8e", "comment": "Malware payload (AgentTesla)", "value": "f86292b3b32655d0f2a563e495ca47b69bdf0fd23abc77c9449aaaa4086b6db02d5891ee36d408c40b5400b436386f89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286690, "uuid": "201c51ef-569c-4bea-a539-e8d33fd967f5", "value": "T1A145E003E38544BBD479073545A71F217FBAA8301BB69B6B6BA0493DAE723407E34F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286690, "uuid": "d809d2bc-3522-43f7-a8c5-1b631d843791", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286690, "uuid": "8ee7c7c4-4f5e-453f-9a74-4ca8517ad4fc", "value": "24576:rAOcZEhvXanVAKO+d/Nx75/E3KvxUsAiuju9Ilf3V:t1iOKX1t/xUsAirS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634286690, "uuid": "81acee55-9294-45df-bd31-429c19d6079a", "value": 1255678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634286690, "uuid": "f82c780d-3bb4-4a97-8b51-9f8af2855957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286690, "uuid": "31747d05-7b5b-4994-b0a1-da6f9acd4b0b", "value": "pou753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a53c115-2d72-11ec-843c-42010a9c0014", "comment": "Malware payload (BlackShades)", "timestamp": 1634272890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634272890, "uuid": "36db4527-9374-4bce-858c-ac6b69d90737", "comment": "Malware payload (BlackShades)", "value": "1f67cc3aee307cde9e5102d372f9b87e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634272890, "uuid": "1bf343de-a3ab-4dec-8de3-a87d35a01d9b", "comment": "Malware payload (BlackShades)", "value": "8618bf549fe77b12325caeac35e24857145cba568d740c191a5850e2cc2c3960", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634272890, "uuid": "ae619fb6-3635-46fa-90f8-16e13327a77e", "comment": "Malware payload (BlackShades)", "value": "9add3dadb96e4c8048bb826e652f7e5f90f2a5c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634272890, "uuid": "1046b9b6-5866-4abe-84ad-e410ad2ae280", "comment": "Malware payload (BlackShades)", "value": "594cd402503060eda496e4b5174a2f8620d1481aaab2086ce580f91af0d02361345a7e42ed64f933606e7e9eb225943f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634272890, "uuid": "e18d97e3-897d-43e1-b6a6-e687606ebfde", "value": "T159F4AE2375D2C036D4B301B25679AB625EBFFE310A319997A7C8198D1E384C0EF2A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634272890, "uuid": "72d97620-5b3d-4d44-a3fc-3eb244a13a6b", "value": "2cbe6db2ec1d8a931b50336af1a7dc15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634272890, "uuid": "477fe155-7d48-45dc-b9e0-d9c4d2b66a88", "value": "12288:8qzcpVgUXzL0TTUKZHTNloEkOpnKgofuIwV6eAj0wZxxXMcEe/3paPcgrX:8qzcpKIL0TvZzNlNky0wVW0wZxxVgrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634272890, "uuid": "aacfb134-2257-4547-a4f8-de12bce225eb", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634272890, "uuid": "b3a3740c-797a-4ee8-aacf-992a21917db2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634272890, "uuid": "4748e704-1253-43f7-a9cd-87d4716e2d49", "value": "1f67cc3aee307cde9e5102d372f9b87e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4f9019-2e07-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634336888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336888, "uuid": "e30aca83-4ab8-45aa-9601-94351cf700cd", "comment": "Malware payload", "value": "89efcc9e157340895b88ea374274c88c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336888, "uuid": "94ec9a8c-9aa8-41d8-a028-348585f505b2", "comment": "Malware payload", "value": "87f3a1dc24366b9917bb04491c54edfde6a2217eb936e6b8890e568e4a2efa63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336888, "uuid": "603ae99b-5ae3-4622-a4dc-bc8d5b3584f3", "comment": "Malware payload", "value": "e10d403b380f048c193542d302a7faffb7edb342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336888, "uuid": "3c76c3a2-b423-4e95-b561-73a84be9a4bb", "comment": "Malware payload", "value": "68ab8606f8fd0d4674d31960089b9c28e1998c63ef58b8cb200d9f4598dc5c910626504441b811f6f54f68b5967fb59c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336888, "uuid": "d9c990f2-ff23-4fb4-b86f-e8287a0cd85b", "value": "T1DDA410DC31D132DEC95FC936AA687D78B721706743CB0653982B21A99D4EE57CF280E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336888, "uuid": "32a16277-02da-482d-b8cb-72b992b625e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336888, "uuid": "8980dda8-6990-45f5-ba4b-d460b4d14da0", "value": "12288:fZ/VMua3NJ9yr5ulgJ59vg1bH0pKpx9emAeLYXOkdmzfy+U5+MX60RzTkbyvTbiN:B+F9J3mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634336888, "uuid": "bf27d192-833c-47ae-bfba-7c2d231e1412", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634336888, "uuid": "0f6a0d50-0ae1-4a40-9c49-43f72a92e15c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336888, "uuid": "07efc5ae-df37-459d-9c04-de9bb5927fd1", "value": "Far Cry 6 crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206260ec-2ddc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634318400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318400, "uuid": "c2b7b3f0-8019-4790-8782-f693e51efb35", "comment": "Malware payload", "value": "8d69a9b6f84e7edde1329bf18f404beb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318400, "uuid": "4c4885e4-782e-4f8d-b606-a7b6ed11ed5a", "comment": "Malware payload", "value": "894f5d626d1fff01304e87e4e9e436b8c05a8c098e9638f22eb597c7f4406500", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318400, "uuid": "4477b27a-7537-48ca-bfe7-d6a91261864c", "comment": "Malware payload", "value": "054fdd05f3fbe124410201f94eb5cc5e8fcd5071", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318400, "uuid": "44328998-10e1-40c1-b49d-a15e3870ec83", "comment": "Malware payload", "value": "afb777ba72920863ef99c8c38332674e6d505970a7225a91e230ae4eb99a4a0c5c439116f6d1ecea677553b1d6b695ca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318400, "uuid": "d5a0a7fc-e2b3-49f3-89ef-c4f70687f27a", "value": "T105D38C427797C95BE94803398ED7D7DB3B72FC21DE22870336497B0E5E7A2A08C16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318400, "uuid": "51c833ca-4c49-4139-9dff-6f6643b852f0", "value": "3072:Uk3hOdsylKlgxopeiBNhZFGzE+cL2kdAXc6YehWfGjtUHKGDbpmsiiB9030K+lrq:Uk3hOdsylKlgxopeiBNhZF+E+W2kdAXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634318400, "uuid": "95586213-4344-42e5-b0e6-a9c5932de965", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634318400, "uuid": "fea063cd-03ee-4205-9665-104aaf7ad165", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318400, "uuid": "06402e08-0a19-4023-ac2f-f7c3c90b9403", "value": "Claim-Copy-1970837754.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcd90da-2d90-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634285754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285754, "uuid": "1acca51f-eb01-42fb-b900-f265c89d6565", "comment": "Malware payload (Formbook)", "value": "7ca5a6d622c55365fda10c9e9ba8ee88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285754, "uuid": "394de826-cafb-4e2b-9aae-b0c7f1e8849f", "comment": "Malware payload (Formbook)", "value": "89dd90006d6cd58559565a7ccebc2147780e2a3ae084b5d114b2077c2ae341d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285754, "uuid": "2aecebf9-9950-4ad1-90c4-4fcf963b4c9f", "comment": "Malware payload (Formbook)", "value": "e79376618b25f054dc7cfd73d9561b05a5f6e64e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285754, "uuid": "c26cbaa2-1a54-4798-9107-fab80ae6b4a4", "comment": "Malware payload (Formbook)", "value": "a2e4f2059eb72a8bd8f5ec8cd74b10876f68f2fc8322cd6b6b22346969afed44efbf304d33588822cfa1ad82dc00cad5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285754, "uuid": "62ceffa1-5b80-48df-94ac-1f520ffdb36f", "value": "T1B944132662E154ABE2C747B2AD36A33392BAD309103B644B57608F6DDE157CF8F4B143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285754, "uuid": "e33ec4c3-f2b9-4a27-b765-bb0da258e32c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285754, "uuid": "4f1bc992-fda0-4453-b5cd-6a9efb90e315", "value": "6144:wBlL/cR7xZGzMLX/dtAEF/fsZj18crt63UVB2eu6wLu7YPCGY6Q/:CeR7gMLAM/y18wtagAeuzLp1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634285754, "uuid": "11dc8fb1-2ac9-4fb9-a8d1-3b176e3c9495", "value": 258796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634285754, "uuid": "fb193b33-f3c0-4a7d-86e7-dfe37e7592d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285754, "uuid": "6e26b1ab-d77b-41b0-9493-ef2f3c7e24b0", "value": "7ca5a6d622c55365fda10c9e9ba8ee88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f2a32e-2d8c-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634284024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284024, "uuid": "098da0be-72a1-4048-bf57-54edea90c491", "comment": "Malware payload (NanoCore)", "value": "8a745bd65f32190da2c625f016f14a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284024, "uuid": "f0d4f9d4-ab7c-4618-9e47-ae1970108b48", "comment": "Malware payload (NanoCore)", "value": "8bac59b258ea8ea81eccb35b6e2a4bb78e415c84ea9a7c24a46727d5be8c3023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284024, "uuid": "a31e4696-39db-4071-9a44-6d052844c519", "comment": "Malware payload (NanoCore)", "value": "969ff934b3e2d0cf97054b97e74597a6fd5a03bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284024, "uuid": "178b58da-6e22-464c-a2d1-0524860154f4", "comment": "Malware payload (NanoCore)", "value": "0bdcea2df424231f4f49ec3ea4f6191ee257a7ae34681efa6cd68c29aa2a3f77f009817380be514743daef4ddbb935ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284024, "uuid": "b74df12d-648f-4f2b-9b92-ed32595d9b4f", "value": "T172D41292B496049CE8FA5AF6D40BA5111562AC29F074D16C12AEB33F1BF332395E7F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284024, "uuid": "7c5505c9-8970-43e3-b2e8-84fb1c55e171", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284024, "uuid": "168f0bfe-6c25-4127-b95b-95454587578c", "value": "12288:zcs4J4TaLd9loBC1C6uH+pigWj9JPP1StOA:zI4TcdbTuH+pIJ2tOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284024, "uuid": "cd6a65d3-7135-46e3-acd7-0a9f99bc6933", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284024, "uuid": "a2d18d62-7f51-4043-b1a0-e9b1a38f37bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284024, "uuid": "6e7bd25a-e958-4add-834b-d07d29075692", "value": "8a745bd65f32190da2c625f016f14a39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13daa4ad-2ddc-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634318379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318379, "uuid": "db2fa67e-a128-49ca-8113-68359c94ac04", "comment": "Malware payload (Quakbot)", "value": "44447936a3ea172e1d34dbfb212fc683", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318379, "uuid": "dfcc7c7c-37eb-4d71-a9f3-4d4d221a9c0b", "comment": "Malware payload (Quakbot)", "value": "912944f17119efe419e1aa725b44faa0c982adc1b4e17f561d13807d7c5078b7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318379, "uuid": "4b7dbeb6-6446-4208-ab53-2235bc5395af", "comment": "Malware payload (Quakbot)", "value": "984eeba993e96850c9c538fb2f6d7dd34426dfdd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318379, "uuid": "dc2a2ce5-07d6-45b4-a456-75bfdbadc53e", "comment": "Malware payload (Quakbot)", "value": "a1ec3ea45b3e66a418fd30a4d98dc3c9ee467a01786f7aedc291617534f809d578e6470da81044b33003f878757c8f60", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318379, "uuid": "bd0833c2-637d-4541-861d-31b3a7b9c9c2", "value": "T106D38C427797C95BE94803398ED3D7DB3B72FC21DE22870336467B0E5E7A2A08D16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318379, "uuid": "a6b8aa30-a22e-4221-bddc-9f456fce3836", "value": "3072:ak3hOdsylKlgxopeiBNhZFGzE+cL2kdAWc6YehWfGjtUHKGDbpmsiifnSIn0K+l9:ak3hOdsylKlgxopeiBNhZF+E+W2kdAWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634318379, "uuid": "2fe08d12-fa2b-4e96-8c2a-bc480401ef41", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634318379, "uuid": "ba075a93-b8d5-4439-bfd7-841b1ee62275", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318379, "uuid": "df334c93-378e-49f7-9c41-d48efa032469", "value": "Claim-Copy-850203170.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba715366-2dab-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1634297613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634297613, "uuid": "a34906bd-bfb8-48f9-8961-390a600ee819", "comment": "Malware payload (Gozi)", "value": "47d3e9c39b6ffe128ce09aeece35039e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634297613, "uuid": "64de0110-556a-47d3-b740-bf38e8415b35", "comment": "Malware payload (Gozi)", "value": "91590ccdea506a9845135a3306d2fd81f1aedbd15af34974cb114526443b2e0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634297613, "uuid": "06c8dfba-dfd1-4b41-a68a-c4d9882d4c7a", "comment": "Malware payload (Gozi)", "value": "0694223fb673938db22e72554c6a89bbc3c04140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634297613, "uuid": "dc2af1dc-1d77-4c80-8833-62bcda359978", "comment": "Malware payload (Gozi)", "value": "e9e866bee2dfd9f0041616be66d08077abb1dd5cd5bf5246b2726198517853fb4890901b2fd2a59908c8f2c6c8ddcb41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634297613, "uuid": "37ae5ed2-0d11-4a93-b2f6-cda1c60c3405", "value": "T1CAB3596E9CB49D69DA5D0BB0472401ADC06B7D71810772D752BC360D7AF2BAE2870F2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634297613, "uuid": "a9a73806-06fc-43e6-96b9-5a750af16da5", "value": "b932574997137d9d7810fe70a2ef64dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634297613, "uuid": "6c26c429-ea00-41ff-a942-d227d3630f3c", "value": "1536:z36xjFV/d9IHV6TJ6iFfvkYso1gBA/nEGF7e1KN+:jWd9bTJ9f9so1FPEqaK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634297613, "uuid": "b68c277a-5958-4d0d-a8d6-7ecea43a9755", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634297613, "uuid": "a447113a-3702-4d11-96e5-4315c4287824", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634297613, "uuid": "35400f02-3687-4aac-a1e1-4112766615a2", "value": "Orden de compra n_ 393116209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77962a38-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634300937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300937, "uuid": "51035773-e661-4376-b68e-d26445d4e680", "comment": "Malware payload (Loki)", "value": "99fc72af7a98dd3356175428042340e5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300937, "uuid": "808f68b3-2f9c-432b-b807-11877b5d9240", "comment": "Malware payload (Loki)", "value": "928a60bd3c73c561789e3b57592d31af702563136878c6de3117fd4a91130c59", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300937, "uuid": "72897a11-eabc-4ddd-9505-04c1b6e10410", "comment": "Malware payload (Loki)", "value": "41d920fbaf3916b6e8b4d439f5e6f4868627c25c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300937, "uuid": "1125fe05-8b12-4aa1-896c-8424a0f7718b", "comment": "Malware payload (Loki)", "value": "6896c5492a9d3b33c5d39d280436a147d0e4e216677b849d23284552740c7896c7528db84e0155debc5cfd49f25cc29a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300937, "uuid": "3a1ee2c9-0f29-4a1b-ad36-56e4efdf8049", "value": "T13254F14076ED830ADE2B8B78587A95D40379776ABF05C32E2858129ECE33B074B517B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300937, "uuid": "5af9e052-cd5f-4f48-a9ba-3e24ddff120a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300937, "uuid": "dffbbc91-8bfe-4d93-961c-1eebefc10e2d", "value": "6144:hIfogMkhBrxUXK2Oa7oD9BQsSXj9OhsINQrsXrOzYbI:9SBFUsqsSXjM5QYXrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300937, "uuid": "dbc73c2c-509f-4f86-af27-8843473bc545", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300937, "uuid": "20260abb-7d8e-4b80-acfc-097663abe359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300937, "uuid": "d57aa266-9342-4828-8e77-a3422bcb4f4e", "value": "DHL VN DOC PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86582bc4-2df9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634331026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331026, "uuid": "bbcd831c-c0e3-4060-91a7-8905852cec8f", "comment": "Malware payload (Mirai)", "value": "c9c6d015539ca72b6fd323a5afb7608c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331026, "uuid": "1e6a6914-b6da-4399-88a6-70fd2b7ae53e", "comment": "Malware payload (Mirai)", "value": "9367a854d1386902711511aa200ab6c39d382fd90d7c486dc663c0baa6b039f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331026, "uuid": "f16e5159-bb67-498e-8c24-ddcfa54d715d", "comment": "Malware payload (Mirai)", "value": "f625cb6b474da08a69545f4dd43e71f37febf1b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331026, "uuid": "98dc090e-b5b2-464f-8c5e-34091a7a35d2", "comment": "Malware payload (Mirai)", "value": "e04ffcfc5eb25c5e52a860d9850acc30a5d7149d21ab0f7959ff1a51c9a43584e349ad5fe7b3e95df50d2bac08f953a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634331026, "uuid": "8d3d8e2b-c944-4b7a-bbc6-fa8f0d56efcd", "value": "T1B8D2D030118E7A17F124AC32DD74978F36B38670D4D066A39DC0073A95DE62A7BBA70E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634331026, "uuid": "1d05d256-562d-45da-876d-f64a7426805a", "value": "768:902Qp5IswzO3k+6o3t73SQDNyys3Uozjy:9W8zuPt53JWzjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634331026, "uuid": "7d3b3bab-6e77-4358-8ddb-b87c6738ac78", "value": 30552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634331026, "uuid": "8474b71f-c8e1-4b76-b616-5be8a67ea6cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634331026, "uuid": "63d9e961-46bb-4366-9974-5d96064ab159", "value": "ii.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85536e8f-2df9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634331024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331024, "uuid": "cac26971-a913-45b7-876d-e9c26c9d14d9", "comment": "Malware payload (Mirai)", "value": "e706678b702f4cb08572290ababf0d55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331024, "uuid": "6c19a34e-95a4-4bc3-a2c3-190d5fa275df", "comment": "Malware payload (Mirai)", "value": "93ac2d245650acb80f01493d8f08615e5647bd5026d35341fe1381e4ef0d6eb9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331024, "uuid": "070fb022-ea0d-4af8-864b-c77a8d306232", "comment": "Malware payload (Mirai)", "value": "4666c0f923ad76556a2b36ee36682b073e855c15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331024, "uuid": "ad1ba9a8-8532-4f31-8e19-5d122ea36bcd", "comment": "Malware payload (Mirai)", "value": "a1088b9db71958b2147d3cb3100c128ae7df1313b9b54606d4422bd47116fe1a659696298d42e5c4911be51114888def", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634331024, "uuid": "d72c6992-52d2-4b17-b6ba-be8487b662d3", "value": "T1F4D2D12C09F8CD01D53530B8498E3F1F15AC5509919396EBEFA4756F64A9F323A28AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634331024, "uuid": "54d43b8a-bf3f-4d01-96d1-36042a9d90da", "value": "768:FMlVIVBzBeqC7Gb4oZIg4sE4D/usrb8jWQGp17dnnbcuyD7UGQRjQ:wVKhZIOEwHUjWpDnouy8Gyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634331024, "uuid": "38825017-2883-4823-8507-7f2dbb65b24a", "value": 30368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634331024, "uuid": "3738f213-08ee-4434-84d9-6285da95ccb8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634331024, "uuid": "8ea7e6ca-405f-4942-ae22-1ce4a4e51221", "value": "ii.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88adbcee-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634300536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300536, "uuid": "5070ded7-9688-457a-b34c-9b5564f73d2f", "comment": "Malware payload (SnakeKeylogger)", "value": "39d6afe5692079df30e75663f459d0e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300536, "uuid": "71a67daa-9deb-474b-8619-a34d8ba394f5", "comment": "Malware payload (SnakeKeylogger)", "value": "94599985eaba6ba050b0be5c1aa3fd3f5bb469190b6a7a9f81d2c930b69bef38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300536, "uuid": "37d2bd9e-ff6e-4a3b-92f2-64593798cacb", "comment": "Malware payload (SnakeKeylogger)", "value": "6bf764e164447dde5c39b8abbb12288379a69f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300536, "uuid": "6f090340-3840-424a-95da-bfa641f59457", "comment": "Malware payload (SnakeKeylogger)", "value": "aacfbd687326b8479cd6ece2f68f79e0eedd47f2c60f9777925afdfbb3778a36a968e3673ccfcc5065066f0f9487c6df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300536, "uuid": "01bfea50-bd8f-49eb-aae9-e7ddd635776b", "value": "T1F154F13172FA932DC43B4FBD5876A68027B4B66B3B16DB6E6494324DDD227038720763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300536, "uuid": "d39b64bf-d6c5-4319-bb56-897e7b0153a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300536, "uuid": "f890aea3-251d-4bfc-8881-cdeda668af94", "value": "6144:XAGQgMkhBJUnPFWByu1tgdMgfh8JJulwz2quwif2U6:gSByPU8ytgNoJulIpuXf2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300536, "uuid": "fc29ddbf-d5be-4955-bc1c-59c28afc669b", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300536, "uuid": "cfc0e235-0291-4932-b531-721af73fd9b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300536, "uuid": "44003296-f1c4-4f2b-a218-78b3710125bb", "value": "Halkbank_Ekstre_2021151083739977776234_4397392776763884.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e521f357-2e03-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1634335480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634335480, "uuid": "105b975d-4698-47ee-845c-8ee3df22231b", "comment": "Malware payload (CoinMiner)", "value": "4e9369d450438e15962feb5859a43339", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634335480, "uuid": "b94fc8a7-707b-4533-a7ad-0a5f1c33a95f", "comment": "Malware payload (CoinMiner)", "value": "94cbc6a1b4cc99bbfb3824eab5720009773c04a2b4e628789d7db4f824a78201", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634335480, "uuid": "aeea91b5-cf03-4295-a8c5-67b585be32b0", "comment": "Malware payload (CoinMiner)", "value": "2ffd83ef65c0403660268a115595c5fb3cfc8e1d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634335480, "uuid": "9fe8488a-caf3-407c-9632-e121bf8ca86c", "comment": "Malware payload (CoinMiner)", "value": "2d98bbcbf07218e264022747c9c991d06e4a4310e30bb512e2baa41df1e6bbd0b4304ff2f47bcf89089a1226fd8707ad", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634335480, "uuid": "c202fd8f-4e2f-4216-ab6c-9c9f4bd98a12", "value": "T16F847F343AEA5019F2B3EF758FE4749BDA2FBB632B07945D209103464723A81DD9253E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634335480, "uuid": "59659cb0-7882-45ac-9af1-3b7975e27a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634335480, "uuid": "0d23fb9f-af06-4a4a-9419-f86882af3f39", "value": "6144:Ai/QJ27vm9TV3HVQLld3KK/F9i0gtRvK05/iZd9qN56j:Ai/QJ27vmb3VQLld3K6i0gLvK0wRqN5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634335480, "uuid": "707eecbc-dd01-4ee9-853d-3b3fe46e094b", "value": 381664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634335480, "uuid": "f8c79380-d725-4a23-994e-f4702eaddce6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634335480, "uuid": "a1af7496-fdd7-4480-a5af-2ecb28bdcf23", "value": "Sapphire.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a76ae7-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634300448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300448, "uuid": "2d2ec75d-c393-4372-9ab3-88373d8c0782", "comment": "Malware payload (Formbook)", "value": "f9272181ac97e7d73a6624b53f66317e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300448, "uuid": "431e16d3-e8fc-4b86-99d8-2826e3e2956c", "comment": "Malware payload (Formbook)", "value": "951ce27be9ad08fd71caf711d3015809b4211536a8426c0350ac0e9ac3d2b24c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300448, "uuid": "b02aa94c-2ea3-46d2-91f0-95d86a929637", "comment": "Malware payload (Formbook)", "value": "e711febee229bf617559220d5bd35094385fefd2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300448, "uuid": "2e5f0028-c548-48ff-a960-0535335f27a1", "comment": "Malware payload (Formbook)", "value": "c95e6b30883131f3b466b15525f2182e85bc1af5d6b272de7b90876989157b82831d957749dee661028b666c431dabfb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300448, "uuid": "ac736b9a-347b-4c68-8d7c-88caf1abe153", "value": "T1B464C05AF7674EC9C51BED3C1E24F849502A6C07F6293EA103A3F5784B3FA51D84862E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300448, "uuid": "f4d0b566-5ec2-46c3-9629-c2f205af9911", "value": "6144:P9g1VDeV8olPP07RPPPPPPPRPPPPPP0ExzPPPPPPPPPkPPPPPPPPPGSbCKVH15v2:eeVSTxuTc7FxFL33hHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300448, "uuid": "6706257f-bab9-419c-88a2-c3d9ebc1abf2", "value": 328824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300448, "uuid": "c4747113-1739-41d7-a2c5-f95759a1cbb2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300448, "uuid": "65b30a3d-ec8a-4e1e-a083-a6e91012163b", "value": "PO 4910007391 CHANGZHOU.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f768f8-2d7a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634276397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276397, "uuid": "7a806c6a-95c0-4f3f-98e0-4a8bd9e98718", "comment": "Malware payload (AgentTesla)", "value": "60b5f8ce71e224363b63bc60ce94d6d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276397, "uuid": "14df6cfd-5419-4a5b-9a01-335590ca83ec", "comment": "Malware payload (AgentTesla)", "value": "9657b42848f0d599f5ca15f39d720f2f1625541b9e35a1a6fdd5bb810ea89190", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276397, "uuid": "e0a087db-7725-4457-96d6-1169953e2a09", "comment": "Malware payload (AgentTesla)", "value": "17d6c5029a5d58df8c28d31ec9c136e56d5a279c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276397, "uuid": "62e5205d-ae33-4fea-8e25-91fa6e7d132c", "comment": "Malware payload (AgentTesla)", "value": "f5ed177a0cf6d93e0b7220ae5f5f9a5b9be1de7f6109edd298fbeb489a2bcd1c012819c8a0e3fc4f849f59c4dd6baf33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276397, "uuid": "9a3ff8e6-73ee-489a-8241-c81683b38d74", "value": "T15794012136D97611D47A4F3B6CB196902776B876BB12DA6F2891310CDE733B78B20723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276397, "uuid": "646be762-96fd-4b82-bb2d-928792207259", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276397, "uuid": "7782a7b1-8376-4f90-8fe6-acb9486bb411", "value": "12288:NSBH0CpkW3Vh2FhVFR+TrAUb3q1eysORxr:ABH09W3KFhv4T98fPRxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276397, "uuid": "9e4880b6-0d62-45f3-b325-c5eff252f448", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276397, "uuid": "e64c4af0-02fe-4fa5-bcfe-ef306b8e689f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276397, "uuid": "40f18fbd-d67d-4f6f-bb37-9b407a209864", "value": "BL-LADING#ATA-3678920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56b9211-2d5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262922, "uuid": "9d6f10d0-ba5a-48d6-8109-f828e2d86899", "comment": "Malware payload (Gafgyt)", "value": "9ef55582925c17c07bfa7317dccdf254", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262922, "uuid": "e66c96c3-ae76-48be-b0fe-d8299f135f61", "comment": "Malware payload (Gafgyt)", "value": "96a374aae94a59a7ba932d36a452e30614ac3a59b7522cf4d3d303dbaec6552e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262922, "uuid": "374ff63f-6897-4af9-b0fa-29af96b61bbd", "comment": "Malware payload (Gafgyt)", "value": "2d8cf55ee325329939fc3eccd7b89b75a1bb0dcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262922, "uuid": "ca85c703-a856-4f33-b6bb-9579821097b3", "comment": "Malware payload (Gafgyt)", "value": "3732c41e5a64900071d8a1b143281a401746e6073fc5a175de241c428d88b480af701ae4de7c51483e0844a3dc5c65eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262922, "uuid": "ded0abed-a0d9-4d2e-8ff3-e348b1ac3883", "value": "T1E6833C02F743C6B3C8830BB2029BAE665931BDAA4E269F45F31D7DF4AB128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262922, "uuid": "f3951365-996d-494f-b836-6c0c4bf805da", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LJQMhmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Y9QMhmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262922, "uuid": "e7ed71e2-8814-49eb-85d5-eef2f6ea5e8f", "value": 85000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262922, "uuid": "ad9a5824-c9ac-401f-badf-e00ad70fbac5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262922, "uuid": "1c41d59b-81b8-4928-ba37-a80767a9cee6", "value": "9ef55582925c17c07bfa7317dccdf254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77e0c8b-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634280455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280455, "uuid": "efb970c4-e6d2-4e80-8beb-84ee292ee5d0", "comment": "Malware payload (Formbook)", "value": "443234864b2623d4c93e296fca2f88f6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280455, "uuid": "5b70a8d8-deca-4141-81db-151ead016d8e", "comment": "Malware payload (Formbook)", "value": "9758f64d59335cb9cf577d3fc525001bb5d62bce3bbc81079b34e4f66bc4e3a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280455, "uuid": "cbe14a4d-24eb-41c5-90c0-82bf1b31a131", "comment": "Malware payload (Formbook)", "value": "6c93276284341cee8a7993042f4936322edff8af", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280455, "uuid": "a86a00e4-8cc4-4cd4-b37f-e8963c699070", "comment": "Malware payload (Formbook)", "value": "d3326ba5199d3e17869760b4714509c75c7428ce875e8bc0833ab7388322cc522f286b22bd90189a0a23ba83c9a5e8bd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280455, "uuid": "fa0a71de-4ba5-4e33-ba02-6e278d7afe53", "value": "T1B994D015656A0F27C85F013AAC320C90B0D4BE42E691BC7128F4FD475D3BB6EB996E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280455, "uuid": "4c9a582f-f9b8-4c18-b8f6-9f2866e5073e", "value": "6144:9iMOfTNAp4TJOUz8hFa3THT283vxsC3FBoV1YcBInzkgGHnF2zQ1PfeGDiHb7X76:ArsuJBgeH2kFBcUkgGHeiDyLRtSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280455, "uuid": "b4434f44-b05b-4329-ba24-ddca23a9f9e2", "value": 437224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280455, "uuid": "a0259353-ada1-409c-87ec-049c0afb2bf5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280455, "uuid": "ad887b53-5a82-4ad5-838f-d73b379e57ca", "value": "101421KSM.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e46056-2d86-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634281694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281694, "uuid": "6a614f31-f9c8-4799-a646-7c300aa33e84", "comment": "Malware payload (AgentTesla)", "value": "6019a47b8919e505bc99a26bf98fe016", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281694, "uuid": "8e9b7418-6d9d-4473-82b8-6910caad122d", "comment": "Malware payload (AgentTesla)", "value": "9825504877a89c312ba91e9bf8ffbb3abbc65af019ff7fb7603ea29e23e844a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281694, "uuid": "5e40109c-9a30-4bb0-8781-b3a0157a2bbd", "comment": "Malware payload (AgentTesla)", "value": "c947ab3919b5811c69bed93900ae1a4a53420bb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281694, "uuid": "2c7e502d-cca8-4ba5-81e1-32bf9d4349b5", "comment": "Malware payload (AgentTesla)", "value": "870d8cd257c3ae85be473cb61b06d089547428c7d5ec36e5a5b1a26a771db6411777888741d8197ecef4d6ef2ad15966", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281694, "uuid": "8c92db7a-46c8-40ef-b7e1-c12d3976f0fe", "value": "T1307423D4F6227C832D5AA783A8E0553F18E500F8718A7640796C7DB3FDB93B7B496A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281694, "uuid": "1174ff6f-9ee3-4ac4-8934-7b966798f095", "value": "6144:hVht3Jly+sq3cr2G2j/2jNTbKrYGhk2Yb/+JLl5wASmnsTJe2tJ16iKEiaH9GNqR:hVhDlyx1X2jOjxmYak2Y64mnqJ3J16iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281694, "uuid": "98bb7c48-9e52-42b9-bfd1-7df6ec4d44ec", "value": 359716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281694, "uuid": "0ed3f2cb-4f36-43d2-bf74-2714c7e0f6db", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281694, "uuid": "00d00d2e-ba95-4b9c-8309-17fbf4645464", "value": "Price enquiry for test machine______pdf___________________________.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a53fa7-2d67-11ec-843c-42010a9c0014", "comment": "Malware payload (Ratty)", "timestamp": 1634268406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634268406, "uuid": "4c578ec3-8203-4fe3-8abb-9cce968de7de", "comment": "Malware payload (Ratty)", "value": "018e4cd2137de20e2142fd999d9befdf", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634268406, "uuid": "8aa24678-f440-41a3-bec8-7bfdfd5c932a", "comment": "Malware payload (Ratty)", "value": "9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634268406, "uuid": "01ff49f8-7ba0-4948-b333-ab2155565016", "comment": "Malware payload (Ratty)", "value": "cd37af8a3b23ae0b223ae3e52c3c5b683deb23a0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634268406, "uuid": "b383d3d9-2003-4c41-b7c9-601f4b57f678", "comment": "Malware payload (Ratty)", "value": "02edd4ecc9176509679e20343b0cee0e8329e84bfb91632a3c64f9f0631136355d8246a6ebc59909d30e83cef26e9dc8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634268406, "uuid": "1f21263e-14b6-4ea1-9b49-efc11402a44c", "value": "T13C9423F3534474E6C43075FA6393AAB856A1324C6581F27DAE7084D7FDF97A09B488C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634268406, "uuid": "d2a8e44c-07bc-4996-b48c-2ab0ecc28a6c", "value": "12288:TFAzU67etJXECDCXUxqyNq4D8HkxU5YCyNU:TFG77etR7CXUxfNqQxUINU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634268406, "uuid": "26003206-17cc-47d3-821e-7e00db180d5e", "value": 425596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634268406, "uuid": "55881dff-c4e9-40e6-99f9-8bbdb761c895", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634268406, "uuid": "db9ab226-9820-4583-8234-333e466e5d48", "value": "ORDER-0021889.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03650ca3-2d7a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634276260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276260, "uuid": "1e5c1254-d631-4663-9c0c-c685d3157583", "comment": "Malware payload (AgentTesla)", "value": "977c9d490450a8cdfe8700397c9ca66a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276260, "uuid": "3e83b914-8e25-4595-99fc-5ac4aafdd635", "comment": "Malware payload (AgentTesla)", "value": "9932dc26a4a44dec3946568dba769f4ca4a1e5f1dd6edecdcb6d7394864f7da4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276260, "uuid": "39e3cbda-cc3a-4d52-94c9-62585334df5b", "comment": "Malware payload (AgentTesla)", "value": "26b92d6389cf54a1d9ba64e0a1c735839d14d0e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276260, "uuid": "4a0eee5c-9fea-4137-80d9-b47c326eaa6f", "comment": "Malware payload (AgentTesla)", "value": "608c1128f36197fcd2c27f20f1e39b198fea067039ff0e0a376af6ddbb1f69030422d8c204f8d7112f3ac0345ae69e92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276260, "uuid": "15787631-1e1f-47b7-8d62-6df683ff0e23", "value": "T17EF4C0AC7F40F98FD217CC7986749E54EA2D7467270BC213E46B10BED64CA96AE410E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276260, "uuid": "4b673062-eafb-40c2-86cc-f7145ae0e440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276260, "uuid": "1b008250-ba49-4bd6-905d-771529096f0c", "value": "12288:x8GSBwfu/bEDZwOZawNh+El4/JGLd37Gap/d8xHLjguraOvvDisqgCL1:x87BlbnChTGILd3aFxHL1rbv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276260, "uuid": "561fb980-4dfe-496b-9071-b5e9470d976e", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276260, "uuid": "01a179ca-f320-4339-958d-ba4a2e88a227", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276260, "uuid": "60f0b9fc-e64b-4c95-a947-ab2d56b9bf04", "value": "PO NO_720050285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e313ef-2d96-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634288503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288503, "uuid": "90b3615d-df6c-43e4-9588-146c19585dd3", "comment": "Malware payload (RemcosRAT)", "value": "e9f4b286e2b22149360715181f85737e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288503, "uuid": "08be3574-3342-42b7-be4a-d56f8efb665e", "comment": "Malware payload (RemcosRAT)", "value": "99800df852b01aa636d83b05b5c7f18ec22d3ada11dac31552120799fe77c120", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288503, "uuid": "eeba78d8-ab36-4035-a005-bd6549c715de", "comment": "Malware payload (RemcosRAT)", "value": "ddbb64b85c2a9b4f14dc1c8433304084c6c84621", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288503, "uuid": "c1b68ef8-7c91-4167-9b75-8bdebc820862", "comment": "Malware payload (RemcosRAT)", "value": "cf8dba584cd18fab63718e8aa408dcdc6ad0f277889394bd4b1edbc5cb40878850557a0350f06061ac93a22c23adf635", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288503, "uuid": "8c8912bf-3386-4b62-9d09-f75cba86bc42", "value": "T112E42382EC4893EEFA81C06093C75E1CC78BBAF14EE7E4474851929B5F6E6C6352D634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288503, "uuid": "3e2bcbfe-a6b5-41db-b9ce-8bbdd49d3b6a", "value": "12288:6WEaSxi/4vtVwvuyxpmRnOuMCwf+9VfJA2ONZalZRpL8aW6:6W6u4vtV/6wou5VfiwLLL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288503, "uuid": "747ea2e6-b1da-4dcc-9e6a-7e8565e9c0da", "value": 659765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288503, "uuid": "887deb7d-5dd4-4e6b-a2c0-0b3cd44226fe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288503, "uuid": "1c692703-c742-4b5b-94f1-c1c698448537", "value": "Bestellung 2021-10-15.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acc1534-2d92-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634286581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286581, "uuid": "a3e18fb5-6316-47cb-8636-6079429bbc89", "comment": "Malware payload (SnakeKeylogger)", "value": "436655bfbf2953b53bfd58cbce94fb85", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286581, "uuid": "f6859d46-fc04-4689-989b-5beeb74b9357", "comment": "Malware payload (SnakeKeylogger)", "value": "99abfafdb343b82226de4a99de9ab1da29ea9e991749cfc9c70b0e3804b72659", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286581, "uuid": "ff70c9f0-a163-4301-9d99-699097ff57e5", "comment": "Malware payload (SnakeKeylogger)", "value": "b50d0b5af43b6ae8bb3948b628b54d732b77e113", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286581, "uuid": "72228436-53a1-4d22-9057-70a246e2cdd5", "comment": "Malware payload (SnakeKeylogger)", "value": "a58aff24ef8d89899121ff07ac7e3840f54e2e94ac4040b3e59d5e5890c02a6de2f7349f83f891294ce79742fc9b899b", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286581, "uuid": "8d70bccb-46fb-437a-98a3-60fe99a8fca6", "value": "T17713F19AD471854CC4568CC0FE1230F784A48F1B66D4F9D253BEA9A2FD1A0E23166BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286581, "uuid": "032546ef-e9d4-4b0e-a9e3-3ac2f1547010", "value": "768:Zx3INOnPLaipzyu2U64d4lI8KD6QoX1C9yNQdAAnKOGo6/lsbgbLdBPWmUsbriIN:/LLpzAJ6ZD6Qa10/dACKOGDlEadBPXUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634286581, "uuid": "8131117f-860b-486b-aebb-fd8be6ab5c7b", "value": 42741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634286581, "uuid": "2cc4b5a0-f4b0-465a-a291-d092b97b133d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286581, "uuid": "e6f35414-109d-43d5-968b-01ac07550ec1", "value": "Payment_Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32ccc69-2dbd-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634305439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305439, "uuid": "4238462b-30da-4e48-b5cf-e9dbe4bbad1b", "comment": "Malware payload (Quakbot)", "value": "028851f519f904c1f367dcc2f17612b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305439, "uuid": "18a7a217-e1d7-48fa-a11b-9908ea328f07", "comment": "Malware payload (Quakbot)", "value": "99c7d40784fe46cc9acd304219a554ce378b7832a602866e352d9562f191d703", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305439, "uuid": "ca8caadb-1e69-4e11-bcfd-d3c17f2839e7", "comment": "Malware payload (Quakbot)", "value": "3b5f3470e00b8064d233a2e2fb8011d3474e7cd9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305439, "uuid": "703f915a-0b91-4386-9bb9-7ced837c3923", "comment": "Malware payload (Quakbot)", "value": "a1859e677a81a04d1023c971f9037833697bd79788c54b214118f94bb60224849269dc0867d35f89a98494059f531e52", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305439, "uuid": "61cb7994-d217-4d87-9ce3-d90a6f8316c1", "value": "T156159E2132A1D015D027743ACDA1E0F81B9A7C258E787C4B31D93F6FAA7E6C29E0575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305439, "uuid": "22d496d9-ae6e-49c0-851c-6124bedc4ba4", "value": "91c07871bd6ea6ffbc4d2b548ec9a02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305439, "uuid": "38c0e232-6b08-468a-8a0b-60b8fec9d700", "value": "12288:cU7AzcO18OcZtc98uEE8aPfR6xa7jg0Ii3pSGdSJbbIclZgFi0WBRLuMdgX2rbnD:/AzcO1T0yfR6lxcYIYZ3qM9n7xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634305439, "uuid": "4bf16735-5f6e-4a40-8f68-84ba9923d88c", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634305439, "uuid": "7acb0570-3a2e-4f6a-adab-5dc7280d07f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305439, "uuid": "6e69fb1b-1092-4c41-9aaa-2ed92b40f63f", "value": "44484.6871458333.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ea4b5d-2dc8-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634310002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310002, "uuid": "b3a50715-7b2e-4521-bca8-347c169c5455", "comment": "Malware payload (Quakbot)", "value": "4e18e09ebe9904bcc1665a03ccf7289c", "object_relation": "md5", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310002, "uuid": "f97434ae-4161-464c-8a09-97da07ec3224", "comment": "Malware payload (Quakbot)", "value": "9a0a90027d20cb15d3be76724f39f8b99e68837a2e0f8a781de7b3ae2895611a", "object_relation": "sha256", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310002, "uuid": "e2bb0b90-49ed-45a3-a91a-a3ed6e7d5806", "comment": "Malware payload (Quakbot)", "value": "682123a35c4ab059373eff365ad65302e00d5436", "object_relation": "sha1", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634310002, "uuid": "82ba0564-0cfd-4b26-b41b-c4cc8b8b6ddb", "comment": "Malware payload (Quakbot)", "value": "0d3376f6ad39445c4e2f9a0f6d1dd6e57563e560abb36acd52fb3eee837f2acddfa2de1f9fcdc7a2f3434f89e89d34bc", "object_relation": "sha3-384", "Tag": [ { "name": "1634289383", "colour": "#566B09", "exportable": true, "hide_tag": false }, { "name": "obama116", "colour": "#2226CF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310002, "uuid": "8e425069-3654-4095-a91d-84caf31f47ed", "value": "T136D38C427797C95BE94803398ED7D7DB3B72FC21DE22870336497B0E5E7A2A08C16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310002, "uuid": "3ad8acb5-0e8a-4617-90cb-2ea37ec65a9b", "value": "3072:Uk3hOdsylKlgxopeiBNhZFGzE+cL2kdAXc6YehWfGjtUHKGDbpmsiiB9030K+lrq:Uk3hOdsylKlgxopeiBNhZF+E+W2kdAXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634310002, "uuid": "48235a16-04d0-458a-bf6d-a9f0fa51b796", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634310002, "uuid": "f430b988-96dc-403c-bdd2-350508945ba0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634310002, "uuid": "2209f79d-4e4c-4f2d-b790-d9521f087cb7", "value": "Claim-Copy-684471922.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fee85c-2d5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262541, "uuid": "c8328d79-feb9-4974-82f7-d51086cbff41", "comment": "Malware payload (Gafgyt)", "value": "3b7e3eb5d1e4de9d08190adc5df23cce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262541, "uuid": "75e7e8b7-7043-445d-be37-009ad7226012", "comment": "Malware payload (Gafgyt)", "value": "9a5726dd7335b037ad0c06e6d6716268d864e8b00f061f4a2c95eb51dc519830", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262541, "uuid": "8a5ce1e5-1c21-442e-9528-c956731ecde4", "comment": "Malware payload (Gafgyt)", "value": "f8b684261e31adc8cfa6e4a8019a9b329e706d32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262541, "uuid": "fca298ed-1826-402e-881a-54e601222cd7", "comment": "Malware payload (Gafgyt)", "value": "42710b41942e6f64a169b47c855c3d6f77c044c542eea8f3774b5d57a226ae3ce3fd48e7a421849d7e5f69cd0ab117bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262541, "uuid": "d23018c4-c8f0-4a1c-8b26-0ed1bc61ee49", "value": "T13EA30896F800EF77F40AE67604D34B25B670BBE14F532622731739A6AE762D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262541, "uuid": "075de114-67c0-4d44-a97e-bc84159557f1", "value": "3072:nkrWBIvC/IymEdH8ffRWumuxVqDr78fz1e:nkrWBIrym+8hWumuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262541, "uuid": "7a69dc0f-acf1-4c92-8c49-c09a630bfa67", "value": 98920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262541, "uuid": "9d57ffdf-1dff-4a59-9e4c-e655adf926e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262541, "uuid": "cffd4578-57fd-4933-b1b4-18a6618a0660", "value": "3b7e3eb5d1e4de9d08190adc5df23cce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7883ab2-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634280428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280428, "uuid": "7a171822-afba-429f-84c6-87c6f62e663a", "comment": "Malware payload (Loki)", "value": "a84047446721c0cabca9a1a8461e5315", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280428, "uuid": "1f30ca8f-c9f8-47ee-b8a0-27f69b3fbeee", "comment": "Malware payload (Loki)", "value": "9b4f543559cabed7995983b273b43682df26972af0b36191b0a42932332009b5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280428, "uuid": "6674d598-6709-4971-9040-de4db028f23f", "comment": "Malware payload (Loki)", "value": "d4d26892ed2ac7e37ff9da1d6e36cb57c3f66062", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280428, "uuid": "419b833c-e516-4ca7-898c-1d2e45842d95", "comment": "Malware payload (Loki)", "value": "0fbbe809f789a35e61a2d435ca4f60afcbc9194503a3f15b2038e82f4b69cdb39198fcbc0a6eb9b4e1838294ac8cc58f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280428, "uuid": "4c870dfb-f425-4eda-b52c-b22347c2e11d", "value": "T11C74CF0029B95F15E471FF7196BB2B264165DD1ABFC41370C7A7343A28BA76AA00BF07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280428, "uuid": "ac4ba348-0f0e-4d14-b1c8-d3df77d1f990", "value": "6144:UPrUj+QJasi+/yFmHsF8se60p79JImBrXfir4r77hZFtpqAnIEy:SrUL0sijssF169jBrXfOI7hZFtpqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280428, "uuid": "41abef1d-230d-4114-be88-a2ec031e7586", "value": 351144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280428, "uuid": "9609cad6-1ab5-4ee0-a273-109dc4ff0a65", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280428, "uuid": "9885be5a-2747-4822-b73f-ceb0229bea42", "value": "SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcc666f-2dc7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634309403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309403, "uuid": "c4e2b424-51ac-4026-a694-5d1db015c8a0", "comment": "Malware payload (Mirai)", "value": "9ce54be3e13facd29d0630e249bb57a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309403, "uuid": "cfa13fee-ea7d-4ed4-8d36-4f8f11a572dd", "comment": "Malware payload (Mirai)", "value": "9b9c63135cc3356b1346398b436ea8c5e585b03a62aa549d9a03834f0320d8a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309403, "uuid": "464a9d93-2e04-4d80-a586-1b59b4470750", "comment": "Malware payload (Mirai)", "value": "c76000ad0040c8fd672292a26c1180d73f0a47b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309403, "uuid": "3daddb83-af83-4799-82c9-30f7c123038d", "comment": "Malware payload (Mirai)", "value": "1dcd2e001ad9395707d04eaa81ac2f90986446065ee8350a2de6166e4cf0cb2374b25c11fd2d203a4590c70ab15b6548", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309403, "uuid": "f7922003-21f1-45ba-a1ad-77def19c7b9b", "value": "T110534AC8A5C3E4F5EC001D79307AABA1AA73F53F2039ED9BD79E25739542243E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309403, "uuid": "3fc4a7d4-6d32-453d-b3eb-562a433e9e0e", "value": "1536:b5VYYpXIqVkxmxRvXMFnKia7jGKO18Hq6PW3SVE0+j/iMAm9:diYpROxmxhXMFnKl/GHCHqr+E5/uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634309403, "uuid": "d87b6b87-8ee2-4aa2-9be8-26ffa0051af7", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634309403, "uuid": "dc3b741d-fbd9-488f-8d49-ea7084d68691", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309403, "uuid": "a0b0d087-04c9-4f8f-82ce-0f44d8555b45", "value": "94VG.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3d1c21-2d81-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634279574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279574, "uuid": "f9a2dcbc-befc-4873-8639-aedb92d52437", "comment": "Malware payload (Formbook)", "value": "f977d96c98335083d54f9b9b54fb0cd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279574, "uuid": "c0938ecb-038d-4154-81a9-8854451776bf", "comment": "Malware payload (Formbook)", "value": "9c9a99423087bdfd23df04a29984273ba056021ee54e815d2cd85103a9548eff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279574, "uuid": "9c1dbdf4-4efc-46e7-92b1-c598d255f7fc", "comment": "Malware payload (Formbook)", "value": "298da015025154518be5739918956b6b96b91090", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279574, "uuid": "eee015c8-ac01-4afd-bfe3-676727dbe303", "comment": "Malware payload (Formbook)", "value": "53da9b461e53002a83f6c9a333d63210e0fb2175453f773a0ad594b721c02a80db5875c0295436db6814d94fc2731091", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279574, "uuid": "27267661-fc3d-40c6-a6ae-847faeeaa75d", "value": "T1D6B4E744E5F5E8D9C0072176A83DF134291BFB4A9377CC6A2B19788760AF392617BE0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279574, "uuid": "9844d068-651b-4e64-9e97-81eb50602c9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279574, "uuid": "54602b5f-6cd5-4d88-ad37-7303426e56f4", "value": "6144:7FLHgMkhBmA8L8z14cb5TrJbGAdRkx4wSsOXgMx7Dml3SjK:75SBYgWcJrJBdRkpOXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279574, "uuid": "d9d36554-7c82-4c97-87d9-5f4a9008203a", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279574, "uuid": "16fcf4a3-ff4c-47bf-a317-2aa06087d53a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279574, "uuid": "a58f335f-296b-4da6-af6d-17c49f3e1792", "value": "f977d96c98335083d54f9b9b54fb0cd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0954e92b-2dae-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634298604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298604, "uuid": "a3545f9e-da95-4333-a68b-33353d53793f", "comment": "Malware payload (Mirai)", "value": "fe4c0c2e0edbdd6dd487522cdadcd55d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298604, "uuid": "27f101b6-8926-4719-a52b-eca53196b698", "comment": "Malware payload (Mirai)", "value": "9e8cdcfa3658c386cd03da788629977ef62e728b28fbff15b799e19795509ce4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298604, "uuid": "e7868d23-ff1b-4217-8475-ff243495799a", "comment": "Malware payload (Mirai)", "value": "77075710fca067f252da8b4c2bba097af9d0fb15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298604, "uuid": "871ea0a3-c85a-4078-9514-12d47c5c9e5c", "comment": "Malware payload (Mirai)", "value": "8f0907b158bff195aa3e0dc4a33bef5c3a6d6f86f02a913d3b47f774351cc8fe2b977c1a4532d3ec8781be150bd9f4a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634298604, "uuid": "7f7bda25-d467-4745-8b95-eb333de2738e", "value": "T1893328C4E5CBE8F1D8010979307EAFA3ADB7E53FA474DE96D7895923AA04702E10225D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634298604, "uuid": "ae089514-053f-48f8-866f-a3e38dfc520b", "value": "1536:QSQtie5bHVtdwxJzNlE9NglUKWwsFqJpNLxL:CtieRXdwxhNS9NaUHwIo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634298604, "uuid": "ea300704-2f4c-4441-bbb1-8450f10a7715", "value": 54160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634298604, "uuid": "48dc7bc9-54bf-4a4a-bde5-37da3a5d8976", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634298604, "uuid": "38f9d06e-3166-4851-a4bd-dfa2d87b1965", "value": "KKveTTgaAAsecNNaaaa.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f733ed45-2dbe-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634305875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305875, "uuid": "736b3f74-31e2-47dc-9bff-2b5273fea795", "comment": "Malware payload", "value": "50b0532fb46b59495f1157391722cbbc", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305875, "uuid": "53dec72a-f132-4720-bd9f-c7e3210a9aa9", "comment": "Malware payload", "value": "9eaa499aa4a1bc644d2a9696f87a2e75c50c64da1ad52837db4e15659b7fd17f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305875, "uuid": "1360e9ca-c3b0-462d-84ac-e982dc7639eb", "comment": "Malware payload", "value": "79bcfe97656e6dd85e69d43144459b555fb29db6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305875, "uuid": "ab08bb83-c1ab-4e81-ae1e-3077a327f753", "comment": "Malware payload", "value": "b5a1c824bb7cef08141e287fb6f41f1ce14f050ce597eaa8732e9b06120e5626f502539767a3cc3c9dcc383460402c15", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305875, "uuid": "8bb8cb98-90f1-438e-a509-a41c4e201ee2", "value": "T124830862F2A5C81AD92443320DE7CBE26732FC899E7E57473184BB0E2F78AD45E07546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305875, "uuid": "a71f2612-5639-485c-aad5-bebf1ffbd22c", "value": "1536:2xpcKoSsxz1PDZL2Qiw+4868O8KKA4Rek3hbdlylKsgqopeJBWhZFGkE+cL4Lxlx:UpcKoSsxzNDZL2Qiw+4868O8KKA4Rek3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634305875, "uuid": "bd47aae8-be13-438a-81b5-246dff8a4a88", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634305875, "uuid": "52cc7892-4554-4312-be1a-4ee99bf3dd9e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305875, "uuid": "276f8e33-3439-492b-b466-6a7302d26f35", "value": "Bericht(entwurf).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c162f0-2d84-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634280964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280964, "uuid": "3abf752a-517d-4113-9686-809c0f6b682e", "comment": "Malware payload (Loki)", "value": "d47befd1774b096afb0f6e5e2adea52f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280964, "uuid": "8f15b95f-0096-40e6-9905-5eb26f1fac22", "comment": "Malware payload (Loki)", "value": "9f45d2565f9a142cf8c52b2323c5e3d14e9ef0f74adf7f9298814f3e6dbb1c93", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280964, "uuid": "e36a396e-aa32-4165-ab0b-96324c1e41bf", "comment": "Malware payload (Loki)", "value": "c692c29b8fe4d77ccac70e8a58076ab347613b63", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280964, "uuid": "92bfec67-18a8-4798-b24b-3d73cfa2fcf1", "comment": "Malware payload (Loki)", "value": "36669a2d206fee61feafa6e235ddd76a5ee1183f8b94afd9d685bee4b7a67509378ecfd51ec4132a48cb103b856b8241", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280964, "uuid": "d97fbecf-61ad-4620-bb48-b129f31da125", "value": "T101D27C04338DC621CABE573B59A3565013B6B3E76912DB0A7ECC41DC9D933871B23BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280964, "uuid": "47256f48-186f-4c3f-bd6a-75397b6fcec1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280964, "uuid": "53b408f0-aee9-4477-b551-287fd9a6e4b3", "value": "768:ze7rsI5SDiEMws3KqBMwUVRLhasjtPi5FL:ze7e/MhGlLNar5FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280964, "uuid": "e85fe03e-91cd-4fde-8d9e-d69a85652ec7", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280964, "uuid": "4c18eea2-e509-4d8a-b2ec-695fa03b4e44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280964, "uuid": "a8a62807-9a67-4d20-8e48-80e4ac3e1f94", "value": "DHL INVOICE DETAILS_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f574aa86-2ddb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634318328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318328, "uuid": "2f2ee1b3-18b5-4a22-b215-905bddeb0060", "comment": "Malware payload (Formbook)", "value": "6f458a706a5d5e0a65adaceec728d6c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318328, "uuid": "fb8d8382-f8cb-490c-ba9c-4158bff4b4fc", "comment": "Malware payload (Formbook)", "value": "9f55a497a04ad1181a75185f7b2ec1be0b9d33ed50f26c0c8cc82fa0f85db590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318328, "uuid": "e52e76ef-4d64-4807-83e0-2857b50425c9", "comment": "Malware payload (Formbook)", "value": "5d623230470043f8a55a426e2b95b1501cd96820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634318328, "uuid": "f5257fc8-b447-4651-8518-da817498b2f4", "comment": "Malware payload (Formbook)", "value": "d68aaee94b8b32da1cf56c3b5bcba68d9ea7f5c97770de35de7191166ea15bd7ff594003ccb5af0c16e4ab96db802c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318328, "uuid": "0f9037c5-ed4d-4d9e-9d4d-26706178c7b0", "value": "T1CC74016033EA531AC47B4F7918B656C54779772BBB08E76E2884349C8E227138B217B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318328, "uuid": "d364d055-3427-4c9d-a3df-4f870f0e42d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318328, "uuid": "c29df3ac-7d78-4ac3-b02b-d4a5fa33d73f", "value": "6144:P9CLgMkhBmkApFWCev74HjUbgA731K6L8wk7+neqr/06abjj9k+mbdsLFnjD:eSBmk7v74gUu19kY3/zaPW+VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634318328, "uuid": "a5aa265f-a621-4741-bc3f-1b841b74aa98", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634318328, "uuid": "bf22fd3d-4746-4c18-94d5-dd6b7b1ca837", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634318328, "uuid": "8fb2c06e-d39b-402a-9a45-833fa05e1e36", "value": "Doc_008543678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10a630a-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634321246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321246, "uuid": "b6918387-fe94-4704-94d0-8ae420297612", "comment": "Malware payload", "value": "c052190b60d83304962baa2f4381ee06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321246, "uuid": "133d4ae1-651a-40a6-8ae3-ec1e6e2e7695", "comment": "Malware payload", "value": "9f59a9c7a38d8031c5b0829da6c4c10951b1de67adada4f567449d4b6ea8d83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321246, "uuid": "b887c565-fa91-4003-b8f4-bc08124122dd", "comment": "Malware payload", "value": "1b9be49206b5c9c88847ba83ff4971902ff033b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321246, "uuid": "07d786f4-65b0-4b53-ae2a-a465aba30da5", "comment": "Malware payload", "value": "a7165ccd5fa1b5ffc163ca8b83c7918b84895c650b7c8c0b6da4ecad94fd3fed5afd140733652a410a1c6428c610722e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321246, "uuid": "df8e0f75-6d70-4555-8985-66d0726fd982", "value": "T1383412637AD1D4B3D2C652F2C6E3E2BBE67E863505107A0F1BC4AF3665325C79A1E060", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321246, "uuid": "ac122361-34e4-49f6-a261-8490a7d0e302", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321246, "uuid": "c65eec8b-4cdf-468e-bcba-544f3c404e41", "value": "3072:wBynOpL12riocLMJmC6NLrcTf5TVs3PNz5AesZR1jGGgVeK4AjdG8+A7Bp7Z3Lq3:wBlL/cJQS7WPpgfsj7jhhVZpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321246, "uuid": "ee9bf2d9-6afe-49bd-af69-353590265e60", "value": 252694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321246, "uuid": "d618309d-a473-4e8e-9cf2-e0a9aee99605", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321246, "uuid": "89e87122-fef5-4580-96cb-c49221224914", "value": "c052190b60d83304962baa2f4381ee06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c843f98-2d5b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634263203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263203, "uuid": "5cd5b866-4670-4a8e-9c33-4f1078e922a7", "comment": "Malware payload (Mirai)", "value": "ef39fb456ddc20cc6a205f197df43d50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263203, "uuid": "1671012d-4e82-4b51-90c6-c78b91f0fae7", "comment": "Malware payload (Mirai)", "value": "9fe886eb971525d09b41f5fc0df9390576395bda8c9be0192a16b6c8963577a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263203, "uuid": "15ec53b0-3942-495e-a3ce-fe7ec6001a30", "comment": "Malware payload (Mirai)", "value": "25b91f71613d59c4c4f32da2ae766f57c3b51ca8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634263203, "uuid": "711e0cc0-01c6-472e-b057-8d76986127aa", "comment": "Malware payload (Mirai)", "value": "d9795fa2fd059db881e94ec4ca66bb7861729d6ac98df5148b61abc431aaba1fbc77f02ac2149af9ff9a77ec3a22127d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634263203, "uuid": "0c4da06c-3eb2-4467-8d61-ceff13a4e401", "value": "T12BC33B42EA409B17C5D61777FE9F414A3322DB54A3DB330689285FF43F86A9E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634263203, "uuid": "87e3cc78-252c-4eb1-85e3-a049e8b3f243", "value": "3072:tc/BCltnde5hLckPBrPDVpN+Gt4TmxoWM/9xM/:O/BCltnAcErPDVpgGomxjM/9xM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634263203, "uuid": "e6cd4f28-a1c7-45e1-b084-e31e91de53c5", "value": 126644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634263203, "uuid": "7b175b30-8de3-4d0a-820f-9e2af1d8465b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634263203, "uuid": "08936ea0-6c8c-4c22-82e1-64d9b9367a5b", "value": "Owari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a686fd-2dbf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634306008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634306008, "uuid": "533b77c0-ba82-4311-892c-066db19dcb25", "comment": "Malware payload", "value": "48534d5a1b98635f0850795b1eaf5a18", "object_relation": "md5", "Tag": [ { "name": "ASPXWebShellr00t", "colour": "#A076B6", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634306008, "uuid": "47798b8a-5ec2-49cb-8813-9f09aad0624c", "comment": "Malware payload", "value": "9fe95310ce4e1b491e97bee18efdc4ef8a2e50b395779b3d768bf7cbf5700918", "object_relation": "sha256", "Tag": [ { "name": "ASPXWebShellr00t", "colour": "#A076B6", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634306008, "uuid": "11129a19-4f8f-4348-8d28-794181c3d811", "comment": "Malware payload", "value": "765edcf2ccb65801d875c3564ad3b99f58aa3b28", "object_relation": "sha1", "Tag": [ { "name": "ASPXWebShellr00t", "colour": "#A076B6", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634306008, "uuid": "d7b3dc4e-a196-4979-b591-60660deeaa09", "comment": "Malware payload", "value": "a8e1b0e7a79cbc1eb427031b744d0de339027fd209b31eeb21d7d42e848c5bfb32484333f9a840569747606a013259aa", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXWebShellr00t", "colour": "#A076B6", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634306008, "uuid": "b128d024-eb8d-40b9-ac9a-2be4c95f675e", "value": "T1AE33A4095D89595B8273B33AEFA38459EF23116303665630FEDCB2061FB445846B2FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634306008, "uuid": "55647ab8-3cc6-4b69-abd6-5b03e2a2243f", "value": "768:ZrWL/STt9EQzQvUrDAg5kCYtzEl2lJ7h4O:Z6/STt9EiQcDGCYtzEly34O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634306008, "uuid": "c894b3dd-7fe3-4d16-b4c4-beeded7b1591", "value": 51295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634306008, "uuid": "d9dfa4a6-e422-441f-8801-530a30ead003", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634306008, "uuid": "0cf1b9b4-ce41-4551-8b72-638337f04154", "value": "htyLX0L1.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e29ea5-2dc2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634307369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634307369, "uuid": "72c6c087-3817-4b3c-bcd1-80d2c068083b", "comment": "Malware payload (RedLineStealer)", "value": "adf176c453f3e41fa05ee104d85a3090", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634307369, "uuid": "643e8e7c-cd44-4728-a1bc-3d805cf7db0b", "comment": "Malware payload (RedLineStealer)", "value": "a1c2a8d328a756b25f0f871843dd68cf12f266291f9764523d9ed1d909e43a22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634307369, "uuid": "181000ad-a2e0-4d81-b0aa-3304d4fb9bc3", "comment": "Malware payload (RedLineStealer)", "value": "42aa1b7ee4d8ebabc99e44d029230637d47c1013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634307369, "uuid": "d650256e-ebcc-408e-aa5f-cc32155190d7", "comment": "Malware payload (RedLineStealer)", "value": "9b5ca1c2352eeb796355ea0c25182a55dcde04b601cfacb89cd2938edefe5c0089cc02544a83397e9da27f4f98ee8837", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634307369, "uuid": "749ff690-1a65-464e-b280-440c718eae2f", "value": "T19884BE10B7A0D034F1F716F85ABA927CE53E7AA16724A0CB52D522EE5B346E5EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634307369, "uuid": "22b4141a-7050-4433-b646-a56f412637d9", "value": "25506997d455f542a3814e3772e2c9b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634307369, "uuid": "4c4391f9-7122-4468-b4d3-9c6354e44f02", "value": "6144:SspugGMEfQlpQRpl1RuP2I1kzDGeIg/rgkNEjpByT8WcrgaxHUHmWl:bZGMucQzdpqevdmjpByT0rgadsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634307369, "uuid": "73c28899-a536-4dbb-bef2-7f3904e17f41", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634307369, "uuid": "b15266f2-3207-41d1-bccc-652620bacc56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634307369, "uuid": "5ad1fc98-a405-4220-a1ef-1ab4ad7b212b", "value": "adf176c453f3e41fa05ee104d85a3090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d1ab5e-2e06-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634336716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336716, "uuid": "d30d6e51-b9b1-48ea-9f5f-ef301118c665", "comment": "Malware payload", "value": "b4261109c2d8b560ea930206da73ead5", "object_relation": "md5", "Tag": [ { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336716, "uuid": "4759a0a3-d28e-4df7-92c1-775e03ac0360", "comment": "Malware payload", "value": "a1fef72ee40c92802a713f095c00cf9afc4ef5175ce1b57eca7f638d0f4fa85c", "object_relation": "sha256", "Tag": [ { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336716, "uuid": "5746ece0-d838-420f-b370-d300f96a0b69", "comment": "Malware payload", "value": "23d61751aaacc3974da23ad2d6d14519a8b74e24", "object_relation": "sha1", "Tag": [ { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336716, "uuid": "b331b46c-fa52-40d2-9a9b-884fe5af7f06", "comment": "Malware payload", "value": "f379e34034e0b74e522b008d97db0fe6daf8e587dd7e06e27047a3edfe2b3e6b590759f140d429812df71666b09bb654", "object_relation": "sha3-384", "Tag": [ { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336716, "uuid": "6b8d4f05-e465-41e7-b978-6ddfefd9b763", "value": "T1E6149E0563CF5EEFE38245257D96B0A81EB93A5E8F334A77157E41EF0632873299130A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336716, "uuid": "cef54268-152a-4a97-b127-bbbc484ff21d", "value": "6144:8Zh53CEz0SjEzo+Npcu2CxuYEjNJeL/IzDOa:8rL6dcu2CxuYa2LwzDOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634336716, "uuid": "1e32de73-2dda-423a-8142-637e875bc45c", "value": 208392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634336716, "uuid": "52ea492d-389f-447c-94be-fde2698fbe39", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336716, "uuid": "e27cae3c-b921-4278-95bc-1eac91c3a8f9", "value": "PSxor35.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b1f456-2d8b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634283827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283827, "uuid": "aceddb34-a7fe-4cac-89fe-37890c71d100", "comment": "Malware payload (AgentTesla)", "value": "4e6b9341bdb8a3fdaa9b9a2d85f0ec2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283827, "uuid": "3529c993-83c9-4096-945d-afb04d7d35b9", "comment": "Malware payload (AgentTesla)", "value": "a21b4bf393e2d12bc43b8a6066045e5ad301b76b042a132c07b4a0dbcc9f7f00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283827, "uuid": "eef8d50a-da6a-4b02-b8cb-0450968b047f", "comment": "Malware payload (AgentTesla)", "value": "02ecdea0e4ab7cddfd4fef5c4b3656c215f52df7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283827, "uuid": "1ff23399-798e-4d71-b09a-fa4036931850", "comment": "Malware payload (AgentTesla)", "value": "e2b5645f3f4bd041c572665b2926fe17ee1baa1aa2f721386c550b88a526220d4c4c1a6d75dc0a50941ab364a6a7ae3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283827, "uuid": "1ea578fd-327c-4eec-915c-d53164ad9e27", "value": "T1F38423CA94661B4F02DB5F25FE28FC090C99ED29A055C520E349E61B726FBBEA0841DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283827, "uuid": "d739eaa9-6eb1-45de-9b98-fe1299d96a28", "value": "6144:LUdSqtUGIuwzR0caG2aPbNINdsg+7TyWaVn4fc8094CW5WJXlUHAw33p5w3Azlrb:eV+uQWcZ1busg+/0Vnoc809Y5dH33Y3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634283827, "uuid": "66de4d9f-8253-4fb7-963c-8793c5754784", "value": 378218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634283827, "uuid": "a5337cff-227a-4d92-9509-12bd1aa49928", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283827, "uuid": "3692be7d-2b2f-4855-b41f-898139139fb5", "value": "PO CPWPKL-1901088.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6654fe-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634280384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280384, "uuid": "9579c3ab-2ab6-406b-b1c0-a2835fd32f6b", "comment": "Malware payload (Formbook)", "value": "ce669e849499691c572cae1e22fafbbb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280384, "uuid": "f4f685f4-8e1e-4cf6-a4a0-b9f9adf486a5", "comment": "Malware payload (Formbook)", "value": "a23425be1b64165391c27a65db8082855a16057655f6a76fa208c39861f6e279", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280384, "uuid": "73693e00-08e8-4204-bfc2-0656513dbb45", "comment": "Malware payload (Formbook)", "value": "7a982e6229963bee82669d014f63729f85040f8a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280384, "uuid": "6512ab2c-4f58-4a45-80cc-1a748d5388ea", "comment": "Malware payload (Formbook)", "value": "7e6c5bf98c24a4d97710f9ec9bad66f99116e630db4a90caf0e7ded4ee9e2c7d748779e8f642cc78f85ca970d8854f2f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280384, "uuid": "e762bf7e-2e27-4755-a01b-86f650bbc6bc", "value": "T18B74D02AB7354926E24F06BF3172B4046C649DFD57AA2FDA1FA3BB06113010B4F52B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280384, "uuid": "71de0f00-d4de-481d-af85-27af438ef92c", "value": "6144:/LmBZsUMShRRrvi75UVNjFt0CWN5FtohdTbL/nErPdr+v5h0QE:+MShjjiCnLY5kdb84hmQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280384, "uuid": "c9aee17e-434b-4f54-9007-d5889edf2c69", "value": 351672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280384, "uuid": "3f5b0045-ff2c-48b6-996e-608291cce4e1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280384, "uuid": "b912d2d5-3d41-4217-95b4-1c1d338cc16d", "value": "draft shipping docs CI+PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e9a7cc-2d90-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634285739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285739, "uuid": "4f0d3d9a-8980-437b-9a70-71a5f3abd6b4", "comment": "Malware payload (Formbook)", "value": "cc92dedec89f09b08729784048f1060b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285739, "uuid": "d008ac77-0ff9-4c36-96d0-e4d35ef1007a", "comment": "Malware payload (Formbook)", "value": "a2539269c2b9200d7baed9f0dfc25b59fd4713a641d79fd9bd13272c7e1296ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285739, "uuid": "3568c5b2-0827-4aa7-bbe2-a8bc4f92a18f", "comment": "Malware payload (Formbook)", "value": "23c567c3d934ea81a26771da855f6815d9483457", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285739, "uuid": "5de28ed2-f74a-424c-bac6-1d70dd8252c0", "comment": "Malware payload (Formbook)", "value": "57c9b1dd78513d089a523eb187c6d95edd22ca21b9598fca2622cd1b3fea03145f85f17837f855d8a69b347957d6965a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285739, "uuid": "3c704d4a-3521-4de7-914f-50202f23fe34", "value": "T124F46D529EBCD435CAA1693DCD1F6398671E7E103E24543B3AD23E0EDA78790B52D342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285739, "uuid": "d12a952b-3c72-4bb6-a1a3-1426d1b3e94f", "value": "f5ffba271bfb9624023f7853a89e38a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285739, "uuid": "da8afd31-e8c8-45e2-bebe-5fa6c115d438", "value": "12288:bCF4Dqt0bJMifjeHRcPF7KyiNUZci+BfZ8fQO:eiVbJMifjQ0JiNUZc/Z8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634285739, "uuid": "26d8833e-f6bc-49d9-ab5c-97d8fb473137", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634285739, "uuid": "5365f316-e133-4f8f-baa7-f939d6530f2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285739, "uuid": "96e44413-0e59-4d84-9e53-7fc043c998c6", "value": "cc92dedec89f09b08729784048f1060b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e9e706-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634320957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320957, "uuid": "9eb23e72-1f52-4a42-9ab3-51fd4dc14536", "comment": "Malware payload", "value": "ee6e199aea5d5deef50528aeb92833ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320957, "uuid": "18944ca8-1ed2-46be-8e8e-12bd254ca788", "comment": "Malware payload", "value": "a27e70916ea7038818d0639f9acca031ed752f6808129f722f4115f5d50d30cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320957, "uuid": "6ee20702-f9ae-4431-84e7-7122eeb4d776", "comment": "Malware payload", "value": "d1a5d9eacf6c328e7acbfb810c84e4037cbee700", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320957, "uuid": "0c09f8ba-c197-40fc-8cb2-35983c6677d6", "comment": "Malware payload", "value": "d79bd8ac7d7de307f5d46d6f853119e732a64934211d23da93e8b8442e50f21f0c1a7b2047363817c71f09c7311d27c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320957, "uuid": "e38ee76e-bded-490b-9c8d-49fa886cd90d", "value": "T15504036B318DF6BE8D8364E3D72B80CF12B92F71971BDF9090A4905569E04378B36E48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320957, "uuid": "2a1a6000-68fd-436e-99bd-cf707610d0a7", "value": "3072:b5oQVIy+l4Zr7oz1U0RxajbizScAXjrkxNIQftl9oX:b5dV9x7on0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320957, "uuid": "447c0244-7557-415f-90a7-89941941a9cd", "value": 176094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320957, "uuid": "fcf15cd9-a7b8-40c0-aefc-7b913c3a628c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320957, "uuid": "e0e2285a-0b50-4499-a6a2-0e83718a4337", "value": "2954942_06_min-234896.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001daadc-2d7a-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634276255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276255, "uuid": "af4d4158-307b-459c-8d98-27799a04927f", "comment": "Malware payload (GuLoader)", "value": "c5e63c7c7413ec0d438630e95d8dcc15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276255, "uuid": "000e7e70-90d2-4150-b689-7884e02d7674", "comment": "Malware payload (GuLoader)", "value": "a2f4228af8ed5ffef5cf23abfa4157cf3810ab42f20422a50fbc317a1fd9835e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276255, "uuid": "39bf8b34-807d-420f-8736-bd424df5f5b1", "comment": "Malware payload (GuLoader)", "value": "e27f2c916649275f441fa2b4bba17ee26e224314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276255, "uuid": "9feac1e2-3846-4549-a759-fcebde91e70e", "comment": "Malware payload (GuLoader)", "value": "eede47c206e22d5eb2eee3ed684003fa81b826000ce18e8d93629b3c0b58e2ba66b3d197f7c01e451d76b21d3cd5951a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276255, "uuid": "9d1451e2-a8b1-4462-8112-12587e5359e4", "value": "T1E1A34BC3668C28F1F9019A7D0B7F6167475DAC33A4455E8B10846B0FC57EBC2A92972F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276255, "uuid": "16f98a02-4fea-43c5-b0b3-fe45ceaeee4f", "value": "3d3cd1bd8dcc611a5734bf41f4e1a6a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276255, "uuid": "ed6e4694-5603-46e8-81f3-3be6e39bdd43", "value": "768:tpDPX2DNW0/MSKi0+rA2Im4nKc5PZCodIYfAn6SHf9+cpXzpDYZV/SFVBD:tpD8WK1zrWm4nNeoLsH3DKV/SjBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276255, "uuid": "ae72b2a8-b1cd-4ba9-8b2b-3c2fb13b2425", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276255, "uuid": "e34bddff-5e93-40db-9357-71f627255da1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276255, "uuid": "89954d69-87f8-4c16-8044-d36cb67971aa", "value": "PEDIDO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2526be-2d7b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634277003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634277003, "uuid": "7d601a16-a636-4d3a-89bd-0950cd0944dd", "comment": "Malware payload (Mirai)", "value": "55a0c4e7b6274860295ec6bbd5bfb934", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634277003, "uuid": "846a35d0-5963-4ad1-815e-2e2d9083043f", "comment": "Malware payload (Mirai)", "value": "a3815793f42028195d54bc8b93488701bceef8abfeb3d6b8755d3162baecf187", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634277003, "uuid": "76fac99e-1865-49cd-b8c1-426a69f75142", "comment": "Malware payload (Mirai)", "value": "f67ecf02bb9feb856448e2808d05b7e80cb69e4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634277003, "uuid": "13fa3e80-0532-4062-b840-a25f547d33e3", "comment": "Malware payload (Mirai)", "value": "586adb76229690eb96cfa19318839778b3a4a3d655970b9a5feca263763d760c3f26b9e3371751b8ecbceca492dc4900", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634277003, "uuid": "84e27919-9b79-456e-a7ff-aa322e992656", "value": "T1202302B90F5A99328E7E9DB9A97405816F870F2DACCB248D50B453E93B505933CF098F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634277003, "uuid": "125ea371-7d19-49b5-a91b-02ea20514af6", "value": "768:vHq8XdG1zvTZB9I3EETNRLbBGdy86lUnlNnkDhmj39q3UELMyBZ25Z7X30kF:vHq8XdKzLX9IU8LcJnn05LMHFrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634277003, "uuid": "cd9568cc-d964-4966-8f63-d5dcbc213356", "value": 46844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634277003, "uuid": "ed9fa6dd-55ae-4eeb-9cb4-0e401d4e989c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634277003, "uuid": "c56406a0-658d-4c77-87e9-29172705bc88", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7efc65-2d80-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634279151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279151, "uuid": "61ef95f0-6baa-445b-973c-94cdf856f132", "comment": "Malware payload", "value": "792356100c405ab950340a311df02764", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279151, "uuid": "02c34bc8-9a86-4dd6-8c03-71cbc0f5e185", "comment": "Malware payload", "value": "a49e20c8211e8f4268b0b5c13b4f1d70a0b74dc24e8a08a857cd2b1ff4ad4c3f", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279151, "uuid": "e2e42bc4-8a4a-4047-adbd-336ff060dd80", "comment": "Malware payload", "value": "5d8c321334e2ba433c3e691bbae7e554aeb3e20a", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279151, "uuid": "559e0e64-2bd9-47d5-9824-6da33fd85f7e", "comment": "Malware payload", "value": "1edc6f274d90e1bb1d10405436e9a16db14591730006dabd147e4a0cd7da0fa7547fb9bdcafac5cd6281c9621d44200a", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "link", "colour": "#B9E92A", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279151, "uuid": "c4cbd055-d8d5-4831-ae0c-502a99e108d1", "value": "T140F0AC1FC1249516EA7A07BA4504CBF8D1F94744BAD99E8B5CB4EA8689082AF7C1206B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279151, "uuid": "a82587e8-3545-4a4e-b197-5351e2fa11ab", "value": "12:5jVPxruTNwHV4JONRf7vJ6MxnjxFgrviQ/3VF1GKMxrwRta8n:99xCh84kNRfLJHjx+13VF1GHxAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279151, "uuid": "67cc4351-07f9-4a0c-9396-5306877fdb80", "value": 609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279151, "uuid": "fda93ac8-84ed-45f8-acf6-8514d30e5faf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279151, "uuid": "b683a022-d421-48ab-9426-3c3d67592be4", "value": "599151.301.25077.7868139..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0068dba-2d9a-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634290347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290347, "uuid": "8b857b98-2e86-4d10-ad2b-9fb826d466ed", "comment": "Malware payload (DanaBot)", "value": "2540d86500ff77fec9c2c313b5398c5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290347, "uuid": "97f15e89-5686-4e40-a3a2-639ebe041c6f", "comment": "Malware payload (DanaBot)", "value": "a5437c7d1711d9ef40881b429e3b308c5e3d6b94da15aa1b20f5c64ecbe49848", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290347, "uuid": "e21d7d3e-1918-462b-acf5-b1dc75c7e6fa", "comment": "Malware payload (DanaBot)", "value": "aed9e3309557e3879c6f19672a50b68fefe42944", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290347, "uuid": "ec979c39-b9a2-465e-927e-7a057f5f214b", "comment": "Malware payload (DanaBot)", "value": "b01e182ded1579626de40e9a43fe230de75e8a0ac5be0fc9e18e6e53aff517b585c855d2817e77312b0db59806667a93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290347, "uuid": "464f3036-e210-4d52-87c2-8115ec099bf4", "value": "T15F45121077A1C034F1F727F84AB692A4B52E7AE1A72864CF23D825EA17396D5EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290347, "uuid": "0d705166-9900-427a-a6d4-7911f755fb25", "value": "9e2cb00668936ef8a66a623b516f5f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290347, "uuid": "5bf1e7d0-3b23-438a-a067-2a6a8b3d5ea0", "value": "24576:GHwyO/SrsQq731wku7XhPAjj9/wywokm9KOiWQJILi9l:ARbCPuLhIjR/wQkm9KOvQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634290347, "uuid": "50dccf9a-93e3-4188-b6fd-97e39d320ade", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634290347, "uuid": "b3f4146c-cad0-43c9-801b-322211f2f99f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290347, "uuid": "e20b3ca1-be58-4dc3-bae5-2a04bff18f49", "value": "2540d86500ff77fec9c2c313b5398c5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4b1eb9-2d7b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634277005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634277005, "uuid": "feaecf57-527a-4225-8e0b-c9f74f63526f", "comment": "Malware payload (Mirai)", "value": "c6acee4fe27a44e31dacf8f159c40368", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634277005, "uuid": "089bf12d-6477-40ee-824b-0270404f2433", "comment": "Malware payload (Mirai)", "value": "a5e0265a5e64b251edfb86f832aef9f9b48f8dab582d004fee4f3d540c2cc7dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634277005, "uuid": "4931134e-80de-4503-bc08-acb553d4d71d", "comment": "Malware payload (Mirai)", "value": "88b73ac2db8eb0e612e6633b0918d7a8a00cdf5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634277005, "uuid": "39e72242-4b95-49c0-a7b3-87e48ee99b82", "comment": "Malware payload (Mirai)", "value": "416ef47d171af1eb506b19bfff5ed27afd040829596786a738189972c17af28b88907ed535490278c2c0ad9a114b0ab8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634277005, "uuid": "a5ccb56a-d42c-44b5-b1f8-12e72d4e52ae", "value": "T1CAA2E179E902189BEC9666B2BE36CD4B41106CB0924993AFF76AC0D127FA387D0518DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634277005, "uuid": "9f01b716-9b1d-4369-8365-6524aed84d3d", "value": "384:MwX206yHsN1yGbE3F2hHCM6ZHLZIcbQPKLEqJKV+NBsk0NyY:f2/XbE3eiMUrSdK4qnvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634277005, "uuid": "633f6aa7-0b46-4315-b97f-1f30fe5c1ddf", "value": 21992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634277005, "uuid": "ebaf4ef3-3952-4183-b0dd-1a6772010218", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634277005, "uuid": "cbcb129a-a892-433e-9c6e-8eb48d2b6782", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392f6ada-2d7a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634276351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276351, "uuid": "d1cc5408-d775-416a-a767-452ca3544d83", "comment": "Malware payload (AgentTesla)", "value": "483783835b0d5188bd86cafa161ce543", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276351, "uuid": "31af0ac1-798f-4fc8-b03e-604a2c953436", "comment": "Malware payload (AgentTesla)", "value": "a5fb662deef4a96d6364a4fe9e7ac0e0a62c92dd4ca4a297b4ad32e0c755b8c3", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276351, "uuid": "c42a48fb-2aff-4d0a-8f65-c414719641d4", "comment": "Malware payload (AgentTesla)", "value": "b37dd49bf8d42536b568917d2af35710bb538d55", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276351, "uuid": "1e96edcb-1a65-4cfd-9582-ab2c2b9b28a7", "comment": "Malware payload (AgentTesla)", "value": "68b57b4114f74e79d3f16964a572c61e9c9d011ea20ec6f5b88f33bdeff1d14d6923ed9cb52860440f3a24c946e18e08", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276351, "uuid": "02d0277c-61c2-41a5-b8c1-8c68d9c82d75", "value": "T1E7B312FF64ED659EB3E991BB9A5DAE79E23018ECC21CCD8DB7001C5A0CFA0753101988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276351, "uuid": "5239041c-8cc8-4192-9766-a67aec6a49b6", "value": "1536:lHxbHvxmJdJl84z81p5NRX1uyVRvcLXTTGAcU9TrIbqvLEINs/KibeUJ5rfu5UEU:ldHJm/JYHxaPj3IbUNAnbe2hfpEql5Ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276351, "uuid": "3b54a77b-24e9-40e2-9274-14619965ce31", "value": 109312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276351, "uuid": "deab0c59-3ad9-466a-885d-078c504d83d8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276351, "uuid": "9ab43d59-8bf9-47e4-a1c2-76f59b356043", "value": "Purchase Inquiry.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5befa57-2ddf-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634320019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320019, "uuid": "c55eb4bb-cb52-4723-9216-c2b1344c4cf2", "comment": "Malware payload (BitRAT)", "value": "17730f2c1447ac620dc60a8cd9c1f845", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320019, "uuid": "53939119-3018-432f-8a5e-ddaa9939f587", "comment": "Malware payload (BitRAT)", "value": "a8130d6e0367f83f68640720c35d12b339c1a84e371cff73524fcaa0fc62f44c", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320019, "uuid": "0b941f7d-f810-463a-9bf8-5a44fd29375a", "comment": "Malware payload (BitRAT)", "value": "4206e477cb8c3b12eb65206310b9cc29e1c4f99e", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320019, "uuid": "d8fffb51-5082-44bd-9129-2e7fa27b6ef1", "comment": "Malware payload (BitRAT)", "value": "6cab861e8c0edd5be406624f710c3c1377585718c1f59f75d9baca899b02dad75f09e12ef9814824f128b1ef4ac64115", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320019, "uuid": "c21058d3-715e-44a6-9c93-5f4308edb1fd", "value": "T18A646DA11E16EC05DC2869B6C572D4E923717E2CDCB98606708DFF1F8B3B28AD51473A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320019, "uuid": "fc5794b4-fd04-4def-99ff-71992bb227ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320019, "uuid": "df732bc4-41ee-4546-b8e0-437d59f6aab0", "value": "6144:m1ICeh9IuiHfpFxZTD/THyh4l7V3XR1nPtBOVTn2:CICerPiHfpFxZTD/THyql7V3XR1nPtBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320019, "uuid": "bdcf1762-95cb-42a6-acf5-4033c89ef115", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320019, "uuid": "53ca301f-f0b4-442e-9074-65f69650d1a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320019, "uuid": "12550126-3973-4fe3-b708-a44a424d8ad6", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340e21ca-2d79-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634275912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275912, "uuid": "c918d0f2-57c4-433d-b141-127d777c099c", "comment": "Malware payload (Mirai)", "value": "7eabeddc5c9316dcc1c6e9e20c52a128", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275912, "uuid": "8273fca5-585b-4dde-acc8-f11227ae8f9f", "comment": "Malware payload (Mirai)", "value": "a95b13928598ef47ac96eab438607218c546117bae9d570c242ae1036fe59b2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275912, "uuid": "1564acb9-b57e-4c89-9d69-6c04b4170542", "comment": "Malware payload (Mirai)", "value": "b84adce6f80cbd079d586b0b775081995b3b8c36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275912, "uuid": "7f6bdaa6-a398-48bf-9295-cc378072623d", "comment": "Malware payload (Mirai)", "value": "4b8fed6bc95d13a14c8218df696083aca911813fef25bfc5cfa711d885db85c19834667fec4e94fee0ae386b538ddb92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275912, "uuid": "951f5a86-7870-4a8e-a10a-749aed48f5f9", "value": "T137B2C0FE6DB895DECFEC9AF9A1C4071A8544618635E9878443608C84B739A7AF34D0FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275912, "uuid": "f430a992-0b55-4b10-ae82-11d2f885a104", "value": "384:SDtxNuRTN/gJ7nrL2T27MJS8XVdzxhvLhWphJrmt8ZiBCfWGNbCNCLRWGVCz0Nvl:SDtxNOenrL2TqMQ8XVd/vUpHrmtciEus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634275912, "uuid": "0b943bfd-be3c-4433-aeb1-82741776adaf", "value": 24548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634275912, "uuid": "bc237be9-1f29-4cd0-a0af-932de24d8b2e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275912, "uuid": "acf9b217-2cc6-48b0-9ea9-702a5b68df0b", "value": "7eabeddc5c9316dcc1c6e9e20c52a128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b46e23f-2d84-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634280649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280649, "uuid": "2feac855-c577-46a3-b3a0-2bbb67bad09a", "comment": "Malware payload (Formbook)", "value": "bcb6b1075cf6afcf43d06046b3c9ee3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280649, "uuid": "76e1fdd4-48d0-401e-9815-a90f92cef0d8", "comment": "Malware payload (Formbook)", "value": "a9ab19b5e80ce04548b75d379c494d3113f71dfa81afaf23b512e7ee23ef6667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280649, "uuid": "1ec63d13-4ae3-42a6-bbf8-9305f2427967", "comment": "Malware payload (Formbook)", "value": "0062dbb25b586cd8e20cc79e309c1087ea6f055f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280649, "uuid": "de89869c-3a33-4367-b889-b24622aac59e", "comment": "Malware payload (Formbook)", "value": "15008ef67f46f02ec420fb433fa1b350ebff04b9bca9249de9d0cebc3279a82c4645b6a34ea926c7c6eb9e3e1cceef2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280649, "uuid": "91117067-925d-4b3d-a476-05b3ffc42976", "value": "T1D4F49D16F38267ADC03BCE39C412D147A2F484036175F7AAB8C019D49D0DA76AE7B79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280649, "uuid": "5a68ca47-fa1f-4ca0-8ad4-1c7acb6375b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280649, "uuid": "92c979a0-9f5f-4286-b12a-91351686bc87", "value": "12288:B4Ee2cS2wH0YSMd8c0LNbuiGgNXhLGtcx9v6wwfrEXtRc:Bte2x2wH0YSMR0ZuKNXtQw16tfrWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280649, "uuid": "23459470-3365-4748-9e05-68df31d22b77", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280649, "uuid": "24f093aa-8544-4637-bb93-9476a9819ff8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280649, "uuid": "7d31d6d3-4de1-4f29-8e5d-829c86075f8f", "value": "DO854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640fa438-2d9b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634290596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290596, "uuid": "2fc74bba-dfdf-4519-9d8a-b7393d31a2a3", "comment": "Malware payload (RedLineStealer)", "value": "c39f7d21aabffec2e14e7484ed6afe03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290596, "uuid": "ade19392-c3bb-4315-ad2c-7e4d411beea6", "comment": "Malware payload (RedLineStealer)", "value": "aa380d5239ccf0409993f7cfb4c2345d2364f3795398de00ea5b2db86e9a2cbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290596, "uuid": "cf568dc1-009c-4eb3-a5ac-3f68b5f53c2d", "comment": "Malware payload (RedLineStealer)", "value": "ebc0316b53f68ee2f71d9c07aaf10436d9401816", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290596, "uuid": "51d12d44-0851-4c31-a514-93faff3192cd", "comment": "Malware payload (RedLineStealer)", "value": "ce2f889cf380555cb3fe15df768dd939bbfccc5e05a51685e2ff219e99abf1b71d77f7db527242f56edfe0432e3c7065", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290596, "uuid": "4942819a-9ee0-4fe0-b857-433c706ac36f", "value": "T13184BF00B7E0C034F1F752F846BA9278F92E3AA1A725A1CF52D516EA9734AD5EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290596, "uuid": "8ff1d91f-0097-483c-94b8-202854eabd8d", "value": "9e2cb00668936ef8a66a623b516f5f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290596, "uuid": "053571f7-49e0-45da-b84d-179b97f6dcfc", "value": "6144:/+1fYzo2YFtv7XfkLR55Q+ONHlyj/tftlyooBg7eV:Gn9v7XcV5G+Odlyj/tDyoom2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634290596, "uuid": "1121063d-3813-41da-8b7e-4bb7f17fa1e0", "value": 375301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634290596, "uuid": "6323be33-dd24-49a3-b8fb-1360c0d3828a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290596, "uuid": "794f22fb-da57-4d23-b4d5-2a7879c08778", "value": "c39f7d21aabffec2e14e7484ed6afe03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b6be5c-2d61-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634265559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265559, "uuid": "cf84613a-8e7e-4316-b93d-06b795fb27d2", "comment": "Malware payload (Mirai)", "value": "4eac2f3587eb30f6630f028ee02f8ab6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265559, "uuid": "00f8b1de-6ab5-4a34-8116-bec607a373cc", "comment": "Malware payload (Mirai)", "value": "aa454479ac10d7c5dda3fde520cc9b4bc6feb419448fb1668dc00ddbc4db4f26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265559, "uuid": "9e09e4de-4999-4b5f-8264-1edce092c9b2", "comment": "Malware payload (Mirai)", "value": "0fd5c635e98b2351f0491ab3a4f1df6033c409ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265559, "uuid": "63a0efd2-b88e-4b8e-a0f1-6b8aae9d11a0", "comment": "Malware payload (Mirai)", "value": "c2e34ddf63317e8a1264d42b0e4a5cf8938950f19e264a9873f94e1eb89e866673af5cdf7cb093263ce852dcc649b997", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265559, "uuid": "dd44f5c7-f1d4-47b0-a416-5d662fee879f", "value": "T1BA3309DAB402AD7CF98EEABE80670E09B23033145153172767ABFDD37D32154E952E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265559, "uuid": "c1cbd943-df7c-43e0-86fa-56a301462700", "value": "768:p8eTIuI9Me1KyWFr/Qhyuw3gFHnuGU7wWWJUH8w9KqQeO8tTi:eeId9MUKBEoAFnuGUwfUH8wkqQV8Ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634265559, "uuid": "f2a85564-ad60-4bc3-b7f7-d3a6594ec1b4", "value": 52360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634265559, "uuid": "275fef7e-bef7-4056-8868-2aaebe27e6cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265559, "uuid": "b670088d-4fa0-4fe8-8067-235378909676", "value": "4eac2f3587eb30f6630f028ee02f8ab6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8fd864-2de8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634323898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323898, "uuid": "3a84ee49-f985-4a07-af2d-115e57e9f7d8", "comment": "Malware payload", "value": "28e0d06562a6e0df8dad0fa04e4c33ac", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323898, "uuid": "9e4ee7d0-6949-4009-80d3-838c8c19ba59", "comment": "Malware payload", "value": "aa5ea17832aa74736e26ab68b569c83b38d705289df49bb98c0aa5c9657fbe11", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323898, "uuid": "1e6d9472-d390-4285-ae86-30266a2726cf", "comment": "Malware payload", "value": "aa2511f7546d97e327b4a6a027f3195f62e04117", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323898, "uuid": "85d39966-8791-4bad-9e7e-7b671e3e356e", "comment": "Malware payload", "value": "e10c5e89f81834caa6b4b08613fccd5532a509b990a4a6409a570acdd45a7294e6e6807402a59b3339e1fe33007b0368", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323898, "uuid": "7db87a08-c294-4c6f-9898-579a7c8b5067", "value": "T112D533CC1764E46BE26666B1D8CF206371341D49223CE5BF46AE3FA0C4B36897B5C92D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323898, "uuid": "963ffb0b-7e7a-4dc2-a4be-e5920bba5450", "value": "49152:KmIaOnTtAJESpMYAKueNChLFN1y2uTLsMcd+8ntL/8JnD4FE4Niw1gh05n/6TqM+:xIa4TtAJEvDKueNkzQcd5dIKE4N7gh0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634323898, "uuid": "c7a73266-a945-4fa0-8af5-a33e5fb844da", "value": 2872098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634323898, "uuid": "e245617a-9d50-4b3c-bc6c-07aba00502a7", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323898, "uuid": "47da700b-add3-40bb-bba4-a2194698c6a8", "value": "Android build_obf (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf578633-2e00-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634334128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334128, "uuid": "27b4c87e-71aa-4d57-9bb6-e5e6646e186f", "comment": "Malware payload", "value": "724bd5d473623dfaf8a1f18847a72cea", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334128, "uuid": "56f4144b-72fb-4c9f-84c8-b48ea424e561", "comment": "Malware payload", "value": "ab823cbbde9ca87da1a0996c8c6f0f031811da5872d8271e6ae3232ca6276abe", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334128, "uuid": "f762c8dc-6982-4ada-b2f4-3653769b5428", "comment": "Malware payload", "value": "53064ae07afe490a7a562bd2da793e2c8567d86a", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334128, "uuid": "e9cecd26-c929-45ef-bdce-fa18b9cd2e7f", "comment": "Malware payload", "value": "eefacd5c1e3b4ef9300038a7ecd5bb9b4d02a59232048b4066c8d64f4f450bd17d059949907bfa4ee72754bc0d45b8a1", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334128, "uuid": "b1f4a2d3-14e0-45b1-9b3f-b71017be5524", "value": "T19EE31209814B9885E273E2FC28377D8461FD5B24A0CE061D1ADDD99478C34CAFDA947F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334128, "uuid": "20583d81-bc89-4212-bc1c-39d69c2a6882", "value": "3072:22S78APdAMqOBFzG/1xBC5ZV6L6OkeVtdnGHi6OCwdMhA5sJLyoXv4I2DWVKFyM+:o8qTzGdx8Z5OkehGHi6OCjGs5rX9Ottu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634334128, "uuid": "dbc28eff-677d-401a-a59e-6f0785738a75", "value": 148303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634334128, "uuid": "c114ffd4-e90d-4674-bd24-6cb2e99c33a7", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334128, "uuid": "8eaa24e3-72ea-4f39-a06e-8822d78dd132", "value": "asdfgh.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d19dec-2d91-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634286549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286549, "uuid": "fedcf268-2471-4fc3-987a-4eaef825e2d2", "comment": "Malware payload (AgentTesla)", "value": "9ba2c7a4f69bcfa3bb7abf31fb1e1a8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286549, "uuid": "2a94e4e1-cbfa-4fd9-80a4-d4990b6b777d", "comment": "Malware payload (AgentTesla)", "value": "aba581d47e923f5bb01d25b183fa6a72e51cb0099f9dc2c37973344f43b58c40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286549, "uuid": "e0847ac3-48c8-4523-a1eb-2448e5826931", "comment": "Malware payload (AgentTesla)", "value": "94e689568954086f17bdf2d002ab60a988608f12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286549, "uuid": "a09b0902-4a28-4aba-94bc-c26584fee85e", "comment": "Malware payload (AgentTesla)", "value": "e33020dd11c323910dd6022e812e17b37f9ec6ab4ef648ac2641f42ec53131ccb0b6653e6d87ee5f6c77b65b941f1854", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286549, "uuid": "7a1381ec-b8df-4bb8-9e9c-6871df544872", "value": "T1F24501402B59991ED1754F75889E411D73B84903AAC2FA0B3A9FF2EF27B239318215DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286549, "uuid": "15d9a391-1bd0-4fb4-ad0d-c2079df98cdd", "value": "12288:YUSB4OqsjJo1rCXqvku4Y2eCmZSFEFo4rBF4:YBwsjJorLvku/RZrzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634286549, "uuid": "deb3a597-e254-4c75-8a22-b6183cd9c0b5", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634286549, "uuid": "99a7010e-3c98-4cc5-ba17-3c4f097e4a23", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286549, "uuid": "ef9c6c06-d7a0-4f44-a70d-bbfffc43f53d", "value": "296905286476436.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4990337b-2dbe-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634305584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305584, "uuid": "6abd9cff-da94-4e37-9978-94e60bf858b8", "comment": "Malware payload (AveMariaRAT)", "value": "de5077d4fcea4154f65b9ce308783855", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305584, "uuid": "68f68bca-34fb-4bfb-9d58-0b4778c61327", "comment": "Malware payload (AveMariaRAT)", "value": "ad424f679f2f0140d5d3297afa4dd1d3e1b82357b68128ab6bc8015495165a66", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305584, "uuid": "f200b8d4-c242-4e11-8cdf-94313be78fff", "comment": "Malware payload (AveMariaRAT)", "value": "47699e33248c01d4248e266650d27fcdedf84172", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634305584, "uuid": "fd035885-cbce-4763-b42d-295359a75872", "comment": "Malware payload (AveMariaRAT)", "value": "6fd0661eac11b974d79ce705b7c36c5657ee3ebd878482bd1e81c3c4b70f0ddbe67ff25a3261e1a3b7a4b4cb8f4aeb5b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305584, "uuid": "1dc841b0-631f-45d9-b3ad-9860e549cfa5", "value": "T19AE48D73A7DF4E37C3239A38C41685756C9B38329E7A44D6AFE42B4C8AF9144386C167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305584, "uuid": "52dc574e-9ca3-45ec-b469-f24967c5226e", "value": "12666343f95da9cc22c238274d75b6c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305584, "uuid": "cec52554-ea9d-4202-9b8a-87e12e7c81d4", "value": "12288:0SvSsA2JxPaLrNgLGKXhfLeoZ10VicVpJ+SnqyUz:0AdLzPCrNgLfXhaoZuVT1pqyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634305584, "uuid": "4711929e-e564-4e09-9adf-59a4239538ee", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634305584, "uuid": "75c37558-dcc6-4340-bf4f-fe504e3bf64e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634305584, "uuid": "d65a8e26-d2fd-4667-9049-7bb0b4a32ccc", "value": "RFQ Material Standard BS 4360 GR. 40A43A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2066060d-2d9b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634290482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290482, "uuid": "14494d83-696d-490a-bece-fd5a1433a016", "comment": "Malware payload", "value": "2a7758f5061fbdc6cafb591d9e0791f7", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290482, "uuid": "2b4b774f-e333-4516-8240-9bd9055cba84", "comment": "Malware payload", "value": "ad669b73c537108f91ca86ae36f6f331d6a31a2b577d8cf0b715e6c8daeb011a", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290482, "uuid": "efec95be-b303-4a68-9368-63ee90321bed", "comment": "Malware payload", "value": "909e560b302e44903c53faa3e1ce4815209d574a", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634290482, "uuid": "020dcf92-a775-4597-8a12-d8f491e374cc", "comment": "Malware payload", "value": "3b0927aaf1d0d5eb6e047ef720cb9676a0cd2f1ae97388b85527da350192d470178175c203937b1c94904747a82bac30", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290482, "uuid": "1f0204a0-c1fa-403e-aa8b-a294b689cf3a", "value": "T177A239E4BE234E7782BB95B1F1326A01B1329B03464ACE41B17CD6D43FF4C18C665DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290482, "uuid": "9454de26-f393-4df7-bbad-a98acb06ccfa", "value": "384:PX6qUVkczFiX4pmOdOi5o5oloD0x6u6RpZi7eY/YTx5g1yae:PlUpzFiX2XB6uSn4e20j4yae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634290482, "uuid": "08120742-29b5-46ae-a12f-5390589740eb", "value": 23229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634290482, "uuid": "61ebf435-242c-40d3-a969-2c53d5229350", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634290482, "uuid": "0c4b161b-22df-4530-a81a-335c6e210b1c", "value": "original shipping documents.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7a7014-2d98-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634289483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289483, "uuid": "107fe5cc-05b7-4411-a91f-bcc907cdd700", "comment": "Malware payload (AgentTesla)", "value": "a984e04b642afa8be9ab12267c71d21d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289483, "uuid": "9f32eea9-22c9-4735-a4d1-75be0d711e59", "comment": "Malware payload (AgentTesla)", "value": "ae12b461fa093bc9a7c2ada3b0e1291ad61e5dc788a73be834b570741ac69c8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289483, "uuid": "0cd780f8-62a6-428a-866b-d90ccc12c9cc", "comment": "Malware payload (AgentTesla)", "value": "1e8627ddab5cb302058bf4edfbe21159cb0a3444", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289483, "uuid": "405e5368-b1a3-47f6-8cd8-e981377411af", "comment": "Malware payload (AgentTesla)", "value": "50ee2882d23954896554078fc92ed62c88db83ed6cb4e59fe15f4bbbedc74d62da487fe04aa3159060dbfed9d83fabc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289483, "uuid": "1a1c219a-1816-4a0e-b87c-1cdad6188915", "value": "T1AA45012133F8934ADA6B0B791CB656991379B6B67B02C31E748C618D9F633134B207E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289483, "uuid": "78469ca2-c9a8-435e-8e37-b81b6bd4a7f1", "value": "6144:ZRJgMkhBdLs8GbFwTCfvPlUxFTG6p0s0JO+RyURlLLIRi/S69umKdjcIYN+/:tSBFs8wFwTg2RG6pv0JOYPSJvjcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634289483, "uuid": "fa3fba3b-3968-49ee-b484-3dd1a44f6c5d", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634289483, "uuid": "807c3920-f030-45fc-a509-bdf1c9d93390", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289483, "uuid": "dc9ecee9-df52-40f8-bb23-b50f2103d9ae", "value": "Sales_Receipt 5185.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598644fd-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634321072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321072, "uuid": "472db41e-5067-4e0d-b470-5d0ab9b66f6e", "comment": "Malware payload (Mirai)", "value": "f31baeb37a20a7a95322fdfafdd2fa84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321072, "uuid": "346a4b3a-bfb5-4875-be0c-90033c1a1253", "comment": "Malware payload (Mirai)", "value": "aed70746b2f0fe98069f69eef6d94fe8dc736ed3afd963ae1346bec2ea19064d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321072, "uuid": "3f0e580c-5b93-40d8-9e2f-593026f2a6d8", "comment": "Malware payload (Mirai)", "value": "48d111f9b1f51588ae6093b509bdb60c3b929e16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321072, "uuid": "c9761ff2-aeac-4771-a655-131a6785dc39", "comment": "Malware payload (Mirai)", "value": "08dd782647ae5d729f45b3332047f9947bf9a27ecde52595606b928407835b4ed3f38d33674b05a679a444422fe8be71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321072, "uuid": "972d3519-6373-4a25-9221-2d42c8f5df9b", "value": "T1DB93504E6E714F7DFFAD823897B79E209309339516A1C584C1ACEE025E7038A741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321072, "uuid": "5977a756-bb48-4f81-86aa-5b1c5a81b9c9", "value": "1536:fUNyqwipEXzKt4kKSdkVz+lW82YExjSk7IB6dYyHv8pvJQEHr:8mkKSdG+lW82YExjLMCYyHv8pvJrHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321072, "uuid": "c5e27455-1d7b-472b-bc49-7046191322b2", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321072, "uuid": "cd526a8a-8d9e-47ec-8164-e53c75bf6250", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321072, "uuid": "0813e7ea-d4e6-4dcf-a467-88a4a17607cc", "value": "f31baeb37a20a7a95322fdfafdd2fa84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe92847-2d80-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634279207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279207, "uuid": "9013372d-0506-4825-a6c2-e0d826270cea", "comment": "Malware payload (AgentTesla)", "value": "07a9c9d3de53ce20de184c9b22137657", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279207, "uuid": "a243dd12-0394-4ef2-a29f-a8cf8fe35213", "comment": "Malware payload (AgentTesla)", "value": "af0902b859d5df130dc0b9f8e0541b88da80683721307249b239e5da98050811", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279207, "uuid": "fee821a8-03ba-4e46-9384-9263fcbc836e", "comment": "Malware payload (AgentTesla)", "value": "38db554f03a2b190c7d485c3cb52e6a8d70abba9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279207, "uuid": "d3f92799-6b8c-4862-a8af-c5ca800663b3", "comment": "Malware payload (AgentTesla)", "value": "76c36fbbab21e10d1f08a158998a4414de5821a8d05f4fdb17d6449366f8edfb8e41c6f6861caa56a07407f5815522ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279207, "uuid": "351a524b-314b-44a1-80c0-ac07f33a46bf", "value": "T19D84021421EDA21FC93B8A799476D6821379B97BBF45FB0F6898216C8D2D3C60B01377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279207, "uuid": "b15acc08-3858-44d6-b4bf-bb9c2cdd7dd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279207, "uuid": "9b7c34b3-67fa-44cb-847a-bac4af3f7b4f", "value": "12288:ABSBmd3IFhfV/AMcIlXbK/sXGgSCkZUKxE:3BRNJZmsXGgroq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279207, "uuid": "4353e08e-6f42-41e6-8b15-dff301cd7899", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279207, "uuid": "ac6c186b-e18e-41b3-8445-6dc567662c2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279207, "uuid": "44c6a88e-c6ef-4a0b-bfd7-56ca2060f493", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b58b59f-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634280327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280327, "uuid": "af619cbf-4dcc-4325-b7bf-15dd03dcdb1c", "comment": "Malware payload (Formbook)", "value": "84abe73a24c3c85c72f96a7f74246ed4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280327, "uuid": "ee355b75-fd3e-4cee-a1cd-f41e48f641a4", "comment": "Malware payload (Formbook)", "value": "b0bb44364e6069575ed370a6b2bef2953828d3391d16287d66efa3fdf03a3387", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280327, "uuid": "1ba1c457-3e33-490c-a1e5-e2af42838585", "comment": "Malware payload (Formbook)", "value": "bc2484c7dd276281462b1b8ce40e957b6192bd9b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280327, "uuid": "2da9370f-fba8-48b2-8c18-5e2fb22d1782", "comment": "Malware payload (Formbook)", "value": "e1c7b5dc20bf3989e0820b4498a98c4401d67aead211aab608f327d37fa93352fe8956d0e081534e0f865e34f3a35f5d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280327, "uuid": "69da2349-7b88-4b33-a668-af4008b2ab4e", "value": "T15494E051BD57438EE4A12E33AA0C3F3A51425C4869A59C57287FF0A6FC78C0277FA1DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280327, "uuid": "5469c559-30c0-4e30-9cf2-fb7c7d2516b1", "value": "6144:cHlYd/RgfbuAlyGyV1LzPiFM9DtB13y10KW5yGlEry8LS24jc6iTdPvlK6z+7AU:6q/REbuirC1nPYMJtz3yQsenTkdp+7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280327, "uuid": "b8cabff2-a214-4a6f-81cc-cc835bd82bd2", "value": 412920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280327, "uuid": "91c0c93c-d52b-43d0-8289-d914a88ccb17", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280327, "uuid": "03ac8983-1797-41bf-9b1d-9f6335640aed", "value": "INVOICE44.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625e71db-2d84-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634280715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280715, "uuid": "a895adf2-e472-4771-991f-ee18db8ea45d", "comment": "Malware payload", "value": "7a9b3b54bd1fea9a790ca5bf1e02ab91", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-40449", "colour": "#1F5DF9", "exportable": true, "hide_tag": false }, { "name": "MysterySnail", "colour": "#1B78D1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280715, "uuid": "dc44a6f1-44ea-4116-a111-d2e1af87074c", "comment": "Malware payload", "value": "b0d340bd65b18f21b1767943bb676d77fe08e085d5a2ac210f266759c311cd2c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-40449", "colour": "#1F5DF9", "exportable": true, "hide_tag": false }, { "name": "MysterySnail", "colour": "#1B78D1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280715, "uuid": "9e3ac108-8781-4fa1-a03e-eedbb4fed685", "comment": "Malware payload", "value": "4693713e499b15d735ffa34b135982a825d448ad", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-40449", "colour": "#1F5DF9", "exportable": true, "hide_tag": false }, { "name": "MysterySnail", "colour": "#1B78D1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280715, "uuid": "7a1d2abf-e058-47fb-8773-8e63fe1f1a86", "comment": "Malware payload", "value": "37a9f4cee7d43abcd70fe85279b72f723c559dddd778dd67050c9ad81976ea11a983232caaef796c13bca6e5a0495ee4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-40449", "colour": "#1F5DF9", "exportable": true, "hide_tag": false }, { "name": "MysterySnail", "colour": "#1B78D1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280715, "uuid": "6876c96c-4639-4e07-8950-c1ee1d10f755", "value": "T16E9631A9DB7B53E4E5521BBECD222120E2907BB8F670C02557F9D39B16805B00EF97E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280715, "uuid": "b7302f71-8da3-413e-8d69-ff10f23cd2e3", "value": "49152:66VwASOwGtlqOhIU6i5H7teZtsDFc9HSgm7inT9p53PPhk+y94faa57HarYhu+nA:vW+k3E7iZXbteQDm9yOuLnsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280715, "uuid": "1c21c82c-c6b0-493a-bb61-75ca67f13b13", "value": 8702186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280715, "uuid": "0d3b9761-9f5d-46e6-a6d1-10249ca42735", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280715, "uuid": "4155420a-b650-488e-b14f-9d253e45def1", "value": "b0d340bd65b18f21b1767943bb676d77fe08e085d5a2ac210f266759c311cd2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f3e223-2d91-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634286168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286168, "uuid": "ad5756ab-27c7-443b-b115-682f83f3ae08", "comment": "Malware payload", "value": "21f8fcb3a90c4001a0046c5c9b2e54a4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286168, "uuid": "b1dcdaa7-ab7b-49a8-93ad-462188adc2b1", "comment": "Malware payload", "value": "b63bd58c1c692ed60df6793284d87f81a93874e473cf9aa3939ed127f5ebbd77", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286168, "uuid": "6e16324e-6dc1-4ed0-955a-3443e84da371", "comment": "Malware payload", "value": "155c49b528e58b6e6335db20871ab3f755ceefb2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286168, "uuid": "eff71189-0161-4220-9216-858146e337e5", "comment": "Malware payload", "value": "ecdaa07e2f09aec94e1eeb3762e9498b5d6f8f54e687a6dd98975ab924a82185f16e7cfea66c11c93793b0746cbc0335", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286168, "uuid": "32bdb7fe-dd35-46f1-8481-59df202b59df", "value": "T14592BF50C7F4021DDF9ED6B1ACAAA98C432FBC068287B367BDA596C91CB04BA1F54464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286168, "uuid": "8468892a-51ba-4563-912b-924df02ff3ed", "value": "384:jo2/yjBmTlpfe+5RoYM1dnC/RZzTxvds2f55xHesEtGtbT8jVbtXQ:jo2/CBEpm+5mdnC5ZTxV/ZSs8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634286168, "uuid": "e9424f2b-905e-4580-a3c9-be176fa55232", "value": 19735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634286168, "uuid": "e6953442-783a-4b35-a51a-a9a096ec500e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286168, "uuid": "b0f6a926-0429-4a83-8697-47c3aac9150d", "value": "Purchase Order 31-05-21.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddd3a8b-2d79-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634276251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276251, "uuid": "fc522283-c881-4eaa-a84b-9f68a351751f", "comment": "Malware payload (AgentTesla)", "value": "437a62d72f0e4c473ea72929c504d9da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276251, "uuid": "680ab1d7-8b6b-4e00-9902-f390f1ce0a52", "comment": "Malware payload (AgentTesla)", "value": "b6fba8d31173567d845b29d7b9fb934ae34bb9d08a36c0c6d9f34d34fe0020cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276251, "uuid": "5a03d65e-1067-4c66-a4da-90930c171b54", "comment": "Malware payload (AgentTesla)", "value": "cd40f007a7e8e717797ee93538dcc9f865d22a86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276251, "uuid": "fe297582-0b45-43ea-9ecf-76d7b5657260", "comment": "Malware payload (AgentTesla)", "value": "2dca0840c545368cd183383315f33f00fa234a9fe68283194d1b95948299d1311cbe2a66ef8039d743c8af787ecde23a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276251, "uuid": "d9f8d67f-0dbd-47a6-a380-4bba2a92c40e", "value": "T17DC42315E0AEF5C08CF957DA27196C7E69A6561F3C6894B3269305248CBCB073C1F2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276251, "uuid": "0228cbd8-1ff1-415a-ab83-65ba3557757b", "value": "12288:GN2riAcThkU6C8KFtrv4p9fObxqJeT7uOAzpKab6YL2GuudvKeubxs:k22htMr2bxqJeTS3zpKab0GuWKeKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276251, "uuid": "79a8f479-c62b-45b2-b4b3-41db283cd924", "value": 590027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276251, "uuid": "80fb447d-9847-4593-8fa0-ffd8f26bdc1a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276251, "uuid": "858b27f2-e56a-4c52-bde9-d84a145abcdf", "value": "PO NO_720050285.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bd4a98-2de1-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634320902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320902, "uuid": "b2894185-b2b8-4924-a01b-e1713c5d807b", "comment": "Malware payload (Metamorfo)", "value": "64a83177696b9f9da958f3af0a1e3e7c", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320902, "uuid": "2f418abf-0296-46df-9699-789a62856f3f", "comment": "Malware payload (Metamorfo)", "value": "b70e50bba5a88bf17a70886dcc5f7be2b622dc99c8cc91241be10040e06aea41", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320902, "uuid": "5bb4bff5-20ab-4f7c-8275-655274bac0b9", "comment": "Malware payload (Metamorfo)", "value": "0aa41a2a6ba85157730735ab0af9244ec31e20ac", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320902, "uuid": "56817138-8b2e-418c-91da-51d94fdc1367", "comment": "Malware payload (Metamorfo)", "value": "b8599c3dd4b640028c0527585833f9e7c6a7b3d86804cfc1d38b7ce04697266456d204fd22321ff61d1da21d6323b71e", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320902, "uuid": "9ad24c21-dbe6-4205-830d-6d2c292a23a7", "value": "T11E41FB141EEB1229C2B3CF7A24F67286CD7ABD61A9534F5F8084438B1861550EC31E7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320902, "uuid": "48ca163e-9c06-4f0e-9cb1-e2a02f46068b", "value": "48:8+uH+M+LlN+Wdhclx1cIXv3KaIqiHkb6NS6:8+ueFLmqclx1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320902, "uuid": "299021cc-ae5f-4c1b-8d96-0da9eb6fd67a", "value": 2042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320902, "uuid": "2265fdca-9bd4-45d7-86dd-798eea16959e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320902, "uuid": "7d16025a-5dfd-4b5a-b8ce-acad06f23a0b", "value": "Anexo - 151022547820.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906946c2-2d99-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634289811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289811, "uuid": "faf3da47-7548-4fe6-9790-5e396c335341", "comment": "Malware payload (Loki)", "value": "4652b89600fe5e9bd1d107a51157d180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289811, "uuid": "ddce2ce1-59be-4d62-af19-05a68224b0d7", "comment": "Malware payload (Loki)", "value": "b7c78c25422396652ac51f1857f0979d14716a78c4293ebc9f9ea5f0ef69f757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289811, "uuid": "02e020c6-e4bd-4a47-a4fb-d23e6f115e04", "comment": "Malware payload (Loki)", "value": "4c29866f1567d426a4cdb52060f4be1aa5758db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634289811, "uuid": "d922c7e3-5d29-4ee5-a30a-ba86af2a5ebd", "comment": "Malware payload (Loki)", "value": "cfb2983facbf3672d06ab10760f9c26f692f118e19ee8f0df88493d738034f6b46fe07e14007f5b5504cc5257b6a1283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289811, "uuid": "8823aeea-7270-42bc-bdca-d5a9942c7e6f", "value": "T156E3D0C437E4ED13C62C2BB92166A7C51735C348BB13D34B6CA86B392D827CD6A40AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289811, "uuid": "270caec2-742e-4351-964d-cebb7137600a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289811, "uuid": "76b19748-2b0b-410a-92e5-ea2918b65e9f", "value": "3072:mB+vRCHQYHYhnBGS7uWew4ruhS0h0CTXYmvFMQ4b1LfwN/qMiShFq8ucyZ07Vr70:mXmnBGcuWe9iS0hYmuQ4pfKSMiShs6yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634289811, "uuid": "a66d03f1-f485-40e9-b98a-5f520cbd0bdc", "value": 150784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634289811, "uuid": "8cf9558a-8df8-43f0-8591-cea62c3fad19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634289811, "uuid": "1bc95fdb-464f-4688-8e82-08df26a34574", "value": "VERSANDDOKUMENTE_75876245.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebc9795-2e05-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634336194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336194, "uuid": "09286fb4-e19e-41cb-acb3-cf29a09553bd", "comment": "Malware payload (RedLineStealer)", "value": "8aa179ca062a174c67433dc36e8b0142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336194, "uuid": "515a4e49-71b1-40ff-ac4c-9b7e1cd920f1", "comment": "Malware payload (RedLineStealer)", "value": "b861fd048ceff8dca345ce5ab41b60c695d845258ecc3bf175a819ee42037f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336194, "uuid": "355b0686-2e91-4d98-8de2-4cae3b9a3600", "comment": "Malware payload (RedLineStealer)", "value": "c40e9516dd3dd5ab85dbac13693eea68ac9ef456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634336194, "uuid": "f6e3aa0f-ce26-4e01-9128-a9d7a977bf96", "comment": "Malware payload (RedLineStealer)", "value": "e1e1eea991908f34b590dcd49a9d423c8cadd6d09e14b7110f9a565f349c02c5caf53fae358754322faf75f40631c362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336194, "uuid": "a156a3bd-282c-4280-a0d6-18a7ead49cd1", "value": "T13364CF56AE448E56F58A37B192ED55D548E32D37D82781EFAEFC78883E3B2C18105323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336194, "uuid": "24b076e5-02b1-4a81-9dc2-dbd6aeacd899", "value": "24ec2b5b549de8dc7f6de6d052a7ab6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336194, "uuid": "0eea658f-349f-4bfe-aa4f-959783f6888a", "value": "6144:xAvhW/yDDSfSUZCGEwwyjk2kFYJwi+3bTf5v2DQpv5rFTn1XfUU/aj/G:yvhW/yCfF82XkfiAxvbjrFTnKU/aj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634336194, "uuid": "021946d6-b0a0-43ad-a462-3265b8fe0ea6", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634336194, "uuid": "5797bee9-5935-4c2f-a9c7-7e157ea6f5e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634336194, "uuid": "2aaab19d-2e0b-49a7-b0dc-98fc4e5ce77a", "value": "Diplex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afe167e-2dae-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634298607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298607, "uuid": "a615c420-386f-4ed5-8723-bcbae281d0a3", "comment": "Malware payload (Mirai)", "value": "4d558b30ec2aa8ccbeb864d18064aefd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298607, "uuid": "5ff0ef13-e911-4497-a3f3-d3a9b1a8f19b", "comment": "Malware payload (Mirai)", "value": "b8643de9ae627c775d2753a270a963850cbc097a4d82e06898b951b0aeefa686", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298607, "uuid": "5d9f635e-3906-478b-9442-13605de112aa", "comment": "Malware payload (Mirai)", "value": "c3073c27b2dee5941ec0aab7a1aea3261068470e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634298607, "uuid": "e939b71a-6227-4391-980e-3a428062bab1", "comment": "Malware payload (Mirai)", "value": "d2b08b71a770c648169b15766aa96fddaeb87225433291197a7aa526a3be82ddc23de68e8cd55d127ff4ee26c0a6ad6f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634298607, "uuid": "15d9158f-2f82-4ac2-8c54-66a57d11c125", "value": "T155430785B981A625C7C04777FA6F008E3718ABD8E0DA33438D152FA0768ED1F1DA7B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634298607, "uuid": "17ae7cc4-cdbe-46a8-b668-ae6da92a34e0", "value": "768:Im3t31zOKiEJ36pbjf5Cg1Fmh9di2rhhtlXu0hkermbANacd8UYyCQZydRU6SE4c:I6tMHc3UPf5jeh9cghtSfU279C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634298607, "uuid": "b675efeb-2ba3-40c4-8cc9-0ffc3c73082b", "value": 59096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634298607, "uuid": "f3b1f24e-5fdb-46b9-9963-a9a2a2da9fc1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634298607, "uuid": "084d9da2-ff6c-4c89-a0e6-7a2817c4b2cb", "value": "KKveTTgaAAsecNNaaaa.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c8d2d1-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634288747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288747, "uuid": "8a5b77e6-87a0-412f-bbca-89502c9dee64", "comment": "Malware payload (AgentTesla)", "value": "c6dcc3ff489d4c56ede8d4c90752b2c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288747, "uuid": "a2ebec73-a237-4915-a20c-a196697daeb2", "comment": "Malware payload (AgentTesla)", "value": "b89c8f83bc64caa99ea16898ccfd42d70b64669ca347874697d68ed66c708e6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288747, "uuid": "981ca489-c3ca-4766-accb-19834aabca12", "comment": "Malware payload (AgentTesla)", "value": "fe51d1c67b2370541a059a63406ccd3d142224b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288747, "uuid": "a2e8d88a-ce74-4e8f-b225-be59a5b34792", "comment": "Malware payload (AgentTesla)", "value": "a825ee0f26bb50301effcd189a3a6df41decdf2023f6d0d983e6153795336fcebbef6d7e3c9560de10ae61bf85824e07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288747, "uuid": "d58927e1-1289-4724-8156-8a0470f8b64b", "value": "T1B9A4237C9445A53A88AF70A8078FB2B1F530CC253E96F12956ACF3D4676509BE3C306B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288747, "uuid": "fc88f5be-7f73-4392-b9d3-2329942e3c67", "value": "12288:zQa2bhOfWPrPcpPqPk4ckCWU88f3SuDKVN:z0bi4kp8kfkH86u+VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288747, "uuid": "f791f4b0-0a04-44d7-b8a3-433501f95321", "value": 449610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288747, "uuid": "f453d34b-3259-4e93-8a9d-db9d7548656a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288747, "uuid": "b22aca0b-ca7f-423e-86e7-060b7bfaad2e", "value": "TNT SHIPPING DOCUMENT.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b941c77-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634288756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288756, "uuid": "ee70345b-453b-4f85-8a16-c0bc4b100503", "comment": "Malware payload (AgentTesla)", "value": "e932df3f32e18cca7dc5fa2e99558d38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288756, "uuid": "e9e3e843-1e7f-4222-8f92-0c003a12ae9d", "comment": "Malware payload (AgentTesla)", "value": "ba3bdf137b0c3c090ba8f7659bfdd676a4bdd4f2d4db4ecb3a941d7e266d9f93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288756, "uuid": "a089fb48-c4a3-418e-a3bd-40a5179f2a9d", "comment": "Malware payload (AgentTesla)", "value": "0a572934e5cee66657b967499bb062cc8401308c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288756, "uuid": "154d3327-c014-4bd3-8197-3016fa059abc", "comment": "Malware payload (AgentTesla)", "value": "a3e029bbffe6c3930ba5848d2658fbfd13261dbe02237f213b97d576f730e72f7b26b9f8977a4edbe8e17f95e21afcac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288756, "uuid": "7a6006d9-a1d2-40ab-bbb3-f2d986219675", "value": "T137F4B415F382AC05E46B567350E450E392446887E858837DEBB3BAE71C9A7C04F8DBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288756, "uuid": "40ccfd9e-75a8-408c-b4ac-71c1ffd0077e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288756, "uuid": "dde63418-10c8-448b-a391-9954406c8376", "value": "6144:Eu/BxEadWHWOn5rZOiTl6XnU2KOhXfqm5rEc+tCId9cmcerf1hNau6xp3O482laj:lbQHWAlZd+1VoCI/3XrhX6n3u5foe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288756, "uuid": "52f5b415-45f3-4c7b-95af-318c82f88580", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288756, "uuid": "c26de1db-fe65-434b-b06e-85045929b503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288756, "uuid": "028b20da-0c70-4f5d-b217-7d0a1c0acf96", "value": "TNT SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f169bdd-2d59-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262241, "uuid": "c6966dc9-35d7-49b8-ad17-a6e178cd2b69", "comment": "Malware payload (Gafgyt)", "value": "f3df67b73bab2b9d2ea241f5622bc54f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262241, "uuid": "59745840-4695-466e-938b-b33d5ffba503", "comment": "Malware payload (Gafgyt)", "value": "bb483b1ecca86f4e8de05db514da8a868a13177793c85e2ffd41cb6e035afcea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262241, "uuid": "d82cb34e-87c4-4b2f-8764-173653b799b5", "comment": "Malware payload (Gafgyt)", "value": "41b53152d3a926a34b3f68f1940a94d0823f69ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262241, "uuid": "4d6f54c7-4ae8-47d9-a0cf-4065fe316305", "comment": "Malware payload (Gafgyt)", "value": "b3cc529f06a6effaf26642cea441994c4b6c9ea9f08fae4621d62b1bcc336e8497a2dbc1b948e2e324f19301f13b038e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262241, "uuid": "dbd339cc-5161-4fe5-9d16-94e0aeaa78a9", "value": "T187C32805D4508767C2D3237AE79E825D37325BA4A3DB33215A34BFB82BC278D1E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262241, "uuid": "c10dfc52-d7a3-4759-8ca3-036af4e00564", "value": "3072:ekYPUfsgnsb0J2ag/Vf3kD8lvi+mTQOY5NX3cn:9YPUfsgEo2a03kDki+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262241, "uuid": "d4e9bc09-bd17-47df-b164-1d033f19e84c", "value": 121008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262241, "uuid": "c2adbf55-a6a0-4c78-8e00-58e0609ff87f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262241, "uuid": "de996038-bdb4-407b-b43a-1e377dfb5a3b", "value": "f3df67b73bab2b9d2ea241f5622bc54f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c4b6b1-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634321046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321046, "uuid": "15d05364-58dd-4e64-8a3b-7228eb6b381c", "comment": "Malware payload (Mirai)", "value": "3c0b9b3e5ed1efbe066f2bdd75448822", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321046, "uuid": "bbe36afd-85e2-4813-bb75-1c94b55c7117", "comment": "Malware payload (Mirai)", "value": "bb501d40bf3d94a11d2cdc5fcb43d64ebccf530ce9f20e8e22eaf948cfe58435", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321046, "uuid": "7f7ae41e-145d-45cd-a72e-37895aa1bb87", "comment": "Malware payload (Mirai)", "value": "9c226733202d3d0387b22aec25140f4c609d5854", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321046, "uuid": "48c5a126-5f7a-442a-9335-01c4616e992a", "comment": "Malware payload (Mirai)", "value": "43c2b2c32a58dc7563f9fdb5a1be55652d33d9088786357d7cc28dcf08edec1b29331d87cbaa18e945194c1452c3a4e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321046, "uuid": "c9e5f19e-428d-4b3d-bc14-814545449452", "value": "T1F2539D66C0B85DA0D49889B0761CCDF85783A404A6E77EF5C683CF694407AECF109BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321046, "uuid": "0b3ebd73-e926-44fe-87a7-ea49e885a6a4", "value": "768:6/BAQypMIae3xOqiwBAVmFEHzF2PBaEDiPV44g5N2tS7yTtTL5Qjiv0QD6in3kw9:6/2HmIaeIyehuTESOT8YUq/2VoCkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321046, "uuid": "f03a5976-140e-46fd-b1e5-2b5ef8052748", "value": 63844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321046, "uuid": "674b5a54-5fe7-4d3d-a01f-a6d89228d341", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321046, "uuid": "fdc19980-881f-4a65-832a-7c6e446aa2da", "value": "3c0b9b3e5ed1efbe066f2bdd75448822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdb1745-2db9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634303393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303393, "uuid": "d6ca8b56-5a65-489f-bc18-df3e691d78fc", "comment": "Malware payload (AgentTesla)", "value": "64a949fd5769b428cc1b7a831a1bbab4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303393, "uuid": "c5492388-ed35-45e7-99db-582947e2f09a", "comment": "Malware payload (AgentTesla)", "value": "bbe8bc1f03f7c099aece5927d8afa0758e78a2fdfe70410397491034e650a814", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303393, "uuid": "b8405d32-c47c-43db-84fe-e4ad81682cc2", "comment": "Malware payload (AgentTesla)", "value": "86aca5fb40b81eb1d4f6e260fd4e5d9185686e4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303393, "uuid": "25f37802-0c97-4882-b5a9-376bd41f6b93", "comment": "Malware payload (AgentTesla)", "value": "04e8c85add870b7abbf63c08c083fb3296dbfb39f6dae85668f41ce34fa4c6b441dc8144d4b47ecc748ba89bcd1b6d1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303393, "uuid": "fa651086-05ac-4124-8fbd-00baec3d43ce", "value": "T14394026032EAA316C97B6B382C7681C143B67B6BBF12DB2E2195114DDD327538B117B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303393, "uuid": "2089505d-1df4-483e-860a-8dde8a29bfaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303393, "uuid": "3d795b33-152a-4ef0-adb9-0843afe64cf4", "value": "12288:zSBYhCjVYpppozzCOaSCDtPR715aUsQSBiIU:mBoK2yzz3CDbpoqShU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634303393, "uuid": "19fc843f-6fe9-41aa-8096-f34029b3b512", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634303393, "uuid": "d5bfcb3c-8468-4c78-971b-3fd9da4a9522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303393, "uuid": "b626ae6f-75df-4016-bc13-945d59d6b6e5", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51d4e43-2de1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634320770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320770, "uuid": "0595c7e5-922f-4648-b935-4e7fff0c06ca", "comment": "Malware payload (Mirai)", "value": "7ca4c71e032cf7b0699675c0e1fb5548", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320770, "uuid": "f381a43e-9857-46fb-9838-76962ed2c2c2", "comment": "Malware payload (Mirai)", "value": "bc2b16d3c8d09c722f0b1aada5019f0c0c271b7bc723b2dc80f9d1c00fcc7ce2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320770, "uuid": "8fed8f90-d608-4bff-9d02-e0a33e5689e3", "comment": "Malware payload (Mirai)", "value": "c066297408085e15e6ee382182829d573ca01473", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320770, "uuid": "ca7ea786-0c9a-4e19-8b38-8bc5bdd0896a", "comment": "Malware payload (Mirai)", "value": "f18eac40f4d7380432bf7c04a488f4fbef3842af064405e7400c6b97db1553bb1283c580a0a820c9dbb77ff476519dd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320770, "uuid": "70ae2362-6ef2-4ffe-86a0-2f97ab9f2c00", "value": "T134732A15AC7A2E27C4E4927F12F78615F2F6330E2474862D3D750F8EFB64684AA46273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320770, "uuid": "af2c2865-d4d6-4b2e-b4f3-40407a2aee5b", "value": "768:0c7JQJiLDZkBoa02F18vE5xlotILA7MEAIU1xJYwIi7YrYCWYbq//L66rpzgoqsU:0EJtDZkBV02F23bqu6V0Js+chj2ZJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320770, "uuid": "0011280d-c3cf-42bb-add6-e19ba2b9bb45", "value": 75104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320770, "uuid": "f4544ea9-18e0-4a59-8f4e-c6b2de060906", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320770, "uuid": "24bfbb6e-6631-4062-a6fa-2fe06f8f50b7", "value": "7ca4c71e032cf7b0699675c0e1fb5548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff4d0e0-2daf-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634299447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299447, "uuid": "fffd7675-0e2b-4ca1-8021-8e3455bdea5e", "comment": "Malware payload (AgentTesla)", "value": "5c5460b0eee2d2324c1c50fc3119cade", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299447, "uuid": "0c12e7a0-34f0-446f-8852-fcdabe02090b", "comment": "Malware payload (AgentTesla)", "value": "bcff6114d2af72dc2525277db3e48e72b78ef6e5c9604898b9019d25b16e4845", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299447, "uuid": "ae3b6c71-586e-44f2-b3a9-964a4f8fbac8", "comment": "Malware payload (AgentTesla)", "value": "e3f6a1f21c26f7d21430bdee98f004284aea7f8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299447, "uuid": "a0bce0e6-e92b-48dc-92b1-e9e644497593", "comment": "Malware payload (AgentTesla)", "value": "1496b5849254b6bf5a910cfbcf686c3581c7be5c1ef4733c58e3680a5fce3dd8bcea20a15069e119faae111c5c82a5a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299447, "uuid": "02f3bc7e-4709-4817-a0b5-57039e47d538", "value": "T176840164B6DA821AC47B4F74A9B752D61332736BBB12C71F6214124DDE73B028B127B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299447, "uuid": "5afce3c7-c633-4a7e-a477-2e282fd3c311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299447, "uuid": "82d0b426-12f1-4432-869c-6f881f1dbe56", "value": "6144:l3VJlgMkhByUQPDeszTzJbR2yw9gPPr/zbtNTVI/c4/g5fH8iQ0+:FhSByUQbtXzpRlwyPz/fxicIgRct0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634299447, "uuid": "69424065-41dd-4545-a929-80351eb68bd2", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634299447, "uuid": "6bbea98b-509e-4e6d-8b8b-bc15d6d2700c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299447, "uuid": "29ec7822-fe38-49f1-9e79-cc29fd03ebf3", "value": "Scan docs. pdf.........................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a07173-2d85-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634281010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281010, "uuid": "e38cfc70-3219-494f-87b0-2367b0501a68", "comment": "Malware payload (RemcosRAT)", "value": "4aebbec0edebbe61d2245514793ab647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281010, "uuid": "0d4a4ebc-da0b-485d-9e03-dcdc6be665dc", "comment": "Malware payload (RemcosRAT)", "value": "bd7c06c6abb5fffe264a20b08aca73e7da11f2450cc8b9ecc63591d41ef83ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281010, "uuid": "755b91b4-8d58-4146-89ce-5d10cf9b24ea", "comment": "Malware payload (RemcosRAT)", "value": "cba8ca7e8f7d1160dd041de408375fe72f6e4edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281010, "uuid": "ff98bff5-1ec5-49ac-9f1c-494ab3d90e81", "comment": "Malware payload (RemcosRAT)", "value": "5af7bc00b2449689627fb983bc9cd2f0cd9784c8af1aa2f1a21ebdc88b884be89e45a737f907f6cd0a210554c6e65a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281010, "uuid": "0bb7900f-b005-4879-9a6c-9a818d665a1d", "value": "T1FA5533805EB1DA1EE24C6E73A7C5C31CD329172A05B2D42ADF3252EFBC42791AC75A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281010, "uuid": "d0ed2f73-7eba-4327-9162-2ede3723a563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281010, "uuid": "9e2f011a-c403-4b1c-a641-87430f25aa90", "value": "24576:39UKkwSAggCSmwqiv7ltfjoHR/k+rXfaEKP7CHx9tCmONcmNdc:t8w9rCHX2l18HR/nrvaN7gfgg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281010, "uuid": "dbf17438-b44c-4870-8f40-cdb61c7cee51", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281010, "uuid": "eef54a58-17a6-4810-b718-737d15b6a5e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281010, "uuid": "7eeeb51d-07a0-4cd0-8d02-f0ba4f92a0ff", "value": "Fedex Bill Of Ladin Invoice Reciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02c5567-2d8b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634283959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283959, "uuid": "af113a90-ac89-4cb3-a89e-7822f3780d70", "comment": "Malware payload (RedLineStealer)", "value": "aed9683ff11176822cf54391b33278f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283959, "uuid": "dcd76a11-53ea-4428-8c53-cb1b69c9beb4", "comment": "Malware payload (RedLineStealer)", "value": "bed295ca607f5004fe28b926af784f7400f15cb4a58064542bba71879467eca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283959, "uuid": "10aa4f19-3265-4742-ada2-61c9e0fa2c8b", "comment": "Malware payload (RedLineStealer)", "value": "cc4b08c215e203f17b5315930af056c78bb128a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283959, "uuid": "bd95cf21-1ea3-4be1-a0cf-5c9a95cbddc0", "comment": "Malware payload (RedLineStealer)", "value": "4f7a6c1acfb69218ffb74a9483c282a72d3da84ff0c211ea08943d76fbfa6db6decc7dbea216e4eee750ac849b6ad97a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283959, "uuid": "fb03e5c0-3e67-4e81-a0ac-34767d9f934e", "value": "T16CD569632588C92CE4176A3BE3AE42F6652F5D08CAB5563B9A8C3D87F7B744504C370E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283959, "uuid": "80facabc-cd43-4493-ab9e-3853c054a367", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283959, "uuid": "984c8bfa-693d-497b-8bed-29423704b5f6", "value": "49152:f1g1yHdQfLmX1F2uIQbhhyuZoVNpGgDcd:fVdCiX1wShhpZo7k/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634283959, "uuid": "be95dd74-28c7-4792-84cd-417c06bb81f0", "value": 2962432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634283959, "uuid": "7aa0e63c-b789-4cb2-9cdc-feca70a47428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283959, "uuid": "7e20315d-e58a-4671-9f5e-39802917908c", "value": "aed9683ff11176822cf54391b33278f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a346f4-2de1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634320762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320762, "uuid": "7f6035be-ea05-403b-9b68-6223097381c2", "comment": "Malware payload (Mirai)", "value": "008dea477930a512ae37829027c843ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320762, "uuid": "96b12f9b-2dbb-4d4e-8ee3-5fc4fb2d36be", "comment": "Malware payload (Mirai)", "value": "bf97da47e9cf3a9678391aa5194bf4c4d48c9f1520933049329b12e157c4e0e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320762, "uuid": "a2536818-740a-4db2-95b9-9d436e73a528", "comment": "Malware payload (Mirai)", "value": "3d1ff6a41cd0a1d1c74a3977c266bc3de242304a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320762, "uuid": "14bb3cee-63dd-4e00-b0f9-53f282713d06", "comment": "Malware payload (Mirai)", "value": "e2f4ce97ab65339407705a50fb6b9050c4b192ce599cb16c1dbd78d691e250d80b4028022b914290bd5480d0407d40bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320762, "uuid": "96cf23c7-e8b7-492d-987d-eac7d5cf1c42", "value": "T16C93751AAFA05EF7E8AFDC3346A91B4524CE5416254CBF79BD30D818F24A24F15E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320762, "uuid": "41422f8f-b1b7-4b09-a8af-8c46e884f84c", "value": "1536:GRWuNskH9ZBLPtwHRop6/iqOqCx5E8FjBwFudSZCLHS:iWuNskH9fPtyap68rS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320762, "uuid": "dc62b14c-db1b-41e8-b044-8647ab918e98", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320762, "uuid": "5c583620-9109-495d-966c-6f6ab864f9bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320762, "uuid": "bea8b5e6-ca62-4aa7-bf89-d82a1e1de857", "value": "008dea477930a512ae37829027c843ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd23e6fc-2d8e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634285162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285162, "uuid": "aec91b10-9ae4-4e7c-b6ef-779f5ba5d639", "comment": "Malware payload (AgentTesla)", "value": "f093c89ea6cd914c7b83ef9a4b8d1d47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285162, "uuid": "666d6c3e-713c-4e89-9257-e1e86272b3b4", "comment": "Malware payload (AgentTesla)", "value": "c2c2dcfe027d2501cab73c145806d39c298ffd43fa196319364d9f84d3bf2190", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285162, "uuid": "8c6bd0b9-8bd0-49fe-bd5a-8a1a3a5840d8", "comment": "Malware payload (AgentTesla)", "value": "a128c2a8293ab97065361edfd7e35fbf9d13cafb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285162, "uuid": "33165e28-5137-4ad1-b94d-9b300eada0a1", "comment": "Malware payload (AgentTesla)", "value": "488b6416fab330c1096f8500c260eb9502d56e5affc03884b01b84ba41690a26960e6d4ca84244456ab67a1ba2c27ecd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285162, "uuid": "3b51c4e3-e127-434f-b7ff-6da1e5cd8f97", "value": "T1E874237C804E93F7A444AA4235A517D86F4E21C878FE5E7D0082F33EE759E902564FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285162, "uuid": "4650e980-3b35-489a-9a28-787d764388c6", "value": "6144:pguqVHhJOtp4QRhcgBWEjbpygBUTjpkUlWJAPI98o9knlj+Qo+zgOnyBukwW:yvhob4hQcgB7UlW2I98Blj+QVzJvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634285162, "uuid": "0f9a110e-2e60-4bc6-9ea7-80adc76cefea", "value": 369910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634285162, "uuid": "2b9850b4-0388-4d42-a8b0-e82849975ea9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285162, "uuid": "b9774fa0-e3d4-4aa9-9f1f-82c9bbb31f26", "value": "COSCOSH SHANGHAI SHIP MANAGEMENT CO LTD.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcfad92-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634320945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320945, "uuid": "483ab3ef-f17d-408c-a685-4d31008031c8", "comment": "Malware payload", "value": "bc97bf10f487ea5a5578cf427de281bc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320945, "uuid": "a0d069fb-055c-44e6-8ca7-600c86610ef3", "comment": "Malware payload", "value": "c363c3b231cf9caf453223175da9f6e154ebe808bf69439d452e5b411b4ff466", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320945, "uuid": "8f9dc02c-f9cd-40c9-bf44-6ffab12f7a9c", "comment": "Malware payload", "value": "ae03c36f9f9bde7ba5509d1285f58cbf96538fc5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320945, "uuid": "2093305b-81e1-443e-ad70-2b0ae48b4e27", "comment": "Malware payload", "value": "85b493a3a32391696a81d05ac05fe9899d3117973372b47a8d04f6d2f237b358bc227c4b7c0d36463950ebbc1cfd0175", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320945, "uuid": "f895ffc3-e59b-4f9d-a153-670baab44549", "value": "T1E811250D691CA206A68777C2D7ADE524DEA3FEF74642E4782500CD540918074FBF4771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320945, "uuid": "f2d82db6-c3a7-411a-9b5b-cc687ee13def", "value": "24:scMe+GVRWJivpfWl/Z+zG0GAYJW+t8/xJXgZXvy5MFTw1r:sct0ivpQ/Z+6sYJWyaxReeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320945, "uuid": "cebe4a1c-ea8f-4f0e-8a30-8e60fa7f04ca", "value": 1018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320945, "uuid": "d95c9d48-ffe7-464a-a5e8-d2de9335afc1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320945, "uuid": "0dec6a76-24db-4173-a4aa-4c8190edee79", "value": "Payment $23856.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b422a9-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634300339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300339, "uuid": "e9916742-3c67-4c80-baad-98b166cac3c2", "comment": "Malware payload", "value": "b3d3b9bce710fb64b21b116a0bc72d6f", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300339, "uuid": "ea1daed7-2c18-4655-b656-ed5d6d205d5a", "comment": "Malware payload", "value": "c40e11972704d0d36b4510d5f6a9b4cce54443abc8cccf74e23aaf68b685ebee", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300339, "uuid": "5d18d67b-d8e5-4315-93a1-e50e29a424fd", "comment": "Malware payload", "value": "9f8c6c2f5eefe233c13452c82438ef5707d97cbd", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300339, "uuid": "cb8dcafb-10d0-4360-9908-55303bc71a6b", "comment": "Malware payload", "value": "9fb8dac5c89b226358a7b56f3bb396e1cca6d8318820da080db24ddfc1b970b253187a297d45a9d2eda8cc797e075149", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300339, "uuid": "403e0413-59a6-46ee-a7c3-4941fbfca5f2", "value": "T19F94F2A87F3857AFD843AB345A55320AD9455C6897DD722C80BF7E6B7E348DA08C8312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300339, "uuid": "2b363afb-468e-4a1a-be53-eb470d562bbe", "value": "6144:VHIiIL1kLl2hmRQr8kgsr5XRcN9ZgdIlqzkrXj+bS3LuvZIzi5xbY/eAE7lyxHX:4thQQTgsTcmstj+XCi5x0eEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300339, "uuid": "5ae1aff9-74f3-43eb-9355-788099547aed", "value": 437368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300339, "uuid": "5643964d-5a11-4f3a-bd3c-06e35a953cbb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300339, "uuid": "9f269552-e149-4e24-a850-5fc632aba244", "value": "HCRUSD10000068943002_BANK_STATEMENT_15.10.2021_44900.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a56ddf0-2d81-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634279332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279332, "uuid": "3d27289d-6bb3-46fc-9db1-a0a98676f6b0", "comment": "Malware payload", "value": "8242e1808eac09b7264a697fc98c2f37", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279332, "uuid": "1b9bbc12-1377-4d05-ae3a-1d8f28fe1335", "comment": "Malware payload", "value": "c43738a850d1ae9d59f39d592cdc3faca6a327735dbaaa9c979b5036dba72937", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279332, "uuid": "a07372c9-ebd6-4212-8d17-6e99d6f66bf5", "comment": "Malware payload", "value": "34a5dca8f5eeb3edb9a73f0e544be74049506325", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279332, "uuid": "0838f046-6530-4ff8-8a60-d61279d3e4b1", "comment": "Malware payload", "value": "6b79ca19851c9c695de124778cf1d94d18255de7c4f2b1b76a85654382fd2d92bd6733446e8b300ba2bb39ab7a351f1a", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "kim", "colour": "#1A0DC8", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279332, "uuid": "884e64b2-bdf2-4751-bb86-bd78622d2c0b", "value": "T189B012A49CF4D85045DC1AA41238D73CE234291027E1E69164FC4680534CFC0AE61EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279332, "uuid": "3be95b34-7a76-4687-909c-51d5b05efa3b", "value": "3:gJc2fu1q90qYGRXPKKk/KzCAKimQRGfwr/TWp7b:Uc2fu1q5YcPK16Wi1GfwrbWVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279332, "uuid": "83785e29-86b5-4f86-a5ea-b8ad1de12a02", "value": 105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279332, "uuid": "badba295-738e-400c-b3d9-21c8e56eb897", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279332, "uuid": "a4e91f2c-7fd8-40dc-8950-6dbaf05b143b", "value": "YqW.Hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d6c04e-2d4b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634256214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634256214, "uuid": "72aff202-ca75-423c-bb41-26debcd83fee", "comment": "Malware payload", "value": "9b93526bb5cb8f5b487a2236f45bf4a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634256214, "uuid": "0917f876-6e8b-4bad-80e2-a748fdf3c092", "comment": "Malware payload", "value": "c5804308c95cf5f08e0b06cc674be6e1b9421c13a174ddcc73f7d1252001f9e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634256214, "uuid": "bed0db5f-b36c-44c2-8a0e-6465c5c0b298", "comment": "Malware payload", "value": "5d4bf5f72074b8321bc67c250c7b76cf97bf638a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634256214, "uuid": "60624ee4-6aeb-4668-98ad-d16690add05f", "comment": "Malware payload", "value": "69235eabad869e7293f212c7f2a4a32cad7f6dd2f9e9c968c1ff76105f8ab74e5fb38c9d3f2b3d8276d84a20980facab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634256214, "uuid": "27ffdac1-9cef-4fac-9354-e38feb785bbb", "value": "T1FE741235B6E8E86BEA37D5300A7EA338E6793D009129198707D8BFCE5F318429E25355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634256214, "uuid": "46a27ee8-72bd-409b-a77e-26fb30848973", "value": "773e933db287d0293e61a62d958e00ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634256214, "uuid": "e2e88753-cb71-406e-8470-cfb872d56ec6", "value": "6144:s3lglS9B3U1wB7zS96KyZzlhWIUiFjD7jiH4/a7B9spsnuHifcYcsTAtLtZ2KwUC:9GBEuBqI9UeiHGa7EQDcKExw1UkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634256214, "uuid": "06e317ab-eb0f-4359-9309-f3fe46b624f6", "value": 351091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634256214, "uuid": "aab6c8db-e6af-4bbe-ba4e-d0fa96682e85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634256214, "uuid": "3aace651-d3a0-4097-8147-ffbc153447ae", "value": "9b93526bb5cb8f5b487a2236f45bf4a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4f2c6d-2d8b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634283842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283842, "uuid": "7ffc13d5-4c18-464b-a9c3-011f5491e2f8", "comment": "Malware payload (Formbook)", "value": "ea5a29adaeedde19dac942d0cd36ec91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283842, "uuid": "534b84a8-3728-4f48-a1d0-32eadffbf4e2", "comment": "Malware payload (Formbook)", "value": "c6106fc0a5a8a0fb4a2245bd159b22ed22ec40840826b51b585f78f97f860be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283842, "uuid": "f023cdb7-2fc0-43db-855b-acf7ed415895", "comment": "Malware payload (Formbook)", "value": "f02440916ca7a1614d6c25bb7f9bc27dd0369de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283842, "uuid": "3c49e334-9eed-4e84-9e8c-bc0d3c0e91b6", "comment": "Malware payload (Formbook)", "value": "f0d19ae5f7d9b1ada283d3bd63fca91ac4f37ff45470206e15467096917ab3df95b8ff19814d57ea12177eff02383f1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283842, "uuid": "a1a43b26-f977-4ce2-a66c-09664d333819", "value": "T1D944122561F2DCFBC18207716AB6C29AE39FD5180170A40B471CAFBB7A667CB9707583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283842, "uuid": "a2a8369d-a3c4-45ed-89c7-738395060cd7", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283842, "uuid": "18a8481c-e75f-4254-b9ec-896401cdfac4", "value": "3072:wBynOpL12riocLM+We73C3iXSIu8m4imntZoPmBa27Sn7vqlndr1+QlX9NZXgf9j:wBlL/c+We73CyLsmtZHn8iXm+rD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634283842, "uuid": "484f519f-dd4c-4e0e-95e7-e64921aa0c7f", "value": 257216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634283842, "uuid": "466994ac-bae3-4bc6-98a8-fbe34a746b58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283842, "uuid": "7877c1ce-7204-474c-b6ac-e38855569307", "value": "ea5a29adaeedde19dac942d0cd36ec91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2bba0f-2df3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634328617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634328617, "uuid": "e5a51996-7db4-476c-9ba2-0fd29272400e", "comment": "Malware payload", "value": "2db31476ba89c2eb13093df7a02c45ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634328617, "uuid": "57aee5c5-b311-4f5d-91be-3707f21c83a2", "comment": "Malware payload", "value": "c6b8a03b94f79fb661cb2bdd0e8a332103ab2974c288b6ab7740acf6aa45af5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634328617, "uuid": "478cfd22-0946-414c-a1a9-e3479604f355", "comment": "Malware payload", "value": "0ecbb0458d025f27fa946b7176e76bc05df8795d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634328617, "uuid": "a882c45a-7794-4ee0-a243-e7ca37fa7e59", "comment": "Malware payload", "value": "facfb9ee38f7cdc331ad9a98b7290ec22420cf451c80f166ab2c851cbe389ffe16ccc265aa83acbf3d90e9590afc98ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634328617, "uuid": "4b6d7d0c-3eb6-4de9-9e2b-b0e882a64d13", "value": "T16384018827AD822ED2305FB8942C645D37729D3668C5FB1F48C7F5A748A63830D927E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634328617, "uuid": "92280cbf-3eec-4ceb-a4b3-ae7321ee6f44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634328617, "uuid": "dad46dd3-6cf6-4a0c-8724-d12c398f0861", "value": "6144:XVV4XoMMkhB9zJOWH4+mnW/OA8IAJ+qZKmHIJJlhfkXjeSFyzoU5LCf5+PXjf2iC:XViXoHSBZJpY+9/j8yqZKKIJXhsXi2ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634328617, "uuid": "1e4b7bd4-1419-4758-8c31-7f64ba3e5501", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634328617, "uuid": "09b8840f-4054-4720-a4df-b89eb9936da9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634328617, "uuid": "304b1b78-dd31-4679-8850-c11e29a06744", "value": "SecuriteInfo.com.Trojan.Win32.starter.ali1000139.21722.25918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd8d8b6-2d8f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634285482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285482, "uuid": "436cc65d-256a-43d3-8b2d-f6fe3531df37", "comment": "Malware payload (Formbook)", "value": "a2a3dde9afc863ab8254f6a4dbd63eb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285482, "uuid": "abb68ec4-b0c6-489a-b2df-a12eec43d98d", "comment": "Malware payload (Formbook)", "value": "c6bd41deb507046a69d680f7ce7c06ec255fc0ca19223d57788bca61cc14beb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285482, "uuid": "3ec778d2-3423-4ae4-9eae-54b1b7f8f66b", "comment": "Malware payload (Formbook)", "value": "1bd5ac9ca23d589175066935b1e0f9afc2ea14d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285482, "uuid": "b30175fa-e30b-453d-becf-3528e834a65b", "comment": "Malware payload (Formbook)", "value": "ba571b949072c101a68faa78cf033fc98287be41fe358a3e783366e9fa48f20d356104ebaae25dbe5476c52c4367e672", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285482, "uuid": "f7429a6b-5e43-43b0-9db6-c51f07d6c98b", "value": "T1CE740105374CEA0EC1715E7E988E905D73B45962A8D2FB4B6AAFF2CF44D23D318412CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285482, "uuid": "fb9c9380-5909-406b-becf-8ecf35c3fb41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285482, "uuid": "39ad3725-ab3f-4b7d-a120-14ae38ac455f", "value": "6144:5ei2R2IMkhBLcZzDmAtte2gxLOTyJsqsffCpUm4v/HqoCXFwfViduVpPu:JjSBw9he20idqsffr1vvqowGiduVpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634285482, "uuid": "090a9aca-3355-4444-88f6-a2fe2d4a2d3a", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634285482, "uuid": "fb9ed919-e4f9-4f88-8fb0-4a207cb1b0c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285482, "uuid": "2636fc5d-caba-4fef-ac71-619ee5edb4f7", "value": "a2a3dde9afc863ab8254f6a4dbd63eb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48002031-2d82-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634279811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279811, "uuid": "8a9d0e44-96f4-4e4c-8a0d-68cfdb39d2cd", "comment": "Malware payload (AgentTesla)", "value": "f22e2ffc7411fb58eb81812056af94f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279811, "uuid": "5d052054-4868-4837-bf02-d5c2c4e58170", "comment": "Malware payload (AgentTesla)", "value": "c87a1308b5783b9d4261acb4704cdbfa482bd5b3080b3f1399424610161386a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279811, "uuid": "78754081-699f-4e9e-b698-e61b70a791c8", "comment": "Malware payload (AgentTesla)", "value": "75c1d0f6d7afb25ac250c35254bde86e33ade416", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634279811, "uuid": "0795fdf3-0683-44b0-b714-8461e71b0d52", "comment": "Malware payload (AgentTesla)", "value": "7f8cde69afeb289c2f16f0edf3cadb338b10f973a1aed0b83f087cba46ae973cee957fbf2838a86ade5523c9afcfbc44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279811, "uuid": "6d2909fe-6e61-4417-88cd-f09fda26a280", "value": "T16594DFE3FA905B37E828A672C9DF40125129BC52B5C86D4BD394B79E0E336115E0FB8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279811, "uuid": "43a1e6d5-f32f-4efe-b314-dc4b2992498a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279811, "uuid": "7d42fde0-ef90-48e7-b4bf-89a80553614f", "value": "6144:hBlL/IjnGxBSf+gYfsoHE3qpxj01at3WQJT8AjzX4aO683BoGQPpkz1bLGyiM:nujnGxBSf+gYvk3qpxUk3/TrUF5oGqwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634279811, "uuid": "af7597d7-97f5-4b68-81ad-2675d995da8e", "value": 443742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634279811, "uuid": "a8a98b8f-2b90-45c9-86d2-973c7be12757", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634279811, "uuid": "14653065-efbf-41d7-8677-019e531545d7", "value": "\u7f8e\u91d1\u532f\u738728.84 (USD 40,257+5% \u7a05\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09159c2d-2d87-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634281853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281853, "uuid": "a5b2ff17-1236-4313-8223-bcc2ca6275dc", "comment": "Malware payload", "value": "a7e1a12eb27b3ee2209dffa1a59f58c8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281853, "uuid": "6fa9388b-0cf2-45cc-b78a-a5d6d9b04912", "comment": "Malware payload", "value": "c92a7d2f90ed8bdc73a7ed3fef7bb98cc86b875a939c2b5d2b01ca6db71f98d8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281853, "uuid": "0bfae8c8-1e57-4922-a230-b49ca8003811", "comment": "Malware payload", "value": "bff82146d55983003e8da6b77a5bd8eee898ed72", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281853, "uuid": "70712a52-3a7a-430b-a3ee-6be1d87ff199", "comment": "Malware payload", "value": "a60d045d0ee63a56683fa32cb5283091d83229562160eac47b4712498f063ca83449b89f225544a9530b6495882dbff3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281853, "uuid": "4515fde0-dc8c-41b7-93e5-6ef174b30766", "value": "T17BA423122C486EA5C4FFFCBB87B83D7EDE2CF26A5901509A2BF4118D0D76E4015AB16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281853, "uuid": "ac9affd7-6ec1-4c89-9839-0cdd887d5800", "value": "12288:tf51spL11E3VShd+qr1svgrruWUwSkOLreoWfT:tf5sJ1iVS/fr1ugryWUwSkOXeoWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281853, "uuid": "a94fb6b1-c4e9-43e9-8827-433ee9b28b74", "value": 454666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281853, "uuid": "e74aa206-5d85-4538-aff3-7fcb4c45c03d", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281853, "uuid": "28b9f829-3f2d-4a3b-9527-05f7a083fe34", "value": "kuronekoyamato.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f294fc9-2d61-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634265543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265543, "uuid": "99bd5be8-ae9e-48c5-88f2-bdb18d6eae38", "comment": "Malware payload (Mirai)", "value": "85badc4e867a9c3ef173d60b6ac11df2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265543, "uuid": "9bd939a6-21ef-4873-9d09-322ee28a3d51", "comment": "Malware payload (Mirai)", "value": "cad12f9a02c109730455b2e0673a212f75b2135af582ff352a274b0f3f046dc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265543, "uuid": "82ef9510-a33e-4322-a1bb-494a393995d4", "comment": "Malware payload (Mirai)", "value": "e7e082f34f706ddf5c75f8b9f79e8191969c9316", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634265543, "uuid": "5b838176-8cde-4476-9b07-0d18d7f03939", "comment": "Malware payload (Mirai)", "value": "9b130a0f6a60b829af8356045a70f4ec2b5cadd0e684d9c9913abbbfa47bd0cb39b838c609f257077d0336da8f650679", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265543, "uuid": "fcc3a987-3fc8-47e8-b8bf-fa83cf1959ba", "value": "T17763B506BF614FB7E86FED3709E91B05248C541B21A97B3A7E34D818F64B25F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265543, "uuid": "d2bac1c5-6c78-42e7-a310-f8a31f2c89b8", "value": "1536:xic5msW0d/JnzwIFIzUP8UTtDOPHtb3cBS:xP53DlEOYtMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634265543, "uuid": "4319c5b7-ed7e-4f0e-ad89-5ead08097adb", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634265543, "uuid": "4c8d3421-9f7b-441d-b98a-45dcad9bf0ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634265543, "uuid": "4c0c1b3c-439f-4fb1-acd4-587577fcd97f", "value": "85badc4e867a9c3ef173d60b6ac11df2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5135d013-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634288846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288846, "uuid": "55e45b69-5bb7-41cc-b4d1-9f2bdfb30190", "comment": "Malware payload (AgentTesla)", "value": "31feefb972bfafaad25abaed5c6d662d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288846, "uuid": "40075c0e-192d-4ebb-a104-9f556fc86ed8", "comment": "Malware payload (AgentTesla)", "value": "cbf6a5b26b6190c21221a8b0c7194adefe9cfde00fd6a8193483d4791793674d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288846, "uuid": "214ea5e9-bc1e-489d-b655-c9e94260dca1", "comment": "Malware payload (AgentTesla)", "value": "349ac7779cd5c149d6af185ca0c091c9e4ca3d5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288846, "uuid": "48fcca71-219f-4ff4-b23c-0491804dee72", "comment": "Malware payload (AgentTesla)", "value": "7c7fe227375b57f74c5768e39b09c9051b7b4b65acd14f45051f862240b5293dcabfcd049786246f8aea1b7cdb97a8ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288846, "uuid": "da565b38-5d39-43b8-a57e-097ec0100666", "value": "T1BA842343E857F4F6F340EA58503148960ADA7F41CD7DCAD0A93F32CA6F592A09CBD18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288846, "uuid": "4ab90fb5-8703-414d-a99f-c3e0b189cfe2", "value": "6144:kXOgKT6LkOXwnfJ5GJnGXimuFsUOCPsLmdtDJTDA/OYyesqtE4OE8fDCELvWSoW+:kXOP8kOgWJn1muDELmdZ1wts+GzHNje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288846, "uuid": "ff903677-470d-42b2-9bd7-2f98fb22efd3", "value": 374379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288846, "uuid": "d6c3aaca-f124-4b09-9487-8c019db71174", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288846, "uuid": "ed03db06-f3e2-4db0-8f7c-dd59320638f1", "value": "BL-LADING#ATA-3678920.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee1e8fb-2d73-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634273407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273407, "uuid": "255981db-2c37-451a-8720-16832a82072c", "comment": "Malware payload (Mirai)", "value": "c0193cebd361f40b31efb8180b482bc8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273407, "uuid": "7538e8f7-9c83-4a55-be08-24297aa69fb3", "comment": "Malware payload (Mirai)", "value": "cc4fe958dd46d3fcd9b8a61ceaf31e5b39fe77f7b6a33531005a9618914e7e2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273407, "uuid": "89eaa796-4ac9-4989-80dc-082f9df42f02", "comment": "Malware payload (Mirai)", "value": "a54c7acc0ac9271c8ad356f869620e9de667381f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273407, "uuid": "968b574e-bd01-4f7a-a745-669228b1d8ef", "comment": "Malware payload (Mirai)", "value": "8e459d323ddce709cbb74462f0d23c59abde23e7cc4f8eebc004ea4a0ed1bdff4d2b75e902bd685cf1da7b93a5e21391", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634273407, "uuid": "41cf71c9-29ee-452a-adef-62e5671ddb6d", "value": "T1E2237CC0A543D9F8EC150AF53173EB329B7AF07A2129EED3D794A432D842702E54729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634273407, "uuid": "9fe36b15-04d5-4cec-b047-35a45ed85c93", "value": "768:gjo8WnBsux3TUi32+4qbBYSWLOC9mnbrVYMbJoSlO+Meb4aU:gWBsux3TUiG9qbBYSWD9mtY8JoSlO+1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634273407, "uuid": "90787d34-ffbe-4bd1-aa7a-43660d425e98", "value": 45656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634273407, "uuid": "0dee6737-86b2-4ae8-b6a6-afe5e48190a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634273407, "uuid": "8b9eb3c5-e4f3-45f8-b137-573419b2a4b8", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38b6c62-2dec-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634325572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634325572, "uuid": "1cdaa47e-f42c-4d37-80e3-57ea795621fc", "comment": "Malware payload (RemcosRAT)", "value": "b02c6f0db629e09a7590bdbadf0b4bc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634325572, "uuid": "23a80806-3901-4d3d-b5c6-40f84c1d7a5e", "comment": "Malware payload (RemcosRAT)", "value": "cc8b096d71a4734e17e6f1bcf10d9730e5a2b3ab15b7e89852a4cdd204563d29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634325572, "uuid": "df02200e-68d9-4659-b720-747742e48edf", "comment": "Malware payload (RemcosRAT)", "value": "ffbb7c8ccbdf7e668e28481cd72ab24a4bd5c419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634325572, "uuid": "8e5ead56-e28c-4319-aa0d-9b85b0eddbba", "comment": "Malware payload (RemcosRAT)", "value": "70f6cd4304b0f5ef53c7b0944d338e4dd7e44c57c097805e4a67ade1ae6fee6e96213af52bcdad4625062156f087bedc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634325572, "uuid": "e2f8ebda-b00d-4e38-9a70-4652442ec618", "value": "T14C35AE63FA008976D14216379C2742F4693EAD457E1CA6AB1FD92D4E0FB73807A31B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634325572, "uuid": "578ed57f-669a-4467-964c-ede9c53341b8", "value": "ef0d28111726cb15a4aaa9629a42e157", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634325572, "uuid": "453eb7c4-8b7e-4c0f-93c9-4503f1624d17", "value": "24576:rgIXpxJEwJsH9STanFMlMh2sXe5q/E5X/CUR:r9xWbpFMIec/E5X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634325572, "uuid": "a19ec11f-0a6f-4da2-ab6c-3b839cdda384", "value": 1083392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634325572, "uuid": "99638b85-931f-4701-8539-02b4d804c38f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634325572, "uuid": "a30b605b-8105-4593-8a12-036c2668422e", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398d51f9-2d5f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634264755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264755, "uuid": "7b913682-4543-4e41-9633-04799360f2be", "comment": "Malware payload (Mirai)", "value": "6a29c3271821324fd15395a3fd9c94db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264755, "uuid": "d49cd5e1-5b92-43a2-a793-8820c445b1b9", "comment": "Malware payload (Mirai)", "value": "ce4e353010b100024d7cca45d5580d1464c9d59044f84bdb147b7f539257b47d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264755, "uuid": "ea480e0f-00a1-46f2-9d61-f5a01758660e", "comment": "Malware payload (Mirai)", "value": "b4bd63f1ebc8afce73fd63ad6ddce65abe698a45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264755, "uuid": "de4ece83-c2b8-4918-9956-1977f198235b", "comment": "Malware payload (Mirai)", "value": "dcc7fc58fda2aa700e0a071bb16f931a4782b299ce532f5fa6bdba231908763d26c1cbd3735c8a412cc2ca1d95bf9122", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634264755, "uuid": "149dee61-268e-4173-9209-552e4e123e9a", "value": "T17333190272280A4BF5E65EF0293F0FE097BFF99024E0B584695EEB458536F761486F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634264755, "uuid": "0c0c8f36-8cb7-41cc-a754-09769b974076", "value": "768:JTHz+ANmmo1oRze7TPRItebzyhBsIn3Z6BU8VbOkhA5Lbv:R4mo1oRzkjHfyHH3Z6wKAxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634264755, "uuid": "b103ca25-2df1-41fa-afd5-91e6e33c2c36", "value": 50964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634264755, "uuid": "aa4b1bef-cccf-4f12-9f40-a00eb2aab2f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634264755, "uuid": "1bafeaf0-ef36-41bf-bb98-447c1ff37bcc", "value": "6a29c3271821324fd15395a3fd9c94db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414e67d4-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634288820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288820, "uuid": "09d5293d-4227-44eb-a784-e9db29f9d78f", "comment": "Malware payload (NanoCore)", "value": "07cf75921767f4547441595790fb0dc1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288820, "uuid": "a9ca27d9-eebc-408a-a3b7-703c31051b49", "comment": "Malware payload (NanoCore)", "value": "ceddd535a300944577bb19bd278fcc1cc239531f7fdf81b3d5a0ba7ed5e3193e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288820, "uuid": "ba99c4c9-c8be-4ea1-8ebc-616bd68fcd94", "comment": "Malware payload (NanoCore)", "value": "b70a01cd77c6ab06165090594dd24c3fd178f50b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288820, "uuid": "6b7af571-e791-4bf9-baf5-12a094f88ffb", "comment": "Malware payload (NanoCore)", "value": "ad896f94754ee0da9ce1b6d01e3a7f9c9424482a926e2f9dc7c6f684845cd7d10454eca5e5dcb05c8b7af8605f2e99da", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288820, "uuid": "9f74e26a-c5b0-47e4-8fa5-ef338ea34b6f", "value": "T12674231AD9DBAD8A24F5B1B8EEADA0B318A7370037A238159601FF3E3C5A54D71443D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288820, "uuid": "cfe226d2-7832-407b-8031-3bea6305790c", "value": "6144:OkjyHPME+vwV4yznstM7gQDrOqpNsvSUvMvdLkld9/gxoa4zrfDqAhRLh42ZdzMc:Lj4JywnsWMQ7Ns5vMVcdwo99jRKmQvY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288820, "uuid": "33462e99-38a6-4788-87aa-8accb61cd2d3", "value": 357823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288820, "uuid": "ff2a4257-5991-4aaf-8075-ee5693bcb113", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288820, "uuid": "09b7c673-5ce5-4789-ae11-ca4ac2db48eb", "value": "Circular PSSB Parts Disc Credit Term (Dlr) Oct2021 (1).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb0c28b-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634300519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300519, "uuid": "23cd6235-3eb1-4a6d-ae74-094cfaa5965b", "comment": "Malware payload", "value": "55f16653a414d44758085369fd69e1d6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300519, "uuid": "dc65acd2-9bcf-4902-97e4-05749f2b10fe", "comment": "Malware payload", "value": "d2d123d94c702c15076dc54e308709bd03d49a9474df46784b674dc5bf3acea9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300519, "uuid": "98372a7a-2be1-4f1f-b3df-5d8951115d7b", "comment": "Malware payload", "value": "8b0cb70531e3417510b3ce15b96cddbc2213940c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300519, "uuid": "41c0d0df-91d6-4d97-9ec6-6a516a8dc191", "comment": "Malware payload", "value": "d73db88dde67cec72e1c9208d3d16d7b4e93cdb4f24cac6c5bbb93a514b317a416fffba9edf0ba3a2e752bbb3b29bc29", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300519, "uuid": "76540798-1db8-4502-b90d-163ffe12f49f", "value": "T168A58D22B2D18437D0776E3CDD6BA369942ABD602E38884B7BE41D4C5F397413A2D2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300519, "uuid": "b878e201-88b9-425f-a90f-162f205617b8", "value": "24576:geb7gRuxeRQXvW5Ax3MsDx4LxCAyzjqZE1LK05mH5yrr3YODbOJbqGfBhVCTU+0t:gefyARMKx4LnuqZg4zf3oTP3oSOYQEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300519, "uuid": "fe4b8353-d115-49eb-9f80-a61278c1fca7", "value": 2231808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300519, "uuid": "1fdaacf3-b2e5-4e59-8d85-6fc616ba843f", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300519, "uuid": "87b3d5d7-2083-4518-899f-d6f4b47bd8dd", "value": "_-_fzol.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25454396-2deb-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634324850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634324850, "uuid": "061c8d12-a772-4195-a803-0cb0347e11ef", "comment": "Malware payload (Quakbot)", "value": "5c76498485ac6534b1b1aa0d6d543762", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634324850, "uuid": "52d20a2b-e8ed-4129-b44d-dd51d8e69f7e", "comment": "Malware payload (Quakbot)", "value": "d3fa92f89ffbc4403c0f8b95034a61d63cfb47fd11cb7d90b5a8d724250234a3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634324850, "uuid": "cb4ab51e-a26d-48f2-af6e-732c2f348f1a", "comment": "Malware payload (Quakbot)", "value": "cf7f1b0007a4007510e48fbc7e61772c25314352", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634324850, "uuid": "3dd761e6-45ba-4651-861d-08e6d17a546d", "comment": "Malware payload (Quakbot)", "value": "203824ba06ec24c0e4a4bb2f97d0f19392c5741817c040372484e4ebe20a004b3ede089fbdd5eb452ef2a2b5e8589810", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634324850, "uuid": "ddb5a9d2-5756-4dc6-8a39-a70cfc914c4f", "value": "T18B258E32F2A14437C5731A7CAC6B62999C3ABE107E28B44B6BF90D4D0F396423D652D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634324850, "uuid": "712c2a91-5258-4e22-b12e-10b2884c2e17", "value": "ef7793fb29a91e2ec547fae0d4d77318", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634324850, "uuid": "f40f83b9-cac8-4f17-a50f-7d8ef4b65916", "value": "24576:EFYpMTTHVlVTyv7o5pGyctKIvOO1CjdekTVzGLnHhtRfDVaG:EQkT1fo+xlVzGLnHLza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634324850, "uuid": "88a6c8a7-5b9d-466f-b309-179bcc4f9519", "value": 989216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634324850, "uuid": "a8ac9299-d43d-49e8-a27a-63ad35a5282a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634324850, "uuid": "7b3d28df-5ac0-4da3-84c0-02fe7f85a7fd", "value": "SecuriteInfo.com.BackDoor.Qbot.623.4600.25636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83847b87-2da8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634296232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634296232, "uuid": "f9265e25-3ad7-489e-8cea-9c97ef0be698", "comment": "Malware payload (Mirai)", "value": "7bc0fb53bbe3c44a86abdc8f775841a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634296232, "uuid": "b9c62b9a-0735-4023-9410-b43c690d85ef", "comment": "Malware payload (Mirai)", "value": "d489b3c564df01323d60ee7ae3762dbb15cf70e5c04632eb25eb6abb0c29da77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634296232, "uuid": "7ebe1e92-c018-439a-b2df-13b4e3a5a5d0", "comment": "Malware payload (Mirai)", "value": "bf3c45b27f3455077a6682ab22836946bbb9b670", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634296232, "uuid": "34deaf20-9998-45fa-a88c-e97e831d4b80", "comment": "Malware payload (Mirai)", "value": "7bb8bdcd883cec100a88bdc3847085adbf54ebd80cd29caec4755e4201b3ed01f859a565695dccb8d8511e5be4d47869", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634296232, "uuid": "abb532c7-5a57-43ad-b26d-f06b4aa816a1", "value": "T16B64028BFB327C0BCB010FB121DB5B9DA97CAA5B83C79091B6C0845F26F61C576A12D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634296232, "uuid": "d324329c-8f3e-485f-9f3d-78dbaf8e1e3a", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioD:p3lOYoaja8xzx/0wsxzSiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634296232, "uuid": "ea770c79-c624-44c9-a5cf-00b7a042e40a", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634296232, "uuid": "d6a828d9-ac8c-4a75-8c5b-661a9ba20f21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634296232, "uuid": "0f9beacf-d663-40ee-b6a4-809b1356799e", "value": "7bc0fb53bbe3c44a86abdc8f775841a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3278c6d-2de5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634322538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634322538, "uuid": "29b5e578-7ce9-4baf-8d6f-7e0b4ba0375d", "comment": "Malware payload", "value": "55b6d906ef1a828aefd2ed665086b602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634322538, "uuid": "7fa68205-a665-4c9a-a1e8-5e60b8d7f1cb", "comment": "Malware payload", "value": "d4b4f0e3c29dcd4732bafa345616d73211c86eebccaa84e770c456d0c6f118df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634322538, "uuid": "d50c2268-c9bc-4352-9588-112f2b2a5926", "comment": "Malware payload", "value": "28202731341e2e3991de00964d21233f16916109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634322538, "uuid": "b3e3daa5-d2bb-468a-9d92-a21d51be0b8d", "comment": "Malware payload", "value": "6b5a4b19d7ddfe3064f3742af02b29f4354845e381f37ee50538251e1f3719f124dd0afe17b3a41d3b1b7edd9a1b05b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634322538, "uuid": "6587aeac-6196-4ea0-a0f3-7fd998aec439", "value": "T1A3B5E04213D1E7BBECE26ABF4F73C203165F2F9167B41DAA1D01855EB91295320E7A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634322538, "uuid": "7a75bb17-6e4a-457d-9535-9fdccffcf04e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634322538, "uuid": "94f9f9a7-efc7-44b6-ab2e-4fdbe9bcf1f0", "value": "49152:WOX70Y1vJ2kfI3p1o9v7Dx/pP4EPDpDSjxF6gVlpcl3l:NoY2kfI3k9zDxxPWXVTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634322538, "uuid": "8fe7e131-16c6-4853-af5d-1d02df239724", "value": 2433024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634322538, "uuid": "8bc583a5-5fb5-415c-925d-610cdfe9187e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634322538, "uuid": "e2b4ddd4-00f5-4a33-a8f3-61a098629b1e", "value": "55b6d906ef1a828aefd2ed665086b602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604bf598-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634321084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321084, "uuid": "4b38915c-8ba0-46ce-b08d-ae4ac97e8a2b", "comment": "Malware payload (Mirai)", "value": "c421da326b75792dc16ab77c61085c12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321084, "uuid": "27846c34-561f-458c-a47f-44e7aa8aabd4", "comment": "Malware payload (Mirai)", "value": "d4eb62801086edb21ae9396511967fdcff1081aecd0cbb40d486784276c51b11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321084, "uuid": "34712315-4bc4-425f-85af-5a8b4152c876", "comment": "Malware payload (Mirai)", "value": "e2b6101244a7f94ed6381acafe0e011e7bfab2f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634321084, "uuid": "428700dd-a1bb-4b2c-8e63-1406da1b5a99", "comment": "Malware payload (Mirai)", "value": "f39f6c8f2d361f77dda2b967c3a003bd34b7989c3bdc4024e63670473333ff86b36ffec9683dcf0eddbed71c7acfdf27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321084, "uuid": "5d89d5bb-87f0-4976-a6dd-391a677abfcd", "value": "T13253F782BC50A629C7C04777EE6F509E3311ABDDD0EA3746DC150BA47A9E80F0D67B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321084, "uuid": "b615a84e-8b5a-4e2e-852e-b4ced7c1c4a7", "value": "768:qNpSX4ltGcabf8u0GnP7+2xrh6RDFuYso1Jcy0uiDz701T1fj7NSqtUut65aQ8Mf:WSXGOfeGnTBxr64Y/cB8t464qbJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634321084, "uuid": "22e7f80a-3b5f-4ef2-93b4-e4d42dcaac73", "value": 61196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634321084, "uuid": "d234bd42-0729-4d4d-8d13-ce5eeed57db3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634321084, "uuid": "0e3dfb6a-5540-4d3a-8999-add9876fc45b", "value": "c421da326b75792dc16ab77c61085c12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc5002d-2db4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634301299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301299, "uuid": "358bf2b4-91f3-4063-9ae6-8864bb3872ab", "comment": "Malware payload (Formbook)", "value": "ce5a9b1b89a57e526ee1347645b25000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301299, "uuid": "1655d7c2-0ecc-4af2-9384-a3df849c7f51", "comment": "Malware payload (Formbook)", "value": "d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301299, "uuid": "4e03b7b2-f070-4ece-864a-9f1848a8bf33", "comment": "Malware payload (Formbook)", "value": "a30d421092b052f05ad0861c63d720404805bdcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301299, "uuid": "27430517-1810-4f76-a6cb-7d7463cea487", "comment": "Malware payload (Formbook)", "value": "07dea8cda2ef2480538153cc5706f6d59d8a7ff3ea0ea803f55212b290664b3d1d4ba4dd0dca904be5890f4d3bfbb59f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301299, "uuid": "8a9006d7-beef-46d4-888b-a10e843540a4", "value": "T1BC74F12073EA922EDC364BB89C3952D253B97BB97B05DB5F2445214C9D23B434B60FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301299, "uuid": "69883b1e-b081-4c4e-b8cb-4688d8b6637f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301299, "uuid": "f99e3b45-6099-4201-b6ff-a62d5a9b0d65", "value": "6144:e0tgMkhBORh50cUZzKDj8jd8EM4lnt91AMv4o4EE77DqOKyOmRQBQ7Y:dSBaPYyAm4ljyF7/qOKmRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301299, "uuid": "39fa3239-cd4e-4282-8d98-857c2f0e6f4c", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301299, "uuid": "32f1e137-429b-4b17-9d7e-e611b3e57cb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301299, "uuid": "8c51f47d-060c-454c-a93a-a680ef516cee", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc8e7b6-2d73-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634273405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273405, "uuid": "24cef492-50d5-48f1-bb3a-ca38ed6dfdfe", "comment": "Malware payload (Mirai)", "value": "f49679fc2fc165a8dbdb679fdab5fbcd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273405, "uuid": "6108a48b-8f46-4ab7-b8f6-ab2114b3ff7e", "comment": "Malware payload (Mirai)", "value": "d73a54e2c23166780b06290b5058804208d532011a6c49a7ef7ab85a0b5a484f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273405, "uuid": "fdde0064-a061-48c0-b56c-da4bbdc194e3", "comment": "Malware payload (Mirai)", "value": "824afb437ba303f7d1ece9d5ba4a763edb8410ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634273405, "uuid": "8145870f-4f22-48ae-b58b-3748858e2922", "comment": "Malware payload (Mirai)", "value": "0e166bdf74eee2c4146cc3a413874d1ec53b35de19ea97bc5a6f894f90108eba4962156b9304f576b7366e1df7fa8075", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634273405, "uuid": "e44ef6e6-05c0-4448-bf69-5142b2c66cf7", "value": "T1EBC32C56EA818F03C4D61776BAAF42493323E754D3DB730689186FB43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634273405, "uuid": "09414f51-1be9-4b6e-9eb9-6ba2410eec35", "value": "3072:lgU/44TM2nDQwI25oFxhYJn6Z5I+oV+M/900i/:eU/44TMKFx5oFxh0nOI+okM/9xi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634273405, "uuid": "55d1a0d3-8a9a-446e-91ec-e1cfe9da2a2c", "value": 121479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634273405, "uuid": "0ca78555-93ee-48e6-b65a-b6046d73a0af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634273405, "uuid": "894efed2-9b46-4237-9348-87298c431c3b", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd9c43f-2de0-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634320434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320434, "uuid": "10e11b42-b474-46bf-9c61-2bf2529c4ba3", "comment": "Malware payload (SnakeKeylogger)", "value": "f7cc11cec3fab768dfc2939a7d84f5e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320434, "uuid": "ce588982-8b3e-450e-8188-5470459a44a3", "comment": "Malware payload (SnakeKeylogger)", "value": "d82eefa0193afb698d4121a88c3f938b3806a33ace81b5338f2c42ede1f830bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320434, "uuid": "2e91e1eb-7446-4f73-b822-eba1e36f503a", "comment": "Malware payload (SnakeKeylogger)", "value": "1991c3c97e615ddc3e1fdd45c6dece4c0052c943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320434, "uuid": "25911530-3199-4ccd-baac-4442356de6b5", "comment": "Malware payload (SnakeKeylogger)", "value": "9168a0d27a86626800c58617bec03d2b8ee9087970378a9406636497a96ad69ca67867aa8412d04b8d64d26548854371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320434, "uuid": "1a040af3-9e19-40e5-8956-bfdcac488029", "value": "T113641256F28189F7E01105310672AB76F33B9B49C027AF438774B9F70A70E8E956BE46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320434, "uuid": "e341549f-4977-4c93-9dba-d50b6a16d93b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320434, "uuid": "3cc10a14-bde9-486a-b55f-813aa121954e", "value": "6144:b8LxBqtPhY23qhQfbkQBLmAN1U4vUJBSrjqyVXYsDqcuUURBXc:nRhMhQfPw4fUJ0iyosGcuUUR9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320434, "uuid": "6baf009f-e10e-420c-8be3-9c73438da26e", "value": 323474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320434, "uuid": "9e1c8847-312d-4c94-b840-5e94b2c3bd0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320434, "uuid": "2de31c75-503d-4e1c-841a-01da4abc06c5", "value": "f7cc11cec3fab768dfc2939a7d84f5e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da07094-2d5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262534, "uuid": "f4a3d4cb-b2dd-4efa-8dc1-d148171754aa", "comment": "Malware payload (Gafgyt)", "value": "871d042a5539279c70edf759b1c3de0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262534, "uuid": "12d80d73-014a-4907-86a7-bf8d0c36dc5d", "comment": "Malware payload (Gafgyt)", "value": "d83c7c136fbdc4f3b9f6635d5df46585523f06dfa04e0dc2e6a90c1b17bd6efe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262534, "uuid": "24fd3521-a042-4f69-a54f-8464d5880811", "comment": "Malware payload (Gafgyt)", "value": "d2800919c9d8f2ff4517acf5267f3dc5170f6eca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262534, "uuid": "9e632e8c-30f1-47a6-ae86-c89a1e8cdf66", "comment": "Malware payload (Gafgyt)", "value": "d339a08ff3dbb4d7b83bad17de986797fe948337879a2bde33b5305ef5155eb87a359a6e87ffd70cb6bf106d3648f74b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262534, "uuid": "fa3c0a09-ea45-4115-a9df-567dbe9c4716", "value": "T11EA32A44F841872BC3D327BBE78E478D3B36569467DB33116A386EB42BC17D92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262534, "uuid": "60795f82-1842-4051-9f5e-3cb4d2f0c3c8", "value": "3072:VSx+i6mqaObhNWnPbGnbhdamZuqQ4DPwXXtse:y6mRObnWnPCvamZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262534, "uuid": "3ca3d06d-5464-46c1-9470-e9f9aec96f99", "value": 100872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262534, "uuid": "488bf7ed-f2cc-4037-941f-8894ba64d88d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262534, "uuid": "dd8e22ee-4ef9-456f-92c6-1fee9ca931d0", "value": "871d042a5539279c70edf759b1c3de0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad0bb5e-2d92-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634286930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286930, "uuid": "108a31d9-5f29-4d09-a77c-7cae53b40e29", "comment": "Malware payload (GuLoader)", "value": "8684134b8de3a1716868a2778bbbd166", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286930, "uuid": "90babe08-e7b8-4d0c-ac1b-a418b258424a", "comment": "Malware payload (GuLoader)", "value": "d9bff821bf2ee062c2e8a09683afdf452b592aaa461e560a8d38919dc60b0b71", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286930, "uuid": "9ef1ec04-0780-491f-967d-7c302a355076", "comment": "Malware payload (GuLoader)", "value": "78cb84530c418fbf077bb6c8240585da827de366", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286930, "uuid": "34e31c65-4a2e-4dba-9051-b8a705d6d41e", "comment": "Malware payload (GuLoader)", "value": "b10c92e71506ba4e67f48f0817742a4c85fd27cbd6574e33b0d39e1aa8027f24ac8e24e1603a1a53caf7278e494219f9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286930, "uuid": "5a6d9724-45b4-4438-813a-3f3da1e30c99", "value": "T1573302B3CD8C7AA3742402D99D5D05BF227A822F14E98A9CE1F65F38639D7A0133D16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286930, "uuid": "774038ca-8027-4bbe-9b18-2b52bf6b837e", "value": "1536:snHkZO9g0pS/dT32Mn/+QVcwcjuBepZdUBLlP:gOOjKdT3V/+QVc7juBKZWBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634286930, "uuid": "e1d140d5-ecff-4733-a15f-bb952a99ff5b", "value": 54791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634286930, "uuid": "d1af4557-0bf4-4783-8bec-e54ee10c061e", "value": "application/x-lzh-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286930, "uuid": "7901359e-3fbb-4063-8c7a-fee2b8ae6ad9", "value": "payment-wire transfer- (BT67798213454323235).lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f31b24-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Alien)", "timestamp": 1634300692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300692, "uuid": "d433eb9a-6d46-40f1-914e-992d8b7f71d7", "comment": "Malware payload (Alien)", "value": "ea911124defd4bf8d63aba29b0a04ed9", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300692, "uuid": "873f6798-cc1d-47d2-854b-515f6bb3c80d", "comment": "Malware payload (Alien)", "value": "dad6cdcd782dc3daf5cf1dbdd82c58336af18b33a87be3f19b0833e547fe90a5", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300692, "uuid": "1b03dca3-85a6-4247-8829-0c9719b2f0f6", "comment": "Malware payload (Alien)", "value": "de6bdb3f1153e95fbf3b4aff904616ff8340e681", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300692, "uuid": "ce346dba-e8ce-4dd2-926b-375dcf189744", "comment": "Malware payload (Alien)", "value": "112ad4941f4515f150689e29766691d898fc1e6791b2debcd0a3dcd67406a624a7a70d8ff1c6ddf6a27f8ad71b940b31", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300692, "uuid": "5c087964-54ca-4f21-86e5-9c7c8bfe67a5", "value": "T1532622777F81FC55D1838938E1078287A11C078A4951F42F9A2AD85D3B7ADA40B26FFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300692, "uuid": "47af1bf4-46a7-4785-8f94-0934bcd9c8a6", "value": "98304:qdK5aHKd+5ZEy/U8cZID5oLO50zISGdo/vIlZPB2S/kP8:2qdry88cm1ELmkvIlZPB258", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300692, "uuid": "0d3e81f6-4377-4ad2-a88e-2a5133180c0d", "value": 4490385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300692, "uuid": "1a3d4169-bac1-43b7-83e6-391229e77f62", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300692, "uuid": "9dc0e232-d4c5-4195-aea6-4b8b0cc737bb", "value": "Chrome637178.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe100942-2d86-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634281835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281835, "uuid": "5b279922-3604-4408-9ce2-51f7f29325c7", "comment": "Malware payload (AgentTesla)", "value": "121ebda619d9b52d6e8a881072a07f02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281835, "uuid": "e7e86e2e-bc7c-4683-970b-5494967b94af", "comment": "Malware payload (AgentTesla)", "value": "db9faea722de8da4248a27a1050add73bbe19261096672268a4860ee11cea1ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281835, "uuid": "eeb6b7ab-1406-404d-88af-a819cc812dda", "comment": "Malware payload (AgentTesla)", "value": "777b94fe752217e429d23cb4231a94be51762185", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281835, "uuid": "03bff14a-6859-470c-8918-7879bc287c46", "comment": "Malware payload (AgentTesla)", "value": "223ffee409345293464e388582144d3552c3592165a1f297d8bafab71ff88e9a14e2eb4690a610a61fe5841672039b6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281835, "uuid": "e54f567c-c337-4102-aa29-a60bf649a321", "value": "T19CB4BEED315076EFC86BC8328A991C74EB60247B531F5213906365EEAA0E99BDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281835, "uuid": "1a1032c8-a24e-4e14-b883-88569d60fe41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281835, "uuid": "248421d6-f335-4df4-826b-9a6d69183c75", "value": "12288:MDiUi4hgz7v0/HvS2Kg8eejMUkjjL+Bp+JNQcOvG57wltpqJKzlQns0i/3r8w:misW74HvS2KgcMUyLQpG3Ov+7wlbq8zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281835, "uuid": "6a50661e-5f30-4b30-ba58-9ec5f5419c79", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281835, "uuid": "d1cee36b-f908-4b08-b3d7-1127d54f1f06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281835, "uuid": "87c51edd-2de6-4df6-a8c9-514e2b45d5ce", "value": "INV.ORDER.BOL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab6ed71-2d84-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634280594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280594, "uuid": "4375c349-aa4f-43e5-ad19-b0c443bf5949", "comment": "Malware payload", "value": "be19ba6e627b0cb5a1e4acb7c725a240", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280594, "uuid": "222a7252-381c-4254-a7a6-e59ff6c40fa5", "comment": "Malware payload", "value": "dc2c8a143099b03f2de31b05cf02a7dc68e88b330c8f5a7f9536c69963293380", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280594, "uuid": "5ccfd7a4-78f2-4826-935f-cfe161114d39", "comment": "Malware payload", "value": "5f4b437ce703ad85ec0d52a83a8f96c2f9491c29", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280594, "uuid": "4c53fc0a-1ca2-4d37-b340-666920e3ef2d", "comment": "Malware payload", "value": "62633483ad1a781cb5f9f9dceadd688d1e9e4c03a47bc773e1f166e07e07191a8067423562177591b08e9396bfc33b2e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280594, "uuid": "b1c8cb18-e213-4137-a6c0-e4d5b9651aff", "value": "T10FA423420C9C79B7C0BFF53792F83A7EAB38E568251161AD73F4216D0ED6ED46786028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280594, "uuid": "ee0363aa-67fa-47a5-a516-48944846978e", "value": "12288:wbVQmt51spL11E3VShd+qr1svgrruW/a/xDRQqtGlU:w5QI5sJ1iVS/fr1ugryWmR9Qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280594, "uuid": "d8eed40c-75e8-46df-b6ee-8ddff8c491ce", "value": 454701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280594, "uuid": "e6e28ab8-911c-49ae-b6ff-fb9f010b9351", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280594, "uuid": "381e66ec-c00e-41af-a94b-b55147c0e595", "value": "kuronekoyamato.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262baa41-2db1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634299941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299941, "uuid": "19b08af5-ebf9-4007-941a-6ee89f2b3cea", "comment": "Malware payload", "value": "1da1b4819ab882bd0988046d759239c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299941, "uuid": "1aeaec5b-336e-43b3-8317-4b83aa7bde04", "comment": "Malware payload", "value": "dd0bbfb31b336a8bd2994f73720526c38efa7ddc89a15da5b326e2cd4ed4e295", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299941, "uuid": "07644361-c90d-4dd8-9902-b817ee6d36ac", "comment": "Malware payload", "value": "2900fc033ac74f49616b8cd01c4a7294c5408545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299941, "uuid": "c82e877e-7976-40eb-a133-2453a59d94d3", "comment": "Malware payload", "value": "06a00700c6ef826f55e6d4836311f973a9abb2078df265fe6704965576e6616b6bdf9c1fb198ea04db7a3fbfe42ded2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299941, "uuid": "790d25bd-aa9e-4307-9222-4fa0aa7dd642", "value": "T13B42BFC8BA06EAA6F6145CF27C2C45BC85DBF26F0A66307048E5B84CC6054AB0A4F7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299941, "uuid": "6fcec9d9-7cdd-4636-89e4-b49e572347d7", "value": "192:fTu2PzRurki7SLDLVpVovt9SbVySN6TQ3JuGpymy/qD1zIWRzYFbYWvpK9pY:flzEBkDOvTCZuQEkymy/Gf+3pK9pY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634299941, "uuid": "eb14f4b0-a346-49b2-876b-a0b3f4bac6c6", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634299941, "uuid": "5c488587-c82e-4bf1-ace6-a9432f1ea9e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299941, "uuid": "df0538c9-f368-4aa5-b8ef-14983e1f48d4", "value": "SecuriteInfo.com.Linux.Siggen.4218.2465.15859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f47de08-2dc7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634309405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309405, "uuid": "9c3208e7-a5aa-4150-8096-0c428682654c", "comment": "Malware payload (Mirai)", "value": "f075c11ceb1a2322f5ec6dce903a84d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309405, "uuid": "c31db396-5290-4efb-ae68-bff2b32f313e", "comment": "Malware payload (Mirai)", "value": "ded7087315009fd9de43d651e2d1c2c7e5c1b49b75a055264c6c589296b8d084", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309405, "uuid": "3b1ce74d-1b14-4873-a73d-97e3cf917c5d", "comment": "Malware payload (Mirai)", "value": "4e2a4a1c2fdee22d52986eddced3d437f569fd9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309405, "uuid": "7aae2e25-b299-4d9e-90e5-c394f604ec28", "comment": "Malware payload (Mirai)", "value": "5cb040acefa6b3b75fafa862743285430166c4021adc52fcd27fb80a3372070fee5abbbb1a317903db287e630e14a8a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309405, "uuid": "8cdf86e8-376e-4194-8bb6-92fdb9ffaf79", "value": "T145E34C86FA408A13C5C61B76FA9F424A33229B55E3DB73068D185FF43F87A5E4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309405, "uuid": "d2b2fce3-5da3-4489-a674-ba4539cb7af0", "value": "3072:nib6sxR464MBJYqNMLK0oNdqjn7AOytpkAMn7yaXWZ2M/9Y/r:ubRp4MDgn7AOytptM2aX9M/9Y/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634309405, "uuid": "24051e9b-e44e-4816-91a0-cb1a05adf51e", "value": 144087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634309405, "uuid": "5a2f7b2e-c4a8-4c58-b917-318c6dd7ef4f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309405, "uuid": "6cd9660e-b10c-4741-804c-ce81b2efa8ee", "value": "94VG.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55053caa-2db4-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634301308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301308, "uuid": "557facba-6707-4845-8c61-35320b1c2509", "comment": "Malware payload (TrickBot)", "value": "7bd7363c595f4ce687355078f265b00c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301308, "uuid": "e0c89654-6dca-4840-be0f-6ec21e50337d", "comment": "Malware payload (TrickBot)", "value": "df16e5de8f0a2d2dd9ef3cc8cc2b544840ade7aca0e9067220d512b2ff697f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301308, "uuid": "ffcdbe43-20c0-45c4-bb29-5fcbbbfe5d3a", "comment": "Malware payload (TrickBot)", "value": "716128b3759715ce50c81c612615485c8f85dc4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301308, "uuid": "2cb04c20-3d47-4c6f-879d-ae295df3aa1c", "comment": "Malware payload (TrickBot)", "value": "32d008511187bfaf3c55e78338326f133c648c2a0febd8f068bfc16bb26ebd4b1f8b9681307e6c168c147c742d20ca74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301308, "uuid": "7b8953aa-4add-48f3-bb37-f9dcfee13dfd", "value": "T1E225CE1335F2C83FD6B2D5314E652B69A6FAE9708F364EC72385464C0D349C68E3627A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301308, "uuid": "e445b249-a8d8-4b12-9a01-1cd85da9aac5", "value": "6084ff3a75cf24854dbb3116ce3ff740", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301308, "uuid": "88843684-d569-4af0-b43d-9b3dc74fcb11", "value": "12288:4G1nPQF6g5ROxYdmsugxjE5OCSLaN9PeJxD0k+J7tNB7SwZfClIEUfi59Julqgp6:cE4msuJOzDgJ7uIa56KUCU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301308, "uuid": "b082ba0d-341e-49c0-8472-645208868dd5", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301308, "uuid": "1bb88ce2-1cf6-45ff-82b4-0fd0d5aeba69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301308, "uuid": "0b907946-26aa-47f9-9c06-a5f73270c625", "value": "7bd7363c595f4ce687355078f265b00c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c039f9fb-2d85-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634281302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281302, "uuid": "ab308d82-ade9-4dc5-9861-acefc5c226f9", "comment": "Malware payload (Metamorfo)", "value": "d5c2375f81648c8bc467c52cfdb37366", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281302, "uuid": "b249f6c7-bff3-4df2-8945-af05fec5219b", "comment": "Malware payload (Metamorfo)", "value": "df45ff92cacd8cb1c8a6d300a094853db27d4bafc8423ddab6e2e5ba0c2f3c35", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281302, "uuid": "61012cd4-55e2-4489-9844-80d8ff10c206", "comment": "Malware payload (Metamorfo)", "value": "2acade95e1e9b2c87254576189f4ef23f2d175f1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634281302, "uuid": "0c2a6c25-dfe5-4d3f-a275-37191e0a1e31", "comment": "Malware payload (Metamorfo)", "value": "f05a24a527ae5c1b8592237d69835a9ad9948a920d11c40cb8506211ac37d53996d25c107b1745e43411a4a0b41a6fbf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281302, "uuid": "982756a3-6332-4f4b-95d3-5cbfc13a8bad", "value": "T1EC31FE092AD70726D3B3CF7A10B792424A76B852EDA39F4D41848AC90861504FC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281302, "uuid": "6e9a9130-0f57-4b75-8a06-5f9035fe3dcf", "value": "48:8PX7om/lMvK1cGxqtpXv3KaIqiHkb6NS6:8PLjdGK1cOqttvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634281302, "uuid": "e1e62a63-bf45-424d-9a34-70119eb2c684", "value": 1574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634281302, "uuid": "86c0031f-4cd4-49b5-9526-78dc516fc1a7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634281302, "uuid": "7643d1ea-6ea1-4338-9327-6cade24d11cf", "value": "Curriculo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711e2409-2da2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634293624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293624, "uuid": "992f09dd-3e7c-4c76-b809-e2550e8d2681", "comment": "Malware payload (Formbook)", "value": "5d0d79406f8e894b3146ecbbf8e27465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293624, "uuid": "795641d6-88d7-47c8-b484-8af07a604de1", "comment": "Malware payload (Formbook)", "value": "e36594f316d20c3f0fb948a9c12a0190b872265c7ba49ebb4ffab701f38bbdd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293624, "uuid": "f52f6809-5d82-440d-bff2-3bea92636ed2", "comment": "Malware payload (Formbook)", "value": "cdad223f57b289f0a31df86dc254e13325289f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634293624, "uuid": "3bed3c6d-e6d9-4624-8ea6-24d301c48c46", "comment": "Malware payload (Formbook)", "value": "c211b119f92ee41769c62cc863f9d8c1ff6ff6ff3f8913d2105f409bc93fb24f8b8d11b1f87c9e250d64c073f4ae59cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293624, "uuid": "ffc0637c-b2e6-4459-9bc0-daba22f42624", "value": "T152E48CFAD3D5653AD1233DB60D1746F5A48AAC312E795877EEE538088F367E430212A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293624, "uuid": "1cd2ef40-6f28-4b73-9746-33b39d1ca97b", "value": "12666343f95da9cc22c238274d75b6c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293624, "uuid": "3491ce80-324e-45ce-bcf9-5c6e22089233", "value": "12288:0SvSsA2JxPaLrNgLGKXhfLeoZ10VicVpS+SnqyUz:0AdLzPCrNgLfXhaoZuVTmpqyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634293624, "uuid": "6bfb62f4-4f47-4f21-9fd2-1beac44b459d", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634293624, "uuid": "f1d84d34-bd99-4c5f-9d70-4858e3803cd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634293624, "uuid": "c52794d1-e1bc-4f69-b084-f0da38addd69", "value": "p2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b431b6e6-2d8b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634283858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283858, "uuid": "d2c03568-1631-4ca1-ad56-2ed87efea4d4", "comment": "Malware payload (RedLineStealer)", "value": "ee903fe5cda8fc7a0305c6b374de5f69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283858, "uuid": "3711e431-3abc-4115-ae9d-38db2dfe786a", "comment": "Malware payload (RedLineStealer)", "value": "e3dc88957f69ac53592f805873d387d17843db4ec0a0fa3dfd833f0a7a4d387a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283858, "uuid": "bfd29dfe-0eab-4eeb-b165-458e2c634bc4", "comment": "Malware payload (RedLineStealer)", "value": "860520196bbb54e8ed18e4644394c9ca7826bc20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283858, "uuid": "bad6a584-4366-45b0-88f9-e238babb33d1", "comment": "Malware payload (RedLineStealer)", "value": "e1b5d3d1845dd12e7f1e4e41900a524587ae4c514d476ff4b670feab2ff6f1e7f8b10d74b674f21657c4fe03b1e73a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283858, "uuid": "c33dcb6e-e34c-44ff-846a-b85f3513ea9d", "value": "T1A7A4BF10F6A0C035F1F312F95AB5A368A53E7AA0A73494CF62D41AEE5734AE1EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283858, "uuid": "1ae8af0a-f3eb-4976-b52a-cea7a1e8252a", "value": "fca1d58205e9c77175b87324501ec95c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283858, "uuid": "49d0bf7c-59d5-476b-b40a-38ba8ea2c807", "value": "12288:CXUhm4mpWJexbM9uRA9TD2Smm4l4l/JQauB:qUhvJeI59TCm5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634283858, "uuid": "37d41cae-672f-4cb0-be35-cf21a8b468fe", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634283858, "uuid": "d5200fb6-6149-42d9-87d9-699eb37bc938", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283858, "uuid": "f17ba4e5-afe9-4074-a688-fe374a0c2519", "value": "ee903fe5cda8fc7a0305c6b374de5f69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6d09d3-2e02-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634334846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334846, "uuid": "d0e072d1-d6ff-4377-afd7-cf15c3e25dbe", "comment": "Malware payload (RedLineStealer)", "value": "83e60135c26872fa756fcb26553be6cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334846, "uuid": "eb53367a-7966-463f-b673-f2a1df1de164", "comment": "Malware payload (RedLineStealer)", "value": "e4331c8eab3a20db74f66603fac6ff6a3faca677176a4015dea2a4665fb3f13f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334846, "uuid": "62fbe98f-1ceb-47c6-b332-eed0be3387fb", "comment": "Malware payload (RedLineStealer)", "value": "3df616b4b4df6faba9373f78dac9a277c07cb26a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334846, "uuid": "73c05461-9572-4d95-abe7-3e41a0128cd8", "comment": "Malware payload (RedLineStealer)", "value": "2a7aed78d3a9b6d831b4e9bc0f077e8739ec76418e733094c6b4bb005bd9cb0c854f233740cb753c59f77e3087ebd1f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334846, "uuid": "8cb50f89-13d0-4492-9c8f-4d2bdc6ae0a8", "value": "T17364CF2179E0C473D47215310AF4DBB949BDB9200F5199EB57C85BBE8E303C2EA35A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334846, "uuid": "b2b17500-a453-4ad2-80f7-290dd72e6397", "value": "d86b72152e3eb79509e879927a109d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334846, "uuid": "26674161-19fb-4733-a900-6dcf705882fb", "value": "6144:bxMewvsdIEL4uKoo7j6O00kHjxAOUpYJRo9wMzT5uLbih5Ualsy:bx3msdIEL4uKEXHMn52tBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634334846, "uuid": "35f1fe15-1485-4e39-9813-30d196596b50", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634334846, "uuid": "d4da4ece-6ef6-493d-a037-1610997f90fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334846, "uuid": "fa7e806f-767a-4779-a8f5-a1a694408263", "value": "Mopes Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94732570-2d97-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634288959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288959, "uuid": "744d3984-33d0-49c9-ada3-7b47ace68f80", "comment": "Malware payload (AgentTesla)", "value": "91b12e9726457f2c6ad29b8b27bf7e3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288959, "uuid": "85aed6b2-c9c8-4fea-984d-f594755dcbf3", "comment": "Malware payload (AgentTesla)", "value": "e4a297a62797d50a37f87d75499be34639395d4791416d2be66c0e3c6a43a8d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288959, "uuid": "803f7c32-f767-4902-8477-52b2fae838cc", "comment": "Malware payload (AgentTesla)", "value": "03406222c3cc95e03736a5844e31975b714758dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288959, "uuid": "81ae4c40-eed2-44e3-8298-047182727f90", "comment": "Malware payload (AgentTesla)", "value": "edc3e31f844e37e1ed51b66f5422189056c10784420dfbdcca065c059aa69bd16a44b2e8cfa17dfa43494e9ea56ce8df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288959, "uuid": "ecf090ed-131d-4952-a15f-2cf0c39b6267", "value": "T10AF4B459F342AC0ED457557354E458E3A1042CD7E8498339EBB3BAA358AE3814F4CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288959, "uuid": "4b21e2c5-b546-46e9-8a7c-a83cd648192d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288959, "uuid": "cf2097d7-97ee-4425-9de1-e73ad4070eec", "value": "12288:08PJTyqnUB9q1onG07lVcKmiqYmKVx0MorN4nSSjj:fTJUBFTpVHmiBVx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288959, "uuid": "ec51e62c-9642-42a7-aa08-302d7c01da8a", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288959, "uuid": "ecc88af5-9983-4cb3-b87a-6afe2bd9c930", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288959, "uuid": "1059ab57-b34d-4ceb-9d1b-19767e578b73", "value": "BND28384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbd7d30-2d92-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634286908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286908, "uuid": "5909f600-9f4b-4613-9aaf-817de8d97b9a", "comment": "Malware payload (Formbook)", "value": "87cd2ddf31c62ed3219d2c559d4a9cb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286908, "uuid": "4d262f09-58a4-49c0-9cc0-194235129ae0", "comment": "Malware payload (Formbook)", "value": "e4a4e1f73cbbd5667b5264b48bc7429ea638532d08e78d53b86b86c0fa5b291b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286908, "uuid": "e2cb8259-ce03-4d4d-8f5e-8d5c720509a0", "comment": "Malware payload (Formbook)", "value": "778feade270eae6041a76bb962c42b5b85d9199d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634286908, "uuid": "31c0e678-94ea-4ccb-8cd9-66ec7f0d84ba", "comment": "Malware payload (Formbook)", "value": "ae26ec2e87646fcfe60fa9444f0ea259238eb519c345b9532a740f15ae8e6427325ae9aec3d0fd1309f8775e282e3d7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286908, "uuid": "58e92f80-e75b-4c05-9b8f-09e0ea4d2e75", "value": "T12A84F10A735D991DF7784E756C9D811CB26EDC92A5C2FA4F9587F09B88E23CB14023CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286908, "uuid": "da68681b-a1b9-4c8d-b628-300c4b698e87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286908, "uuid": "211028f3-5e1d-4f31-837f-8b745c30b506", "value": "6144:bjaohYpyMkhBTJKLDW5dhpTTsdXJWqAIdYrSLdal3tUC80o+cCBtQsIAUVru:PaoYSBTJnhpUdZbverSxtC8Tc6uIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634286908, "uuid": "f14c61e4-e6cc-4937-904a-ecb4e900cdf2", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634286908, "uuid": "69294838-6ad4-4c22-a878-bc75b516d1c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634286908, "uuid": "4ef91b9d-5400-4a2f-a493-312153862abe", "value": "87cd2ddf31c62ed3219d2c559d4a9cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f3dbd9-2d62-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1634266168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634266168, "uuid": "8843f5e9-6054-4cea-96cc-f31806d16913", "comment": "Malware payload (Hydra)", "value": "17fe5d41d3ddc9ae0fd5a50ddefefb58", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634266168, "uuid": "8797bc97-473c-4258-95d9-8361161e95a8", "comment": "Malware payload (Hydra)", "value": "e51f32dbe18d52eafe2ac65f77f84450fd279fecd0278b0df95ce654017dddd2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634266168, "uuid": "f700ccf2-3c88-46d5-9b97-037af31303e5", "comment": "Malware payload (Hydra)", "value": "c953103f0d0464e5c6f4d904daf0acd07fd9e086", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634266168, "uuid": "0800e296-bd24-4cd2-9bc5-2ae214db885b", "comment": "Malware payload (Hydra)", "value": "a417256ffb68b53bf0647b42fa016db133a0271d7122a34a6b1050f14a0a5f4485d5d8a579d6bc5702e4f97663ffb5c2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634266168, "uuid": "4c764f0e-cd0f-4021-9610-d5845868f80f", "value": "T13B76338AF6D0A383F735693864D66BC033400A573581F07798986FD8597AE8F3F5289E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634266168, "uuid": "f914a706-4afd-4d94-ab8c-ae900e570592", "value": "196608:eN+PtKEVaWuAnbP82FO/i1DWx0RiQdyjynFAL9d3l:eNQ1VaVAnbPrOKJWabyj40hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634266168, "uuid": "c6cec365-cd5c-4680-a3c0-2f34914bee06", "value": 7693386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634266168, "uuid": "1f093769-5803-4fb8-812f-21ee99de66cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634266168, "uuid": "13a75bf6-8fe3-48b9-8f23-7728b0d7d391", "value": "81295_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a0a8ec-2d78-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634275616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275616, "uuid": "0cee43d8-1275-4623-9b57-630bbb5f721f", "comment": "Malware payload (Mirai)", "value": "ae96e14d91d236f0d55d66dbebc016b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275616, "uuid": "1f4b5781-8059-47c3-a149-376ffe92a2c1", "comment": "Malware payload (Mirai)", "value": "e5ae5de3144a72228eb0733171d630eb5a284749f52fb3c2e76e72636a0f4c3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275616, "uuid": "7409be97-e2a2-46da-baf9-1e5650f4e350", "comment": "Malware payload (Mirai)", "value": "efcdba58b1f6aed61a0db7ae6e65bdff45179740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275616, "uuid": "8b52c8c3-f550-4408-8453-bc7ddcf0f2d5", "comment": "Malware payload (Mirai)", "value": "18c0378320b2c51e617a0ecd711d28ca4353e32dc8a6f3746df1e5907f1cc8917cb17d6bf2273875ed71d5defddcf61c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275616, "uuid": "c9da0b87-87c7-4b80-a444-186c76621146", "value": "T119A2CF306604DC75D7F10876FABA8AD72E572E7172A8717327202E7476DEC6629B8880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275616, "uuid": "d5367bc7-e967-4170-8a2f-734f66334f9d", "value": "384:Ul2HHc4Jn/LD6xS9ktSqnm3mA5fQpnn/hymdGUop5h6:St4Jn/SJ3nKmxpn/s3UozI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634275616, "uuid": "76400303-c3e7-42a6-ab18-616e20f37f95", "value": 22480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634275616, "uuid": "4729c146-3fb1-41f4-a44e-28797617ce92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275616, "uuid": "ed6b842c-e358-4346-9d9b-8b7c6300a935", "value": "ae96e14d91d236f0d55d66dbebc016b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac1d392-2d8d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634284514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284514, "uuid": "832d48bc-c025-4f9d-9c57-d213717bca71", "comment": "Malware payload (AgentTesla)", "value": "70ae2bcf4e1ca6a2e4df97d690f90265", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284514, "uuid": "7c412b3b-046e-4afd-ab17-63114147c505", "comment": "Malware payload (AgentTesla)", "value": "e65c580c2e9488a5b1d663b83bc321cfc2a0ad030381f3e16ee38665f9006e00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284514, "uuid": "1bd14013-74f8-485e-82a4-f601f46c09a0", "comment": "Malware payload (AgentTesla)", "value": "a0c7f3398108aeb1d64b84edae64ea998fef30dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284514, "uuid": "b5975dba-07b2-403e-ad05-2fb329c68687", "comment": "Malware payload (AgentTesla)", "value": "d00488c671542e001865b5ce244b5715cd107b9ec86ab461c4c380a71c27c124ab8b68dc730ab51600fe0df8d5a59fdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284514, "uuid": "8b5b3aeb-ff08-44c7-a3c8-029288545014", "value": "T12F741201BA9CC93CD19682BFEC9F850203FCA5927163AF5F285D33A859167FA0475ACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284514, "uuid": "2493902f-4a73-4550-b800-e705b4de8184", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284514, "uuid": "6cff8ef0-0af6-42db-af5f-ce3e33e5b820", "value": "6144:RpW2pba1MkhBwvoCmrJSvvUNk1IbeWlnvayGBLMVjU57zB6KPQS4x3f:RpW23SBwg/MHu3bCCe7oxSWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284514, "uuid": "7e807c19-ad0c-4f8e-bcc3-ffa7326cb832", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284514, "uuid": "88715cc9-3ba2-4749-a890-fcca0cd5cc9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284514, "uuid": "e747d97a-e2bd-43ca-a2fa-7e2b9827c896", "value": "2021 NEW CATALOGUE-Eaglesmounts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb46671-2d7a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634276330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276330, "uuid": "a1fb8f62-8f7c-4ae0-91e1-89239dbef231", "comment": "Malware payload (AgentTesla)", "value": "5fbde32f923edf89d89dcab60b07fd86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276330, "uuid": "751bee47-b10d-4f7c-9f60-87f6a34f8a37", "comment": "Malware payload (AgentTesla)", "value": "e6b35b0c81fbe9a13602d49d28b382c697263672a937486910073fcb54e3b1b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276330, "uuid": "a5a9736a-3f2e-4920-bff9-2ed79d4445a2", "comment": "Malware payload (AgentTesla)", "value": "dfdd545ca3b31bf3d74bfa1598ffb2bbac987dd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276330, "uuid": "a04f93fc-a4e6-4ce7-8ba6-82d00b499a29", "comment": "Malware payload (AgentTesla)", "value": "4d1fd0024c9794d5118c0af2275df7e97913f44575019858064a46db1e5725a84bcc009c2dc4dca2e6ad76b6bc99d694", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276330, "uuid": "ac3f99b8-5275-4865-b68d-c7ee222d6b62", "value": "T107B4CF647F89D94FF36A9CB81231DF84CA3D654B3713C629D9BE507A92987843DC2283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276330, "uuid": "1dfa7c9a-c433-4b7c-976a-545bbaa0cb5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276330, "uuid": "824120de-85b1-484c-a624-74069bd31f3f", "value": "12288:mySBeyYq6YFBpaIq8kA6UItMjk/l8tIR:wBdYZYFBvJkA6HIMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276330, "uuid": "55abbabe-564d-4452-b107-84d6f8efef38", "value": 524800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276330, "uuid": "5a3b25ab-e66b-4526-9ab1-a8da7f3ed872", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276330, "uuid": "342d8c68-d06f-4310-b3c8-50f035e20956", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070fa55d-2db1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634299889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299889, "uuid": "fe537cb3-4f55-4187-930c-399a85b6ea59", "comment": "Malware payload (Loki)", "value": "89fac08711068429849bba8ba8b35fd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299889, "uuid": "690937d1-d479-4027-a09f-00f6acec251d", "comment": "Malware payload (Loki)", "value": "e740b380a6f54c3c93d80cb9c943e92d55f4d505060aceb82d84da65163e51ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299889, "uuid": "f6e98b0a-00b7-449a-aaf9-681a321bc96e", "comment": "Malware payload (Loki)", "value": "a09078280633daaa17da7072c805db9be24f341c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634299889, "uuid": "82931372-59ff-43f1-8fe0-613d0403bc55", "comment": "Malware payload (Loki)", "value": "315f45afaea819618aa563d9cfa4f5bd30800909be525dd828f8bd1b1679046ccd34a0383a5957ffffb76e17dcc1fcb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299889, "uuid": "6af01829-b223-4d3e-b051-b5e6f1293c33", "value": "T1C854E116374C9A1EC2361F3784DE001D33B8A952B8D2FA5B6ADFF2D718A63C305515EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299889, "uuid": "2d9a8b64-eb6f-4432-b3a4-65cbddab5793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299889, "uuid": "086c576a-33ff-4f17-9737-8213838d4cf6", "value": "6144:lv1AVMkhBK0ee+0bojzYIwEHUlfEQdGnKWAmW6x:8OSBzbEjzNHMfFGSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634299889, "uuid": "2ff88c04-823e-4e56-aace-b4e1d8879454", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634299889, "uuid": "27d0152e-38b3-47e4-af7c-14de94dd4c00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634299889, "uuid": "2319d44d-1f6c-4b9d-b280-6392bbaf927c", "value": "89fac08711068429849bba8ba8b35fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaeda885-2d93-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634287279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287279, "uuid": "6e72447b-3796-43aa-afac-785ba8f61a09", "comment": "Malware payload (AgentTesla)", "value": "ccb484fb7649c034c2d0b77d464bdc11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287279, "uuid": "9cf64e8e-590d-4aeb-9584-2d8eea0006e0", "comment": "Malware payload (AgentTesla)", "value": "e783beaf61c430d61faec9757962fc8a5314e850e587a7e59dea952f8d25bc97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287279, "uuid": "140501d1-f71f-4b89-9426-5e26a2afe5df", "comment": "Malware payload (AgentTesla)", "value": "3b4b0feebf51a3b8396f4bdd19704a7cf7ab524c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287279, "uuid": "62c947f7-7001-4fd3-884c-7b3d8559e621", "comment": "Malware payload (AgentTesla)", "value": "9bcdc220c1be1d37993515b47af4cdeaeee1639293e99678ea28c5cc2f2377a671c4b784f136d2e19019ec40d4789603", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287279, "uuid": "4c3ad67c-aa74-4390-a25f-6a0d97f5b52a", "value": "T1AC15B555F3429C12E45B167354E465E391082CC6E8988338EFB3BAA358EA3C45F5CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287279, "uuid": "77a16afd-0b85-44df-b46a-cf18f8825365", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287279, "uuid": "f61fb0db-49a0-4b80-982d-51067c6b2093", "value": "12288:Vvf36eILJk6QgMe7+C6/wBYJj4Jry3Bhw0aU:BINk0+/0iEUBhw0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634287279, "uuid": "22e03c2e-feb7-4981-a6d6-483e127d6747", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634287279, "uuid": "f4dfca3e-6661-4c82-9663-cd49b5ab01d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287279, "uuid": "ad202f0b-0da9-4377-9cf1-8c9f12fcaf49", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc37233-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634300677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300677, "uuid": "1e948c95-bd3b-484a-8b9d-e605a42f9ead", "comment": "Malware payload (Cerberus)", "value": "0c266c61ace74fd4950d361b023f0265", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300677, "uuid": "b00a14de-3f18-4dc7-ac1d-52787da159c1", "comment": "Malware payload (Cerberus)", "value": "e8b591d2678800298512295002a936d4850bac44d4f76908b38bb2b616ca2ff6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300677, "uuid": "ef0d9ac8-6f68-442a-aeaa-d35de85344e5", "comment": "Malware payload (Cerberus)", "value": "63c4d87d4496484375d708e808859e4e511eea36", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300677, "uuid": "a78474cf-f2b3-4bb0-8667-acd10ee8042a", "comment": "Malware payload (Cerberus)", "value": "c48346c2036ef43b7f2399dfadb0095fecc3864984fceb6f1491c2b92e4f6f9133e339f18e58b4e5f275c33a6f2f2bbe", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300677, "uuid": "19343e2e-a070-4660-8a54-9fd0254e2257", "value": "T1163412979BB4661DE0BF743025FE73BE767F066462E492F25E3410384C63A921FE8849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300677, "uuid": "ac3db1cd-ef6d-4d6d-aab7-078b3bdea67b", "value": "6144:ehh0TJcGk38D0LHZ2ljU4DQvsAA46cWNORuVBAP40HWNOR1o0BABl:eH0Ffk38D0LHIj7DtAUNORu8PeNORMBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300677, "uuid": "4cab2b59-6bc1-4e2b-90ee-78aa16474607", "value": 246803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300677, "uuid": "903305be-f6c9-4e79-81f4-34b2238dadcf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300677, "uuid": "19c933d6-11cc-43df-a93b-23abc2d53c41", "value": "Android_Guncelleme_build_flow.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c141a8a8-2d8c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634284310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284310, "uuid": "997f4c34-c4ab-4826-b9b8-dbff8f4f3b2a", "comment": "Malware payload (Formbook)", "value": "57ca391bdad17bf09e724a84f970c0fc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284310, "uuid": "e5617c92-9876-45df-9d36-14f3d424978d", "comment": "Malware payload (Formbook)", "value": "e982c63be9c5eb7defc0ddbf72d27a5e6ea2fe2c050777595a831470ca9aa31e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284310, "uuid": "4a41dd0a-50a1-41ce-a18e-16b57c14a375", "comment": "Malware payload (Formbook)", "value": "904a76bc1ff25510f2b3cf61bf256202e9aad704", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284310, "uuid": "cc789c89-aac5-4e74-8773-038aa04c5bdf", "comment": "Malware payload (Formbook)", "value": "f91cde5045d8d86e7c213cb8fb6ba9aecdcd8a969770ff133e3de242a0bac54dab970b9733c321f929ebe041e19892e8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284310, "uuid": "d04d0689-5c2c-40a7-be99-1f4aad6ce0cb", "value": "T1F864231CE7B27AD7FD44016EC8090E19B289E8C4D95CA48DF1C55A702CBEA7E93A5DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284310, "uuid": "ab7494bf-2caa-4f3b-a2aa-19d8cf014588", "value": "6144:ukG6ud753dnnkfm343pph3FObmppjuVfodvTGjmVkDXH+B1eQO/rPcGpP7R:urjNnnkfm3eX3FOypmfUvCqqTH+3eLD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284310, "uuid": "932b0266-5e75-4ca2-a1ba-69ffb91680c7", "value": 332671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284310, "uuid": "ec87c5d9-0674-4b7d-ac19-8e775d95a013", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284310, "uuid": "5a1fe5eb-a326-4ec3-a866-2ad4dc7fd126", "value": "Unpaid invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0d1147-2dff-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634333452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333452, "uuid": "5531fa17-550a-475d-a0d7-33870d6f183d", "comment": "Malware payload (RedLineStealer)", "value": "7f7a2ebf1605906166308d4db85ae471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333452, "uuid": "96b69cb3-f5e5-4dda-abb1-aff942052698", "comment": "Malware payload (RedLineStealer)", "value": "eab8a726a8ffe7a0df384de022b4fd0f6c617b77e6bcd5ca69183564683803d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333452, "uuid": "35a6fbb2-fbc6-4302-871a-769f5c8cc08f", "comment": "Malware payload (RedLineStealer)", "value": "210a8023d2938a53a87a8c35a7fadd24dd8bd7fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333452, "uuid": "28a802e4-526d-4de1-91f7-c4e27d433d7d", "comment": "Malware payload (RedLineStealer)", "value": "2377883ee1188d2bdfc98e0ec176950f3e418434e7243091798fb80c8aff0bb88e401188a1e5b65473b88fc9e511641a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333452, "uuid": "11e4dd6b-2af4-4e18-a2a5-be7962d5e9dd", "value": "T1BD74D000799D8872DAB61D320975EA7A056CB8350B5F66EFE3C4097F8F342C05971AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333452, "uuid": "01782284-8abd-4bc8-96e6-b60923f27283", "value": "11d76051ddffff525e66a516932d4841", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333452, "uuid": "f1b4398b-0890-4a8a-aeed-fe02f83de3d5", "value": "6144:2NzlXTh439rDtCvzzKGsqfccbiJpyAONGHcgNyOQo+hAYbn6P2iPl8CRT45CUP:2FlXTh439rDtXglKccHQo7YuP2MbbUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634333452, "uuid": "c98d457c-14aa-4598-92d1-0b09377cdc31", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634333452, "uuid": "629301ed-b8ce-4ede-9b8c-66745b63459e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333452, "uuid": "d1d13723-798d-461f-b665-b6c99258d03f", "value": "FANDER_MOD V3.03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33e9b44-2d89-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634283105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283105, "uuid": "7be8e848-57f6-4452-aefb-e72caa7e3a54", "comment": "Malware payload (AgentTesla)", "value": "9033efba933618a3010b49f3f045a721", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283105, "uuid": "29052832-875c-4007-9efa-e5c9d3be064b", "comment": "Malware payload (AgentTesla)", "value": "eacaf43707c5b9e87f26bcbb36dfc1738f0f2750f1418fda1dfb3fe0fc1303c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283105, "uuid": "dd0a4fce-bb49-4f28-a3e3-c7b5e78b8767", "comment": "Malware payload (AgentTesla)", "value": "8c8043fbbbf100461bcbe67d660596ebb21c265f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283105, "uuid": "bd1beb75-fc4d-4d1e-b880-5e6621ddee2f", "comment": "Malware payload (AgentTesla)", "value": "48406a3c92ba400b453119ab8a546edb8756ea279d4b43d1e60a5cb69963dd5a1f2e1969e2ea4e1101519e243a114109", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283105, "uuid": "2c4ed48a-92d4-440c-baae-a9209936efcb", "value": "T18654231707E046E004E09416EE74E298D74E6625FFFC9B4D0347FE39ADEAA125D84CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283105, "uuid": "2ff3591b-19ac-418f-b00d-8837a60f406c", "value": "6144:l3pvmPpNBYRUxh/PMmnHR0uBAGbcV5EhgHEytZ7atFx:B9G79nHR0uBAGcat/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634283105, "uuid": "5be0c8bb-4a89-44c8-9d9e-371a07b4f191", "value": 297494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634283105, "uuid": "702b60e2-d383-4f38-9f5c-3535a536076a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283105, "uuid": "32c917df-3383-4154-b425-f3202ed12fb9", "value": "SURRENDED HBL CNSBIF0825IT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0720d5-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634300890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300890, "uuid": "958c1ae4-bd0e-4424-8806-826e310cbb43", "comment": "Malware payload (AgentTesla)", "value": "36a97db8ddb7aaeaab114d2710b5749d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300890, "uuid": "89cfdfc6-1ff5-4ed5-84a4-7594286f89b0", "comment": "Malware payload (AgentTesla)", "value": "eb11606d5ae9c09afd29d60ef54f96896b66dc620961b3bdb3814c5b45ee76e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300890, "uuid": "5566c49d-a6ce-4278-9184-b5acd06167fc", "comment": "Malware payload (AgentTesla)", "value": "3b4db4612baa55b1b398c1283bb34998cd35848d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300890, "uuid": "0130d335-4c94-47d8-8eef-9d3f8e8df67a", "comment": "Malware payload (AgentTesla)", "value": "c65af9434ccb12e18d4a42b42b186c70241f58a1815a02d2d3c28bad7ae00cf829d9c4fa6e0126e4d3dd550f9cbf6c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300890, "uuid": "005479d5-cb83-41a6-87bd-04fd1a771aca", "value": "T1CAE4A415F343AC12A457567354E451E3A10868C7E8888378EFB3BEA358DE7845B8CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300890, "uuid": "dcfea59d-bf1c-46fa-9b59-69cb85fed273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300890, "uuid": "b50f777a-d0e3-4e46-a0c9-f41cc0137741", "value": "12288:Vvf38UILXb/bYO77Q/MDJA3H86wG5ESwtajIz:NI77bD77geC3ZPESwUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300890, "uuid": "a98f53e4-ad08-4285-841a-b602d5c963f9", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300890, "uuid": "d8132f02-024e-4453-877f-16f080f9357f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300890, "uuid": "fbb592ac-07c2-4d24-930c-80c533e9f415", "value": "TNT shipments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85dda20b-2df9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634331025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331025, "uuid": "aa5815a4-67a3-4169-828a-cc50cb173e8e", "comment": "Malware payload (Mirai)", "value": "a0b7a5b61679a69b1b4fa7bb39759533", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331025, "uuid": "8d7269bc-96c6-42bd-bea2-978bb905697e", "comment": "Malware payload (Mirai)", "value": "eb89fcbf84d086d325b0f294f0488e6da4eb9d0e12727fe5642dce014f91c201", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331025, "uuid": "f143beb9-f434-43ce-967d-0a5f51f05ded", "comment": "Malware payload (Mirai)", "value": "cf5cb6f7da7aab6bbb9beba3a23fdf61612eb5c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634331025, "uuid": "a5154562-a684-409d-ae0d-930050bc3977", "comment": "Malware payload (Mirai)", "value": "cf642863d8ef3e9bada63a5508410d9d40727fc5ec36ec0b15689fca1684723cd09399c17f4b1985c211ac7fbae5bd28", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634331025, "uuid": "af313a6b-7fec-4e18-a9f4-eae57fb0794f", "value": "T13333011D2F83D949C8606FB35D08AA86F5C6EFE8D11F14AF095C06ACBC03E9656744C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634331025, "uuid": "2a3bd149-3fb8-4909-8d2a-c3d723bdb958", "value": "1536:qtYS0oEIkutWPXqMRiQAeO7eJcLE8Ls+gIERs2rzet:qtYVoEIkuwPXvRZuLE8L7gZRAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634331025, "uuid": "2852c10a-9bae-4237-b17d-d048cfa9f00b", "value": 54484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634331025, "uuid": "82005e49-9beb-4a17-866e-eed8d0bc22e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634331025, "uuid": "997b0343-7162-4f93-84b8-e6d5794bf5e1", "value": "ii.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39a55cf-2d84-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1634280931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280931, "uuid": "33e3895e-2fa9-4191-987d-693bf43871cf", "comment": "Malware payload (Vjw0rm)", "value": "53e80f5441f77abf03ac535d2ea55327", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280931, "uuid": "2fdf1bce-8084-4fc0-8895-2b0a18282b73", "comment": "Malware payload (Vjw0rm)", "value": "ec12c4a76b8aaaae0bc169b3a974d0b68dda705150fac4dbecd26486f157c039", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280931, "uuid": "cb09d8d8-8d2b-4256-8000-c277757bb3f7", "comment": "Malware payload (Vjw0rm)", "value": "d1accac81fc1e6afaa92a563bff1cd124dbc7ae2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280931, "uuid": "f5c1ef43-d32f-4d61-bcff-5560d485abc8", "comment": "Malware payload (Vjw0rm)", "value": "89e9404f91098a2d0a301cd85bc624bd964293a20ee5b2a883bed4b01c33a332b8d24baf98b24e758021e3310340bcf7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280931, "uuid": "c9693919-511a-4604-8fad-ffc4af8475ff", "value": "T16AB23ADC3811F2DAD1B1A664A47E6ED89BF8121BD411278E382E77408F35690D79EE2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280931, "uuid": "de029a82-6f7b-4ddb-a07b-614209f2e288", "value": "768:h+lwW2uGBtTqK9XU2xWBxFibS+YmOcZ27oxEHSaBfaXD:4lWZBtJrsQbymJZ27oxElSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280931, "uuid": "e122715f-2480-40d4-9020-9014ba937148", "value": 25427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280931, "uuid": "5c929036-b9e2-4f30-a3ce-78188a9a76f3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280931, "uuid": "c793b0d5-09b1-40b8-a628-edf5436fc27a", "value": "eReceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2812c3fd-2d7a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634276322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276322, "uuid": "db4fa917-6c42-4daf-9333-131f4a159524", "comment": "Malware payload (AgentTesla)", "value": "0a8bed02098a13389f0c54ac46e83a35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276322, "uuid": "676a7786-c00e-41a9-8033-93c79c80d76c", "comment": "Malware payload (AgentTesla)", "value": "ec1ebb7d6744634e8f82e87c03e821a90e84ea038760dbec89e2c75ede498547", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276322, "uuid": "beccebd2-725d-4156-b4c0-5272672b9a32", "comment": "Malware payload (AgentTesla)", "value": "dc78b64923e2b37ec0013d3d401b6e95abb42dd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276322, "uuid": "3028cc95-2d1b-4270-9840-009826aa22a8", "comment": "Malware payload (AgentTesla)", "value": "018d393dc253e4f094eb0096bd96eff2579b4528b2683ca3bef48e0f3fbd4c3cd2ca97b3058b296dafbfca12f3f5093f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276322, "uuid": "ec56c44c-7acd-4807-a115-7f88e2113017", "value": "T17A842314A0A26F49F7C5316FC112717FBDB3A488CCA690936DE99CB5DD770809B3A728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276322, "uuid": "09d446dc-f55a-4b9a-85ac-d3dd3f461a40", "value": "6144:uP/L2N5f2RNHT462kisWaX2C5sZllVQlZe6zuOMGxSwq2hnv/+gi4Dpme8txcX+:2/C5fSFjisnb8PVQ/hzuObSLG/n/V187", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276322, "uuid": "5bb646c5-2144-45bd-b8b3-18e0be92939b", "value": 392342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276322, "uuid": "312775c9-131c-4e22-916d-e168ce4de770", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276322, "uuid": "bc4e29d5-b31e-43c5-aebf-582c25584ac9", "value": "SOA.UUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d005ab1-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634300919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300919, "uuid": "2a8e1489-2133-4c8a-bf38-c1c510be394d", "comment": "Malware payload (RemcosRAT)", "value": "671887f69ef34ed7729ca19ca070f70e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300919, "uuid": "6b447724-f33f-4dfb-bc68-4c41585fa38e", "comment": "Malware payload (RemcosRAT)", "value": "ec8a52d55cce244ac7d599b9a54b6aae59b73224f6b379c9ab999ab2a567709e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300919, "uuid": "9b3a851e-e3c6-4a2c-8635-12f909adba8e", "comment": "Malware payload (RemcosRAT)", "value": "628b2133e6ed21453e058072cffcf2ccf2f794dd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300919, "uuid": "039bacec-32d0-4545-907f-f951a8d9fed5", "comment": "Malware payload (RemcosRAT)", "value": "cb2c7a5144e4784160bd576b2b9907517b3f0ea030d787da3e91d5b262d3e3182fc889dae3ce0a292c22040a1f282c7f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300919, "uuid": "b85b7161-5007-4913-b72f-7ebe7b5413f6", "value": "T104E49E778BE00B7EC5A76C3EAC274158185B3CB506A5245A3FF9EA1F473B54A3836087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300919, "uuid": "9e8f8879-c39f-4b7e-8a6c-270ebdf842e5", "value": "12666343f95da9cc22c238274d75b6c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300919, "uuid": "2ab8be63-8583-4c4b-9543-bf58c3b04fe5", "value": "12288:0SvSsA2JxPaLrNgLGKXhfLeoZ10VicVp7+SnqyUz:0AdLzPCrNgLfXhaoZuVT/pqyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300919, "uuid": "b100ae16-8a35-45ca-a531-75a9c0e3a334", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300919, "uuid": "e5339bd4-b92d-4382-ba6c-5cd04a5b342b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300919, "uuid": "fc2ace50-c1f9-4fb2-b61d-953e89a989df", "value": "Documento lettera di vettura Dhl,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e8dd7c-2d5f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634264745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264745, "uuid": "866c6bd7-383d-4eb1-8378-8d03769b44af", "comment": "Malware payload (Mirai)", "value": "ac32893d9877ff57952dbd529acba238", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264745, "uuid": "a7daa0d0-322f-4736-9dac-d46e01db157e", "comment": "Malware payload (Mirai)", "value": "ecbb26a7448c23b94c0bac7bd09cfe29dcdcfd3317409427c5fe75357bc8d345", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264745, "uuid": "3dccaa65-4f2a-4a1b-8a3c-d70794e4d007", "comment": "Malware payload (Mirai)", "value": "543be5741be3f26ae02aebafa116cc2f5780752e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634264745, "uuid": "5e6a67b4-7738-4915-96a9-68c506cf5bc8", "comment": "Malware payload (Mirai)", "value": "39131821c2feeebe7ee0cc826caa7617308e1064dd6ff46d3de32653d14c44dc947ad41faa5807fca705b5678321a266", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634264745, "uuid": "2b2028bc-107b-4e6d-9cdb-41651af8655d", "value": "T1F4338DA5C4B9ADE8D2148E74BD258E788763E100C6932EFAEE4486599047EFCF1583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634264745, "uuid": "ab5517b0-bcc0-4d7d-b6f8-6e34ec3f58d8", "value": "768:waIwqwtOZc5p3hnYep3v0Gvdn/fAPs3g58cAlOSpE4rC/oIaNCy:wanqwtYduxxAPs3gvAlZpEyvLNCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634264745, "uuid": "a4a05b61-0e24-4e04-ad62-76b1dafe5da3", "value": 51072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634264745, "uuid": "5b9dcbe1-cb4e-45c1-a741-621d30115ae0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634264745, "uuid": "7dc6453e-0fbb-48cb-b432-b5445cf28825", "value": "ac32893d9877ff57952dbd529acba238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732f2b7f-2db8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634303077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303077, "uuid": "32868e0d-6e19-46eb-be19-af8c9f56c3dc", "comment": "Malware payload (AgentTesla)", "value": "9200057f9ec9f3b30d3ae308c57a4485", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303077, "uuid": "511d1131-5b89-4b81-80cf-287a8079dae2", "comment": "Malware payload (AgentTesla)", "value": "ecd0eef71657869c11e2c9249a767d89d49c9d6c4f685002c6466524c9947f38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303077, "uuid": "aa63848e-d37f-49c6-8bd4-5fee166a0c92", "comment": "Malware payload (AgentTesla)", "value": "8605545500a19b12b05026820e2c971c23fc2856", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303077, "uuid": "2fddd610-2fa3-4483-88d1-c1f7a908ffac", "comment": "Malware payload (AgentTesla)", "value": "6777746d7ce4f116b627edee7b731eaf84ccce75f2f987dfa877dc1bd6fc421ecf6e4e64f0de474fc1e36210843c7a3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303077, "uuid": "761ba3ba-0d53-42e8-865a-a88a3f1fc6ba", "value": "T15384121036ED438AC97A8B389DB6029523B57BB7BB01D32D7950628D9E3334347527BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303077, "uuid": "878f5525-7808-4320-96d0-57d1ad8d6ff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303077, "uuid": "1fc84f61-bb35-4d2a-9786-8b688c60aa30", "value": "12288:dSB0M7mqjQCuvjJ8+Zxrig+76oVXruj1BdEl1pR2:QB5R+ZRiRlVXSBSLp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634303077, "uuid": "d71d7d80-5f3a-41ba-85ec-18829982fce1", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634303077, "uuid": "81d2283b-2196-4da5-82c2-fed6c6fa608d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303077, "uuid": "eb82ff5a-fa04-4b8b-acf8-5aad9855b726", "value": "RFQ#CNXT-HG20211013-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ee26a5-2d7a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634276375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276375, "uuid": "eb6ddfdd-636f-4488-951b-d099a7e984bc", "comment": "Malware payload (AgentTesla)", "value": "046309626e33ad4d0fb4f4937f643fb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276375, "uuid": "160f08d1-600e-4dbd-b43b-d78767c91fdb", "comment": "Malware payload (AgentTesla)", "value": "ece73ec955293ab06c24d68c3813eeadcaff7b169953744859984cd4d51d30f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276375, "uuid": "2caa9080-1e05-404e-8a97-716f210eec3b", "comment": "Malware payload (AgentTesla)", "value": "3a2de014894f2d44f7bebe8b2a55f22d54e02170", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634276375, "uuid": "a3f1d2aa-a4eb-4111-83bd-ae2c51f77330", "comment": "Malware payload (AgentTesla)", "value": "9e2c38f7dab6c5b3782d8d537e8c77d60d2a7d4ba6090ab0922656d9ffd546e472146dee981419ce0b056ddb0325b5f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276375, "uuid": "adf5b964-1444-46fe-8e67-31ed6a884b28", "value": "T14E94027036AE5309C93B4F39597A52C217B8B6A9BB01CF1F3468228D8E737438B51767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276375, "uuid": "e12d558b-1b5f-4085-b960-d62d852ffe3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276375, "uuid": "1378b856-8e3f-4db7-8046-c24ac5159f61", "value": "6144:jdAegMkhBCDzhxXj9J9LhXVb7+Y+oKIzb8o+E1wnJWnXTBMQ/9Z3O6KhObdBrA7s:VSBC3/jLtqY1vgOynEXTKd6oITrAGiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634276375, "uuid": "e34ffea1-a57d-40fa-b6bc-799dacf579e2", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634276375, "uuid": "d0c3f37e-a896-44c1-9079-251129da8a89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634276375, "uuid": "2ca4db4f-81ec-4fec-abbf-3721b6042d71", "value": "Order P75(D53 )- FATP- RF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f118196c-2e01-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634334641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334641, "uuid": "e5b1f419-eccf-40d4-9c5a-b18b736cecdc", "comment": "Malware payload", "value": "a440eadb6e885ce1dbd91af346bd2c5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334641, "uuid": "676d0bd0-46d1-4b10-a9db-c0bf15cc52a5", "comment": "Malware payload", "value": "ed75fd40d6bb17a1e7bf8a11dde5fc2e91195bfe8adf99f92ac25c945edc70e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334641, "uuid": "1964cb4c-fa1a-4dd8-871c-d74677cfca4b", "comment": "Malware payload", "value": "a704562798f00e25434492118ba40bd8fec27595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334641, "uuid": "46112a54-fcaa-4fda-921e-ea42644f7c54", "comment": "Malware payload", "value": "d41a8ca97162264f623ef6ad3ed898d82127d04f4e8df64d0f1fa7abeb28f1688c9c6507b41a8f40e8e87cd59a47b40e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334641, "uuid": "83e61361-6b0c-4920-99cb-4582916e1e2e", "value": "T1B4C5332028A15546DE56547F2295B3B6D3782E51A4B8FFA3181F332682FB4F9D22CC1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334641, "uuid": "48be49e5-ba09-4918-8ec8-0da1f9c94ca7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334641, "uuid": "2779404e-0d63-43b2-b51d-fa1cf3e3ed0b", "value": "49152:gJYyZtnvC8UzGP1AU4ZOOxh/Y1z9BbtVKMNe26dJR6lcZRoqe8GC:g+aC7iPaq1z95tIMN/6PR0cR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634334641, "uuid": "59e7cb9e-a367-4693-8295-0d9ba8dd048b", "value": 2699533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634334641, "uuid": "6b663e07-63b2-4451-b341-bd603548d7c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334641, "uuid": "b52ef789-f1c5-4eed-b631-94bee3b4e9a9", "value": "Galaxy Swapper v3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3448abd0-2de1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634320580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320580, "uuid": "1a9070d0-12ca-41f8-a6f1-c4e1dcd0223f", "comment": "Malware payload (Formbook)", "value": "9f95195d65c34c3b3bc599e399196cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320580, "uuid": "cd028042-6c8e-4ac9-96e2-431a8d5b1286", "comment": "Malware payload (Formbook)", "value": "efbfd17d24ef5ee8e54a74ef9527396d511bcdade1826a1c08ee4f2603ec798e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320580, "uuid": "83ac029c-9567-4c5a-b60c-7bd20e05884d", "comment": "Malware payload (Formbook)", "value": "283882ea8a5c557c63eb3941eb8fdd6298bdc86f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320580, "uuid": "1aa0ef97-8dfe-43e8-86c7-020c166abb3f", "comment": "Malware payload (Formbook)", "value": "b48adf93ca71a96dcb3c565ee1a07f810766c281b12147514ba1432e7feb4e6c3e1f04fc8790a98146865b6c5999e419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320580, "uuid": "e9beae8f-a470-4cf7-a665-0789e8969e41", "value": "T18AA48C4DA3644287F0082B35DA7D3F590270197C79C1EBE8F9A5761BEEE1BA6153302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320580, "uuid": "650f5787-3880-4880-adf5-bd2bbba843b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320580, "uuid": "7aa9d639-a794-43c2-9bc1-30edfc14ec27", "value": "6144:yLHCTgMkhBnCnz0WLvFZ5Q+VHI3Yhfo5P7cYpXHjp/cvTWXZUGrmxbdM:yLcSBsYQvf5pVo3+fY7RTpkrsUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320580, "uuid": "34d96773-252d-469b-88ad-4fddd7573e77", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320580, "uuid": "823335a2-a9f8-472d-a460-7d0ffe81a5f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320580, "uuid": "59777fd4-618d-4c17-a6fe-8177ec00072e", "value": "Inquiry176801.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c96f26-2e00-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634334053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334053, "uuid": "8f7151fc-7efa-42ad-80dc-21dad3f39316", "comment": "Malware payload", "value": "e2cff59d2d6bc7584093129e52f5ff6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334053, "uuid": "f4390ead-4643-4f44-9bbe-21920e101d6e", "comment": "Malware payload", "value": "f0e51863d3d905b564547baef30c2eb8a64367c01709e83e76b6f3818fefc65d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334053, "uuid": "68d71812-bb97-4521-8a21-9bba251c486c", "comment": "Malware payload", "value": "cd905bb6a6cd4bed43d241f2aa451e1e89836522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634334053, "uuid": "b75add07-13f7-4b7f-bed1-a48a276f025b", "comment": "Malware payload", "value": "227c4dfa69f66ef002232d98868187c3a0d64dbbe76b42f3bcc84f3f54036ea5dc0e7a0fcd6e6cd5482b8ab8174fc68b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334053, "uuid": "f60d729d-eda3-46f0-917b-18fce375252e", "value": "T1A1E55D137644D53AD0E70B3A882BE3589C3F7F217A6ADC0A1EE4295C4E35D43AD3961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334053, "uuid": "c06391bf-feeb-469b-9433-7c5056c1f241", "value": "84089da33a32dfe450671d0f3f838da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334053, "uuid": "2b47070c-bd8a-4fe7-9f26-daf4af26ee48", "value": "49152:6ZWZT0r5o7J9iEchiSryV40bwc6C8CH73T9yx5buWk5:6zYJ9i10bwhC8w5yx5Sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634334053, "uuid": "6fe637c5-1e72-4e8f-b8fc-ad66b47a4803", "value": 3177472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634334053, "uuid": "bd1cba38-eb0a-46e0-baac-dd657ab19033", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634334053, "uuid": "e015b23b-642b-4975-baf6-b377c334c289", "value": "Fromix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4a2bd3-2de1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634320785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320785, "uuid": "888df8dd-fc6e-4822-9b3a-9fa270f871a7", "comment": "Malware payload (Mirai)", "value": "35ef9eee55427528d9dd7e7a7fc7bd9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320785, "uuid": "e48a84ad-c55a-4f64-b25c-8192a777956f", "comment": "Malware payload (Mirai)", "value": "f0e89b699b596d003cc5c87fb84c6e7e9106388a50f6fdba157ac0e3f1b8e5e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320785, "uuid": "4bfcca85-d4ee-4547-9fae-e52c6afe5d09", "comment": "Malware payload (Mirai)", "value": "e573f7884465672c5ae6df8222fcc64e092ec475", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320785, "uuid": "bae19db8-4b48-4151-9dde-1e0ab010f8e8", "comment": "Malware payload (Mirai)", "value": "61acf5aa1acc16a6ba06de26c3e418262170d95a72e31ee02d7ad231e6b0b11a14ed793b3db97ce36f3c0d9b9654eb81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320785, "uuid": "9faf9b00-05cf-4d06-8cd9-5ab2ef76d25e", "value": "T1B1534C0033948F07E4AA5EF5283F17D583BEEE4026E9F0846A0FE74A8275E735559F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320785, "uuid": "f898a3e5-aa09-4a3c-8276-cfca2d8aa0c0", "value": "768:yECdw4BNERp6KrRaDtW4+3Tdti+ZMid+yQG5wU05YNY+cOGchU5dC5/MbB6orkfp:WZWn4+fUi07fdB+cOGu5ikfeDVHXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320785, "uuid": "b776421d-b94b-4f4f-87ef-9f64d940b6a0", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320785, "uuid": "84febb56-140d-419d-bc97-88ca9712eb21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320785, "uuid": "1062bc18-a95e-473f-8dec-f99a37aacd1b", "value": "35ef9eee55427528d9dd7e7a7fc7bd9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f90a3a-2dec-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634325333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634325333, "uuid": "4bd5d297-7d36-46bf-8ccf-62f27cf9b90b", "comment": "Malware payload", "value": "7c6c4ddd4f203db946c4cd61515800bd", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634325333, "uuid": "f46b83bb-92e3-4905-ba2c-757e9c07a320", "comment": "Malware payload", "value": "f123bdb1a3e73e3b531fa09ecea5f813eda0b3b805eefea30b5b18aeaca861d7", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634325333, "uuid": "de9b097e-acfc-49ce-aa77-413aa9bbceca", "comment": "Malware payload", "value": "962c700cc1e84c2d7b156abe9ed55e6010010c65", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634325333, "uuid": "e50d41ef-a0bf-41d8-9c2b-721d0f5b9da4", "comment": "Malware payload", "value": "e8fc2f7b95600d0e68b9ada64acd5ed9e60b99b718387ba987650394f02fbab4028f4371f0d1273dbbaf5c249eb06a83", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634325333, "uuid": "63047df8-3a94-4011-a8d5-143c395f91df", "value": "T17451960AFC47D14C9BB9236BED978562FF1B801B9EA2104C71DCC2491F20809A6ACB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634325333, "uuid": "d6d0dbe4-4ecf-45b5-a12b-c6b4044c438a", "value": "48:Ax148iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlU:GGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634325333, "uuid": "b74edd03-bfc8-4653-b7b6-2793cffc2458", "value": 3129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634325333, "uuid": "c1aed2e0-742f-426c-a8b5-bb94cf4a8110", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634325333, "uuid": "3c01d37d-e111-450e-9f7b-d56b34dd0f80", "value": "b73NwUYJ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2fc9ff-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1634301025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301025, "uuid": "15187f39-0e8c-48ae-a44d-b481ecffba14", "comment": "Malware payload (STRRAT)", "value": "b962bbefda047a3fb192d13036d1f645", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301025, "uuid": "e56738e1-5eb1-453d-be6e-ae2bee8d9adb", "comment": "Malware payload (STRRAT)", "value": "f1485ebcdd60f6e7832578f71bf23f7f366c669f04f4906f439d85e7aadf4b8a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301025, "uuid": "d4976c36-17fe-49e5-a754-d8b7476bd2f6", "comment": "Malware payload (STRRAT)", "value": "b1862abfd3b6627908745d7266e7193dd7f7d2bf", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634301025, "uuid": "69cd48a2-a788-4723-90f4-fa770cf503a0", "comment": "Malware payload (STRRAT)", "value": "9a8527f8f169a47735d5a25a408a9b86916dd135145caa093e11a439c7075464564499c7e66b9122b048b853fb0a894b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301025, "uuid": "9ecfdc50-aceb-4d8a-a6b5-7f5e37ee6229", "value": "T18504F11FBA9780E8D07B587294199376B96C5594E112E83F31FC180C28F2E7E1764EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301025, "uuid": "fb291026-5685-4a5c-8a33-45c97aab7caf", "value": "3072:mPZMhgvT/mSrxxVMjmun9wvrp2PtjXZ5VbwZcOwyVKBAhGEEfMmTgB3vQ4:mB9vTeOxqNSQPtjXZ5VbyTHXhuTa/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634301025, "uuid": "0da7fa13-449d-4133-9ffb-b2601dcdc563", "value": 188715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634301025, "uuid": "67dd6c61-6fa9-4504-a29c-3d3d4f6f5592", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634301025, "uuid": "b7f38e4c-85fd-4131-9b6b-e369b6fb5c3c", "value": "Payment slip.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a93bcc8-2d8e-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634285023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285023, "uuid": "e5156013-f324-4587-ae2c-6795d10c173d", "comment": "Malware payload (GuLoader)", "value": "82d6d933cec68595a240135e850371ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285023, "uuid": "47d9b754-8c37-42ab-a565-b0289109fe2c", "comment": "Malware payload (GuLoader)", "value": "f197f40bdbef3e74e213afc8a219560d56c4a279908f86f6214348f59d7e9e31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285023, "uuid": "c87903dd-cacf-4193-a670-493e0c4a3772", "comment": "Malware payload (GuLoader)", "value": "96d94dcd4f370c2ccbb2ce654a0da3340c762f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285023, "uuid": "8aad48f6-5a1e-44a2-b414-c9bf5dd908b7", "comment": "Malware payload (GuLoader)", "value": "19260131ada44cab2328a1487dd41f2596528af567ca566344fd55966d071ef3509fc1c7ca4745b9c6289eed9acaf548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285023, "uuid": "ae6c8643-bd5c-490a-a028-bd3073400742", "value": "T1BAA36CC2769C1CF0D91069BD4FBF24EB071DDC3344469A4725843B5BD83ABB26861B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285023, "uuid": "b7f80b24-d486-40e9-a546-5fe976b339e0", "value": "3d3cd1bd8dcc611a5734bf41f4e1a6a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285023, "uuid": "5f3f9a88-2378-4857-88a7-ba48978351e2", "value": "768:trWDH2XfkTzcBP3tAbErFsdhgxTtwnssZWwsObLK8LYaCkDhItE/h6D:trWDH2vkXiP36Er68JtnJ1XDptEJ6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634285023, "uuid": "9b5f4c4c-6316-4af9-a80a-ace8dae59a14", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634285023, "uuid": "524cbd1e-12bd-4e82-a5c8-c2f0fb98d25c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285023, "uuid": "d90a5f7c-e132-42ee-a7a2-d8d36ebbc0c2", "value": "184285013-044310-sanlccjavap0003-7069_pdf (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbb7e47-2dcc-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634311656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634311656, "uuid": "71b48ea4-3c2c-4ef0-9f8c-cd8817b8dc73", "comment": "Malware payload (RedLineStealer)", "value": "5cbb7d5ad4093165191596a1f3c6007c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634311656, "uuid": "f49e988b-3bc6-426e-8154-03d5c80e33e1", "comment": "Malware payload (RedLineStealer)", "value": "f1d83f3c30658ddff9efd866d06b7b5db3e0b999b699aead43de4ba3d6e3fc84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634311656, "uuid": "314e1420-bb1a-42d8-a30c-909d9d6a9bb6", "comment": "Malware payload (RedLineStealer)", "value": "e36c8d00c1000ccc8caccbbaab2be92ca137007a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634311656, "uuid": "2ee87320-0470-4aad-8608-db81ad54fa0c", "comment": "Malware payload (RedLineStealer)", "value": "8dd8aeadac9c437421b5c195f527c90c6dd35f6f76d5640a206d34502620342e0282e26bee1af1d69cd1dbec320f7ad0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634311656, "uuid": "7b45f815-c36b-4fbf-9015-aba1923c4eab", "value": "T12184BF00A7A0C034F1F716F54ABA93B9A53E7AE1673491CF12D526EA5B386E5EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634311656, "uuid": "a77f8311-4091-4ecd-b3bf-138bfd74ec76", "value": "470518591ed4a5fa094199423463cb10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634311656, "uuid": "c222a24f-c6c8-407d-b01a-930e81a6f42a", "value": "6144:2ceWpHyGIoGNnOU8TmSq9q1uwrgdftNJN1VyalBUhT4lq2Q/kPKY:ReEyGtGROmlkQftzN1VyaqT4ltvPKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634311656, "uuid": "2e61ac3b-3b8d-47f0-8f54-47698b78dff8", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634311656, "uuid": "159ab280-af33-4976-bc39-4ea21fc40209", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634311656, "uuid": "4292f995-0831-4faf-9b1f-49855201a964", "value": "5cbb7d5ad4093165191596a1f3c6007c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db812f1-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634280143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280143, "uuid": "c7c4b00f-0739-4534-bd57-f7f400e33095", "comment": "Malware payload (SnakeKeylogger)", "value": "e15996280bdc2a39a88e4e03a12dddbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280143, "uuid": "b20f7108-3f66-42cd-a624-ffac20584bbf", "comment": "Malware payload (SnakeKeylogger)", "value": "f1fbe3d43016a22dcb9b9c24816b78ad76de92dc65506a74645d47a5ffa76dd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280143, "uuid": "ce667f96-9cfc-4de3-86e8-51a6d592d1cf", "comment": "Malware payload (SnakeKeylogger)", "value": "295e975baee4990b6b415cf825d2318426b705e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280143, "uuid": "7b123b05-2249-4405-9001-46e4e802d7d3", "comment": "Malware payload (SnakeKeylogger)", "value": "bbc3e6ff8226a486afac3b22b1d73413b79c8dce10d58b9fb909a2267d81f3696b349c84bcee69f6daeae3bb141eb374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280143, "uuid": "2d9ff339-5831-411c-80ef-cbc48e9698f8", "value": "T165C34B7023E9AC1AC75B037651A4710A5A3C4283123CA294FD8E597D6BDFB62073FBB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280143, "uuid": "99e85d94-8939-46f8-a131-378d0c8938c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280143, "uuid": "390a8c23-d9b7-4900-bc9c-58909dbf9a64", "value": "1536:jTQtdijNtRgbirUH+moG5jCnFIEqusIUbdBp6coIbgjQllf:jjpVgH+BG5SFwuxUpBPbgjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280143, "uuid": "d14e380b-022c-4a63-99b4-010d19f6fa68", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280143, "uuid": "cdf49abd-201e-46d9-aa3f-54eaf561af40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280143, "uuid": "36821a30-a51d-40da-8f42-1c5c0c741423", "value": "Swift Bildirimi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ab1e33-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634300529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300529, "uuid": "23a54906-387d-4035-9275-ce4c2f78bfd5", "comment": "Malware payload (SnakeKeylogger)", "value": "68433ca29865ac4f36e1753c37f9128d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300529, "uuid": "eb6003a9-c28e-4941-bdad-3dcb2ce72bb2", "comment": "Malware payload (SnakeKeylogger)", "value": "f23eca05013c2cc70a34d176362ea27488988afba7f362b372509273dc5cd449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300529, "uuid": "49563d72-22a7-4fcd-b5d1-fcadbc7112d0", "comment": "Malware payload (SnakeKeylogger)", "value": "007d128da117c20d278508cfbfee948bc67ab404", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300529, "uuid": "d8ad5e14-cdbc-405c-ad01-7b735d961038", "comment": "Malware payload (SnakeKeylogger)", "value": "7d11359adbdc760a31e130e4c38b8c27cc95e670840824213dd9303a55fad9b324c23f93afcd7296b858e5d32d304c7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300529, "uuid": "1789581f-4210-44b0-b346-2c385ec5c468", "value": "T197E4D71C7B058972EE1DD130CA91DAB47B120F97524CA84AD3EB3ECBB76F2511C49EA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300529, "uuid": "832031df-3e04-4d43-ac88-a7e42fb77d44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300529, "uuid": "b40c1795-9ae9-4ad1-9cae-e9cdc60e6c98", "value": "12288:R31p9ji6AIAZnjyTrtp5m2bPzawNaSctMX:/cGTf5m2bPz6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300529, "uuid": "bf2af137-fd15-4f45-8eb4-8d1999cf5fbf", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300529, "uuid": "1f649084-26dc-412d-89bb-9a6d7f2e53ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300529, "uuid": "bd4579d5-f32a-4b28-b72e-3674b7522c76", "value": "New_Requests_30175082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5dfc67-2d5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634262557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262557, "uuid": "19fe381c-5474-4fa6-9d4b-d019912b493f", "comment": "Malware payload (Gafgyt)", "value": "89b90723cf600550356f0f4031951787", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262557, "uuid": "fc6de6b8-e9d4-4740-b597-1dc2bb69918c", "comment": "Malware payload (Gafgyt)", "value": "f2653e0973bc21d57c16805e9df5d3feec3c400357f0e73196c9c54c0e45e13c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262557, "uuid": "59718b72-0e14-4343-9fb3-8a6fbdd0a92d", "comment": "Malware payload (Gafgyt)", "value": "e505a987864ae32caa55ebd2550421c0d855f984", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634262557, "uuid": "6821890a-968c-4425-892a-0fef86805f71", "comment": "Malware payload (Gafgyt)", "value": "0f0a5149084c2d22fcea37f187e2d30a83fccc490c7b82b8ea546ad4d361232a064067da29147042c567c5eeb2950f7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262557, "uuid": "937e695f-9bc4-472d-9987-7d330e9bf29c", "value": "T14FB31945F9408727C2D327BAE78F478D3B36679467DB33116938BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262557, "uuid": "5a77d1cf-c662-4f9b-8105-422c7341e908", "value": "3072:MSY+46m1qOzssrFPZOfimkZrQAhPDCXFke:06mgOzJrFPTmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634262557, "uuid": "00d419c0-9ab4-4c84-a1ea-99bb9b2c9365", "value": 108418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634262557, "uuid": "0103efb6-d0dd-4d1d-85cd-a06e48d30c76", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634262557, "uuid": "fe9d4702-85c2-43b5-844a-111b2bfc841a", "value": "89b90723cf600550356f0f4031951787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2805b2e1-2d8c-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1634284053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284053, "uuid": "575ea5ed-7893-418a-ba59-5b6a5193927f", "comment": "Malware payload (XpertRAT)", "value": "7560b03d9721036181565287e85d9525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284053, "uuid": "cf228d2c-718f-4162-afbf-44f94c88eff6", "comment": "Malware payload (XpertRAT)", "value": "f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284053, "uuid": "904dff2e-e7ab-4671-9244-1462548ac368", "comment": "Malware payload (XpertRAT)", "value": "447c0d915c9236b5f3221bfbe05e5b57785d3142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284053, "uuid": "ee813705-75fc-46eb-a666-446a781f7c39", "comment": "Malware payload (XpertRAT)", "value": "1db82cfcc34f69c8b71f4750986838574661f8180fa4b93d6f72336011424d97e883fe73f15516e5178fa4270bd26334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284053, "uuid": "041ad528-8750-41b4-94a6-e9a7866c3916", "value": "T1784523D5B09548FAE4DA4AF2E15B982122520C19E038AC7D16ED736A17F377316EBF03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284053, "uuid": "f6fd4589-b500-4e51-b83d-31d362e13c07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284053, "uuid": "6d923376-c30a-48b2-87d1-3d2db4fd17ff", "value": "24576:wLFftZPKgfM82jk4sM7RPPzN6dK3KEf02oaSzFEvtOA:QZPK3DkktYw3ttyzF2tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284053, "uuid": "09160fcb-812b-4a58-8083-2fb96522c929", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284053, "uuid": "82e3f3c2-3c1b-41f8-98e7-f05d65f659a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284053, "uuid": "19d8244a-a236-44f9-8f90-c25bd86a73db", "value": "7560b03d9721036181565287e85d9525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb31bcfc-2db9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634303654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303654, "uuid": "c019aed3-0900-4094-8b8e-259e9fb755b3", "comment": "Malware payload (AgentTesla)", "value": "3baed601483e594e31b042efb80a87f3", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303654, "uuid": "5bf81328-2eb7-4d01-b219-4a619e6a095a", "comment": "Malware payload (AgentTesla)", "value": "f30c6fdbd6f3f2b18bb31df4165f22146f21fcfcd4216474480efeef03054751", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303654, "uuid": "34497788-2ad0-460d-acb9-f46ac1e34898", "comment": "Malware payload (AgentTesla)", "value": "9b2585477b2016fda880239a2a0be072bc7ed56c", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303654, "uuid": "ac83c0c4-9e02-437f-b532-95cff94c4f05", "comment": "Malware payload (AgentTesla)", "value": "11c580469e3bfd426ac1b982a5e9b06dee37203a6e2c8680349262273e0a9b1c950fff52038bc11280bb714d4dcba4b2", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303654, "uuid": "7ceff03e-415d-4dab-9886-3b869be777b3", "value": "T126A42377D318390C7C9AAD9CD7FC2BF061524ED4B0878BDCF82E0687BB1A9A4D61450A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303654, "uuid": "54c4d0d1-ea46-48b5-a1bb-719b71614311", "value": "12288:c8C2UQgMccPuzGuE6F9LT3rCOlD+GJG9wGD0XN+nfGTTKFceHm:cX29FTWXn3W+D+uhSgNU+T2FcOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634303654, "uuid": "f8b24365-b49d-4587-ba80-935fb8207851", "value": 464801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634303654, "uuid": "165c5c63-cd8f-41be-9166-d90d5dcb0ca7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303654, "uuid": "a186dbbb-ca44-462a-9fb5-e82d1a91f2a9", "value": "TNT shipments.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdf5a5d-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634280355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280355, "uuid": "2de2d933-8496-4ba3-bc7f-d44b120b0298", "comment": "Malware payload (Formbook)", "value": "5edbd82c98bab74dd3583540299fd6af", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280355, "uuid": "15e37cd0-a098-492e-907c-bf20621d812b", "comment": "Malware payload (Formbook)", "value": "f3c3c0c49c037e7efa2fbef61995c1dc97cfe2887281ba4b687bdd6aa0a44e0a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280355, "uuid": "5a1bf0dc-1980-4847-a866-d959e1d6f22a", "comment": "Malware payload (Formbook)", "value": "881fcb634d3bcf43699e8e8f132653f050086fe0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280355, "uuid": "f3187d7d-b822-4415-90b0-ecbce4c5a2e9", "comment": "Malware payload (Formbook)", "value": "2732155dc089c7d70a9dbf95788e77e72106e873cade72349f60496b218a405a5eb9619d65c60f6e6841faa45c7054a6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280355, "uuid": "9f6c5231-4e6c-493f-bcd1-00061e04d2b5", "value": "T1E6C4F17731540A6AF37357B41E138944C5C94EA522C2BE8D3A9FB77FA7F014632A8638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280355, "uuid": "41ee2a18-7f85-4cf4-8141-3ee0420a3ba6", "value": "12288:XBAbOSDMFJUJUoMNRRez4hTP9o6mV+02wHEzrBiMSaBH6:Xgn+QgNHez4hTP9o6mV+0FHEXSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280355, "uuid": "d44655ca-4a36-4db1-88fc-0b9891155900", "value": 582648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280355, "uuid": "8531ca8d-225d-4e8b-959c-904cc8ee5cd9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280355, "uuid": "24ef2067-3525-4e43-8c0b-10f75793f247", "value": "PO08485.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d39ad70-2d89-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634282961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282961, "uuid": "9a2dfd03-ca8f-41ff-803f-dadcfe0bea8b", "comment": "Malware payload (AgentTesla)", "value": "170b650b89eb3f88732366ca582cb976", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282961, "uuid": "4bbdf052-b65f-46a8-b2f3-de4916406854", "comment": "Malware payload (AgentTesla)", "value": "f4008d16e598db2a35512ca619aa47a5434e177e5be16323378fd86715002808", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282961, "uuid": "d8baee5e-a8d3-4d6e-9627-69e75584d7ef", "comment": "Malware payload (AgentTesla)", "value": "b76899209d61e00e567d6bfa1140b6455f28b9c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634282961, "uuid": "fa07f676-2d9b-490f-91fa-d3b957b7ad38", "comment": "Malware payload (AgentTesla)", "value": "f6553905a2e0b53953fc7a3e1fbdc7248c13025aa28e7b00bfea6ea084accb03153c77d45d7ba142ef63b1f4cd1a2e8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282961, "uuid": "4af2e465-a1a5-4220-89a5-a8029e499a47", "value": "T16674CF93FB93C551CC933932D4B358F987A63CA9DD68A09B724CBE397A730C24486527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282961, "uuid": "9fe4ffc3-5a7c-461b-b95b-77b29c6a4f07", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282961, "uuid": "3fb9ac29-79cf-4c09-b60f-34428722fc04", "value": "6144:GBlL/LNEppNBYRU1P/PMSnxT0SBCGbyVpEhcHEytf7anFF:EBm77RnxT0SBCGQon7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634282961, "uuid": "979b6132-da6c-4c59-a8e0-c9fd51c50407", "value": 349684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634282961, "uuid": "9eb283d7-fa65-403c-b073-0cf4a9886fbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634282961, "uuid": "a36f0252-3c71-4850-9f2b-a08705d18021", "value": "Purchase Order CTPO18542#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d781eb-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634280148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280148, "uuid": "e4475d2d-06b4-4372-a5b0-90eac58d7d24", "comment": "Malware payload (SnakeKeylogger)", "value": "cbc313ddccede4e1abc2eb066210eb3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280148, "uuid": "865665e7-2c6e-40ef-81c8-e4f052f0e379", "comment": "Malware payload (SnakeKeylogger)", "value": "f42557743e88d50544f011d55f67023915bacac6db0e9bde538b7d8e76e047a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280148, "uuid": "5553c0b3-10c1-4fa8-8430-cd9f4b8dfc7b", "comment": "Malware payload (SnakeKeylogger)", "value": "b8e2b4ed6246f0909ae31c334c9aef959ab3f851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280148, "uuid": "74346a95-e281-4f26-958a-62eba55e3251", "comment": "Malware payload (SnakeKeylogger)", "value": "80aca9ff9b27980edf979911dd6de679f562bf2d1c5c145ee72f9d780606a9cb6af1106f39bfff289fef7e3558f69d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280148, "uuid": "c633a978-de81-47be-9610-1b7c8b9be926", "value": "T1C2D4B5AC7F05A77AEE1EC0308892C6B47B130E579244A95A17CA3EC7B76F2511C79EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280148, "uuid": "3ed2de71-ec6d-4546-90a8-8c493b6e7b3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280148, "uuid": "7407af7c-b133-4279-b6b6-6dad73f6ff5f", "value": "6144:ARFVmrLWI1gED/TA2EN5b5ylmIUUCn7xf+qW/3b7GXrdCMCjsLwNaScBF5HjQ8GB:ARiWSaHb5qjDqWH2pJCCwNaSctMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280148, "uuid": "b2aa75f7-ee9d-4c64-ad53-409cb2ea5f32", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280148, "uuid": "ab1b83f4-2fc7-43b7-b210-e1a1c1ac1279", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280148, "uuid": "341f81aa-e04b-4579-8bc7-e1ce41c04a12", "value": "New_Requests_5022055289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e067332-2dfe-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634333213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333213, "uuid": "f87c5d55-a552-4d91-9751-fe6c97a48c5a", "comment": "Malware payload (RedLineStealer)", "value": "32709bcfdee975523b54705841b56c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333213, "uuid": "9f26ffb8-0281-4553-b0c6-307890910eb8", "comment": "Malware payload (RedLineStealer)", "value": "f446e718a89a9174ebd6f4a12624c6512ae6bc6ed7fe2fee0eceb5baf38f77b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333213, "uuid": "54bc8054-f871-4b6d-9a4d-f100a73864c2", "comment": "Malware payload (RedLineStealer)", "value": "0f30d1ddadc565d5e20d452b16d98b0b9be22373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634333213, "uuid": "aaa98518-b91e-4e4c-be63-68fea0df34a2", "comment": "Malware payload (RedLineStealer)", "value": "2b5c9195fd2ca0d15a3e22e4ab03579792b26995105644c79559194574ed72280e615eac62169b682d74cbb3637fcb15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333213, "uuid": "1a244a04-1f6e-4a2a-a68f-16c02e71d69d", "value": "T1B564BF2179E0C473D47205310AF4DBF959BDB9200B5199EB57D81BBE4E303C2EA35A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333213, "uuid": "baa45c66-8e9a-4d3b-86f4-f13335168aad", "value": "d86b72152e3eb79509e879927a109d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333213, "uuid": "729c00b4-cf41-4172-b86e-b4574f356c9b", "value": "6144:IxPOAfsdY0LoOaYo7jaO00ssjxAODRhaT/JSgc2u0b71SbL5Fy:IxmGsdY0LoOaH1uMmZv6tFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634333213, "uuid": "c87f6492-c551-42bf-81a2-833eefff0d15", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634333213, "uuid": "492b6cae-633b-493f-8a08-da98372a6cb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634333213, "uuid": "a2105716-f0d0-4fba-acd1-52a7fd9c1860", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c17ca29-2d93-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634287012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287012, "uuid": "d9255f10-f4c2-43e6-91b7-51b189388c77", "comment": "Malware payload (AgentTesla)", "value": "33669c8ef326e3285e8df747ef682155", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287012, "uuid": "f2be08dc-9ab9-410b-937c-57d3c5c7459b", "comment": "Malware payload (AgentTesla)", "value": "f464410fb8294b75b96c35b8d3e2efb095b8c53ff47807094b6165f3b787ec97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287012, "uuid": "dd57cf32-0e91-43e1-9207-32aeb653763d", "comment": "Malware payload (AgentTesla)", "value": "30558e04a3b8665f993a02031d4b648f6cf0a671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634287012, "uuid": "9db4aa58-2c0b-4f5c-b692-1ef7796b5b39", "comment": "Malware payload (AgentTesla)", "value": "c3af3e12e057eaef64875e1ceb1d65a3120821a1fcbde762749f0710bac86a70e8d76d313edbef3653d2ffcd1fa0bdd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287012, "uuid": "9d69d2b9-00ea-4061-99e0-85b68a895e3d", "value": "T1877423BC7B24ADB5DD42D18ED95F21368254F37B48ABBE276E607A36CB010403762B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287012, "uuid": "c0eb3cbf-577d-44b2-b655-b75e830461fb", "value": "6144:0SSOQy4z9tKUjT9XYaPbbSVUMokQ4m2cqmkPheIPcsc1V+/a++jBMOuDg7WsfATC:0SGrJkUjT9J6VUMNQ+uokZt++MDAYGWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634287012, "uuid": "fcb022b1-401b-4f44-bac5-8bab682609cc", "value": 359877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634287012, "uuid": "7d18a1dc-e324-4ca2-bd37-4baa60833182", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634287012, "uuid": "20f6cdcd-04a3-46af-b15a-2d737b2b710a", "value": "BANKING INFORMATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2eeacc5-2e10-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634341006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634341006, "uuid": "b65a2002-a77f-4ec8-ba03-8f4eae5a4dd3", "comment": "Malware payload", "value": "e1caa1991aa3f716cd242a95742a4387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634341006, "uuid": "0996c937-8413-45c1-a431-a9b036b49029", "comment": "Malware payload", "value": "f4c49ebb0581258c2f567cde1d976d016e1302a5a29d292b17667884318669b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634341006, "uuid": "2b291e97-f980-42e3-be16-75a98661fa05", "comment": "Malware payload", "value": "52a989ac36682d0f1bdce1fba0638febe2f91b00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634341006, "uuid": "b58945b9-fb54-4f17-85ea-16ff532d55e3", "comment": "Malware payload", "value": "58d21add3cecc85e6a024cebdebf8b527af3d67de0f30879ece13bee4a145f1f9f7adb1e5a0525041fbab18cad03f7c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634341006, "uuid": "a21d90c8-1a85-4157-9837-b93391739e37", "value": "T137F31EECADB34B93D1094DFAC824AEAE166B4DD154ABB0117B8135075AB74BE4DF0833", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634341006, "uuid": "c1369f47-888c-4046-9b50-dd3711ba0ddc", "value": "533746721b1929f9cea5da044f8f3cbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634341006, "uuid": "24772c81-2296-4854-8002-7839020decaf", "value": "1536:Vyi6iV7UTVv8zjP8HwxlevIi6vhhf7qqXVw7NqRZdqttttttwtttRttttFtttttr:GqqVUEHNOCql4kZ57P4+3Fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634341006, "uuid": "ee50803c-5b1b-47fb-8876-c596ae9901ea", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634341006, "uuid": "f48bd557-78ed-4d82-bd54-09466bed1ade", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634341006, "uuid": "e25a2bc1-cdbc-4cd8-8db0-811585eacc0f", "value": "CRoll Acc Generator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dd9ea4-2d8f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634285477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285477, "uuid": "19b33f81-6ad8-4d3b-b8f2-b6701f82fe34", "comment": "Malware payload (Loki)", "value": "b007ee7994afb90b45e3fb23d0acc313", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285477, "uuid": "fb980e09-560e-4957-868c-a12aed57e31a", "comment": "Malware payload (Loki)", "value": "f4fac38f145a5b369bf01511466f7fbafc0fa12abdde0f5838321885cb252f9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285477, "uuid": "a5f3b8a7-eebd-45a9-855d-4442fbcc7192", "comment": "Malware payload (Loki)", "value": "cf0b80481206d6d022f45e28770b601b17f331b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634285477, "uuid": "ecf15439-bb45-4d1b-bd1b-be1c05cc2076", "comment": "Malware payload (Loki)", "value": "6c906ada260145cf97cf8895f8fcec4c232de53440dea15e20ffbfd5cdf179d9c22b86a3e7285b3adcc521cfaa2ef5ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285477, "uuid": "2690f8b6-7047-4ecf-8826-0b4ed8473333", "value": "T17B54E01A6755D92EC2710E3599CE110C337C5992E4E2FE1B6ADFF2DB68B2393089019F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285477, "uuid": "b8482333-b64b-4e5e-a2fd-732ae5a8b9d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285477, "uuid": "adbcb28f-d58a-4d64-bd39-223884009bc3", "value": "6144:mE/z/NMkhBxim3La4JOkNfefbpk8tzLZ2rkjs:pmSBnba4JheXzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634285477, "uuid": "07440492-7127-4629-a32d-e46d4f88843f", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634285477, "uuid": "10b66682-73fa-426c-a4b7-70f62e870776", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634285477, "uuid": "ac5912ec-e8e5-4b7d-aac1-990103c239ba", "value": "b007ee7994afb90b45e3fb23d0acc313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a8280b-2d79-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634275918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275918, "uuid": "1fbf447e-5da5-4f9a-bda6-1ad5f20ce665", "comment": "Malware payload (Mirai)", "value": "4e9abe6bd76bbb4e640f9e2815ac6f17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275918, "uuid": "aae68d31-89b4-4de0-ad8f-cac221780457", "comment": "Malware payload (Mirai)", "value": "f5ed6f6eeed0d4677beaf39d2a41cd8e6734c00335947f45f81b03b781be7078", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275918, "uuid": "27323370-4cda-4c2a-aa81-41fbdf66ef4f", "comment": "Malware payload (Mirai)", "value": "e8706a5477100f33741f1f640fefd67f6001ea64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634275918, "uuid": "149bd384-a99f-41c3-881f-3f418ea25f51", "comment": "Malware payload (Mirai)", "value": "99eb8811731d6196ede9a7606ed64d46ea4702af18abdcd31a3d8db6bc4dea2f86fe6e10dea9a96fd761a7fd2f896133", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275918, "uuid": "6709b83d-658a-4564-823c-ecc02d25f27d", "value": "T120A2E0D4E80A4DC4EFEE7B309CFCC18237A463D9A2A789C61BD1AB400557A739018DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275918, "uuid": "519fda2d-8d12-4b7d-9f0c-3e15cdc2d504", "value": "384:A0uqjF430NurtHTiJLu/21FSvE8QOMY9dG42McjA6q4xqfaOhrX6M4uVcqgw05VO:AmR20QrtHTiJK/A7nYXG42Mcs6q62ZXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634275918, "uuid": "4ac60ad2-2c1e-4416-ad44-88a3567fe6c2", "value": 22280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634275918, "uuid": "47d42564-145d-4ac9-a916-2893f7ae6e4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634275918, "uuid": "d36d5658-bc0b-41af-9f1d-d7760eda7f5a", "value": "4e9abe6bd76bbb4e640f9e2815ac6f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33026d8-2de8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634323907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323907, "uuid": "47b2dfea-800d-4a7a-a4bd-5a1dca643e01", "comment": "Malware payload", "value": "2eb95b88fab546af95d509c94a26a930", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323907, "uuid": "58b562fc-1bc2-4514-8735-051ea60274db", "comment": "Malware payload", "value": "f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323907, "uuid": "d967349f-1f13-43ab-bd46-ca90dd4feec0", "comment": "Malware payload", "value": "cc0d10a420a0ec0ea3f96d89318af0ad325423d8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634323907, "uuid": "2a757f88-09fc-4f3c-af65-ed5bdc927a5d", "comment": "Malware payload", "value": "e4b6d25c96d17fc26a029f60ee838d28c683025bca033185e67a7591e42df7965ae9104106390d7e27c6a1bac1135fc8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323907, "uuid": "c0c025d1-ebe5-40fb-8dfc-97ceb6dd5e4b", "value": "T1997633D499E283A2FE1965329E96B982772016754CC3E03B9E001EE445DBC4F1F27E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323907, "uuid": "6ac83052-9aae-4e80-9697-7efb3b6802ae", "value": "196608:83YEQjk9z5MpNelJKDWx0RiQdyjynFAL9cR3n:8nQwd5GNejeWabyj40En", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634323907, "uuid": "e2d10e04-50e7-4905-bfd2-ef5be78a6cfc", "value": 7693386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634323907, "uuid": "1480c8dc-ab65-489f-bccb-5a3b153d1b11", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634323907, "uuid": "df857f1c-f5fa-46f7-9261-d5053504a6da", "value": "41037_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782d88ce-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634300508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300508, "uuid": "b8f158cb-d991-4809-adc5-7242cf8e1a61", "comment": "Malware payload (Loki)", "value": "4c75ce1b1b1c91b4f4f6d308f4076595", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300508, "uuid": "29bfb20f-f718-4ac4-b0dc-719b64e0b1c8", "comment": "Malware payload (Loki)", "value": "f7d07f9c13ad79ae598b453e9bb647cb5f65d0986f135ace4ab8f9790ecc87e6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300508, "uuid": "58b65a7c-1e11-4c36-9fcf-8dcda567d787", "comment": "Malware payload (Loki)", "value": "2b73814deec1aa0b5b909dede5c2daea3326536d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300508, "uuid": "0bc713c3-b0e7-4e85-b91f-54c6c447c9c0", "comment": "Malware payload (Loki)", "value": "d4e70153cdc2056d42c070bfee753e17b6f4bb8bb198c2b305c14ce81771d46e164285ed7ac4f99634b01935bd493d83", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300508, "uuid": "22e09a81-e6b4-4403-a058-c9e7e1e05981", "value": "T1BEC4F1C2F8899F86DEC306B9C1FC762D9D97CE2F656056C9D660736F4537C6388A2022", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300508, "uuid": "5e8ea372-f3e8-4fad-94bf-0e9aa526d631", "value": "12288:MMdgJYn+KUN4vEHhNHccLrGlW9vYUMApK+6FDvGNDCjG8F:MhCn+KU2v4T8cCW+UXpK+g6DCKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300508, "uuid": "954d888c-17b9-469d-ab4e-b90de93448b4", "value": 567752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300508, "uuid": "94f0d886-6f3e-462c-91b9-3818c37b86f3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300508, "uuid": "84500608-466b-49d7-9966-99ea4d6453c7", "value": "PO20080956.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b840075-2d83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634280300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280300, "uuid": "09abe945-b8c6-4991-bf61-0a31c6d3d683", "comment": "Malware payload (Formbook)", "value": "c5df62fed777cdc07957e29692efaf92", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280300, "uuid": "6813a10f-4c81-426c-b03f-d03a80526ee2", "comment": "Malware payload (Formbook)", "value": "f863135e1d5d004c3012db647d1ea434aef8583096b8564c8d4c33599d71bc43", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280300, "uuid": "a44d93ed-d5eb-4055-a8bc-1d93421cd5d3", "comment": "Malware payload (Formbook)", "value": "09c08ce6f2e71ae8595742145c9edf024689de3a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634280300, "uuid": "bfeb0604-4bc9-43fb-aab7-4c46f733cb4f", "comment": "Malware payload (Formbook)", "value": "743ad23b3583853d884eee365972c40ae6e2c43d63daddace348c817c72ad0633992d10c2bf63b8c3692f1a0e979d798", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280300, "uuid": "5f947b87-ce09-4171-a4ca-46335dcda60b", "value": "T19374AFB8B5043DD6666E137BDA96ADEC03A616739ACBA4CD4078B7C30563375FE02C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280300, "uuid": "dd5b0c3a-03c0-4553-b26c-a3f09ae8f754", "value": "6144:BFyZPPRYRgI9nk0Z4bP0+zZKFPSBtU5kjMEjczQxYz0ne1uqgcDtZURuI4:B4ZRy9nktbZdaD5NEjczy8D3DXURuI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634280300, "uuid": "8bb87ed8-46c3-4589-bdb6-b49a0ff8f401", "value": 349191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634280300, "uuid": "656329fc-0f84-45a9-ada4-4b1b0eeb248b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634280300, "uuid": "a66033b0-fd46-403c-a66b-a43bab352152", "value": "Attachment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b7ed3b-2d8c-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634284045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284045, "uuid": "6c23bafc-c520-4b07-9f42-846fa5d81b3b", "comment": "Malware payload (DanaBot)", "value": "f4106c39d7821ec3f2c4d82c1782f100", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284045, "uuid": "1d7b3585-e916-49b4-823b-acecaa56ebd8", "comment": "Malware payload (DanaBot)", "value": "f8f1569945e8adb87cb91509db4129d64a878863a347dbea1b21b70e1a21f973", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284045, "uuid": "ffce4560-7f8a-4cb8-afb0-c037e4460fd5", "comment": "Malware payload (DanaBot)", "value": "208a5cad2bbd56d0d92300ce3d8ef60a3670ae0d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284045, "uuid": "82dbf64f-b1cf-456c-8fb5-18a465b962af", "comment": "Malware payload (DanaBot)", "value": "8adcad12f21e1ba151f7a096eabaf392d8582ccdcb0f7f82506de646808f49a7af3e74e97e33ab12a22896001170c3f8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284045, "uuid": "d0facb6d-af98-4059-8816-fa9ddf674a10", "value": "T11E3523203BA8DC74C98354704CE1AB955D3B7F22D6B4430763F4EA9E3EBAE90A6D4351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284045, "uuid": "863a556c-e14f-49b3-98e5-f78e65fa19ba", "value": "b5be897698085ea8cfb89dc856c9bdbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284045, "uuid": "2a25c051-dcf1-46d8-a807-4f452c3d3679", "value": "24576:NS5trgeHLtyo64tlrct0rpBXoda3Ftqy/10ikNNJXUZFyP8:NCPHZl6AlrctKpBYda1Yg9kNNRsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284045, "uuid": "a5e4749a-d182-492c-83d5-63deca672f02", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284045, "uuid": "39b7cff4-f7c4-4fdd-a147-d05d1d10f29d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284045, "uuid": "14480052-7a31-4af3-b2f2-d4e2085a2dcf", "value": "f4106c39d7821ec3f2c4d82c1782f100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d368c8-2db9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634303700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303700, "uuid": "409223fb-6c79-42bf-896f-d4487389f447", "comment": "Malware payload (Formbook)", "value": "28e013c2654f47916f1a62cf09308cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303700, "uuid": "08a88f12-3e32-4d20-9d4a-4528d0f4a2e3", "comment": "Malware payload (Formbook)", "value": "fa5502396dc7ec0fc5508d901eb8b3e555558cdbaff338a1911db0edd4563b78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303700, "uuid": "3504671e-3a84-4298-b315-b372e7c6c7f3", "comment": "Malware payload (Formbook)", "value": "fa785ccc69ec30254ee9b81f87dca6764350075e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634303700, "uuid": "c334fd96-db80-4c8d-8866-c4ee686da98e", "comment": "Malware payload (Formbook)", "value": "182617cb15570fb093ccb66fd3bb63703033d28f9111a7d9d1ca323c3b13a56e13eb0ac7a9c393915cbc618343c34a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303700, "uuid": "18e22d70-0e39-4ae3-995c-f7b0aebcfe6b", "value": "T17644223131E3A87FD9E701724DB3AB28E276414E483A691B97205F7FDDE0BD3954A182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303700, "uuid": "e8b84558-1d75-4117-ba9b-6817ebfc5f4b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303700, "uuid": "b0d68e9d-7a12-4e7d-a1fd-766ef5a63c6d", "value": "6144:wBlL/c+xnpzVsgv3OOhxYwdrgR83DE+KO30Zo+zK:Ce+xnd3NxYwVgR2DE+uZ5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634303700, "uuid": "69bb5182-ddbb-4972-a15d-4d64ad675153", "value": 255541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634303700, "uuid": "46357d46-e9f1-4603-8dee-749a44f584fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634303700, "uuid": "5d5470b4-85d2-4f5a-a168-1647c79b830b", "value": "uorr23190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36295b4-2da7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634295910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295910, "uuid": "c7553f99-3a5c-46ed-8114-c9640d0ec178", "comment": "Malware payload (Mirai)", "value": "4d84bb138c5a853b509d235a213ff06c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295910, "uuid": "d38176ec-ec6d-43ef-80cf-44345401226a", "comment": "Malware payload (Mirai)", "value": "fb9e326efb33796f8c31ceb6f138cab169fa1c97d677e98742a8f07491916b0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295910, "uuid": "5d909ecd-553b-4fe7-ac95-2c487b297e99", "comment": "Malware payload (Mirai)", "value": "b350d9484807c2112ca4a9fd21b6d83ca7d91438", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634295910, "uuid": "e056e41b-2f5d-4256-919b-942d924a9468", "comment": "Malware payload (Mirai)", "value": "b3eb8fccbae7c9593e782496ab8a893259c71f45bed3d05a39c155807af9b5916f5dd5b9339f41e3304fc4670d589fc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295910, "uuid": "d7290382-8a46-4b0c-828a-3bf1a6f63c7c", "value": "T1BA834A01B3580B43E1664DF92D3F17D593BFED9022E4B588690FDB4A9231E33568AE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295910, "uuid": "04aacaee-bd29-4f22-9dd2-3c1028ed8181", "value": "1536:XJysOlUR8yUs45oYHYXNaLIcV59+RnINZH:XcY8yUs4q+ZLIY5cnSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634295910, "uuid": "b903244d-34e7-407a-bf4e-962fccaf44cf", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634295910, "uuid": "5e8ef05d-7089-4768-9c39-300972205246", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634295910, "uuid": "886b258b-35cf-4052-b16c-43ba6d26b93b", "value": "4d84bb138c5a853b509d235a213ff06c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7492cb-2dc6-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1634309083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309083, "uuid": "1ce2605e-7651-4581-a1cc-36c8de08f1f0", "comment": "Malware payload (CoinMiner)", "value": "ea4b4ec80f45958158d072e1831f8ac7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309083, "uuid": "3ece6ec1-0044-491f-b997-a86ff0155ca5", "comment": "Malware payload (CoinMiner)", "value": "fbf130705ed4de523fd2e38a6c64848af5d6e1ce6a268251e7b6d6e3f8089957", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309083, "uuid": "734a0ce5-b03a-402b-9b2e-4eff3ab5bc21", "comment": "Malware payload (CoinMiner)", "value": "6779946a2959078f21509f7b11e19b33435de555", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634309083, "uuid": "1415ade7-6954-423c-976b-45c2f6b57e65", "comment": "Malware payload (CoinMiner)", "value": "a45252848aedf070ad9cb1fc6d19b0509d798f016cf29e554fd651fc0426f40e0fb4581f3827516fbb03e0b924e6d910", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309083, "uuid": "d006a1b5-77bc-4648-8f34-5401e2470c2a", "value": "T11CA533B1D2F994BCE2DE04376BA195F21B2AD18F510BE5C356BFAC4CC1868A14533B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309083, "uuid": "2e719320-dc85-4cb4-bc3a-f25c4398803a", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309083, "uuid": "bd855f0b-b828-4999-b409-b29c325c5945", "value": "49152:642jPfGa80VhQ+QaCjkn0CKygHvP4Qyf9e9iI0Oc:tkXlLVh5wkpKy4v+FQibOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634309083, "uuid": "aae71a77-7257-4321-b0bc-20fa430036a3", "value": 2236928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634309083, "uuid": "aabafb01-18a5-4a2d-8fc3-792eacd753a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634309083, "uuid": "66226d8b-2c2e-4d53-b9c5-b680eff2c907", "value": "ea4b4ec80f45958158d072e1831f8ac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595d53bd-2d8e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634284994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284994, "uuid": "c8b60504-8877-49b8-9598-aec8ea34dabe", "comment": "Malware payload (AgentTesla)", "value": "646801cd4d9d42c5be8b56d4db220898", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284994, "uuid": "7c8d88fe-1a0c-46dd-8815-52678a64f7ca", "comment": "Malware payload (AgentTesla)", "value": "fcf3b5248e8d60621c463b1146df0b10d13bed5dbc9fd70a0ad12d8a1d56f186", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284994, "uuid": "ba85ce66-2e6b-439c-98a9-3ab2d6b47a71", "comment": "Malware payload (AgentTesla)", "value": "1e9a398f3f61c0e370517670b8f1d44016a39f1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634284994, "uuid": "97ab5989-cdd2-43b1-9da5-4ad2d9aacb3f", "comment": "Malware payload (AgentTesla)", "value": "198b1b47942ea30afa68478342aa91bf8905a73b8ecf467bcd9d0ce7f4c074f7bcf86c91c5078df695189d95d22c0119", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284994, "uuid": "bc0806a5-0611-4f96-9f36-7cf693bc0e11", "value": "T16C84126CCF82409BC34B67305D19B592A906E4C3984DEF276EA8569D5582CC0D3AFDCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284994, "uuid": "b5ccdf90-24ba-441e-8c66-db9e6b6200af", "value": "12288:MxSRldkNNjGJ7AX86OeNN/G9k8Nq+7nOHX1A4a:T/4dGJ7u86pNN78Nq+7n21A4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634284994, "uuid": "daeae408-74a6-4dee-85f6-9ea84d3de69f", "value": 401305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634284994, "uuid": "ae1e0a96-c01c-4aee-89a5-e96237447587", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634284994, "uuid": "56785f95-8017-4529-9cae-daa5c38b10a6", "value": "Inquiry # 948493.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d642e610-2d8b-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634283916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283916, "uuid": "f0de3333-9842-433f-a2f9-d0bfea3bfd6a", "comment": "Malware payload (Smoke Loader)", "value": "9651d6cf05d0cf3d8c44c693a666f9fe", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283916, "uuid": "6d221553-eeac-46a5-9796-216ce3c7f701", "comment": "Malware payload (Smoke Loader)", "value": "fd6996eab709c3ed21ef140958d9a9147902336b85b47bc896372a18e469a6fc", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283916, "uuid": "12a41f8b-eccb-4905-9bfc-651b17958e9a", "comment": "Malware payload (Smoke Loader)", "value": "fff6f71b04420fe85c72ed37316ea0f77967672f", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634283916, "uuid": "c0afd4d8-a571-4f61-acce-ced6572ec12a", "comment": "Malware payload (Smoke Loader)", "value": "6a6b9149f6f9fd87bcd27af39e33f23b2d3167fe4140eebb6177a52831a19a90b0cb566cd9a8d97f5fa5aa2fb875aa94", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283916, "uuid": "ddaa9446-0224-42a8-9f07-ef19695751b7", "value": "T10B647D10BBE0C039F1B316F959BA936CA93EBDA1AB2594CB13C516EE46346D1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283916, "uuid": "0b69f505-3ada-4124-9338-4822c2b8809e", "value": "fca1d58205e9c77175b87324501ec95c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283916, "uuid": "b8204097-f15f-4488-9e56-3c200c0ad82b", "value": "6144:w+DZBoX6g+x/rn/6FbaFFvCtG6pt7bBHyer4/WeyPnE5:wwoXC6kFFqHpt7hZr4/Bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634283916, "uuid": "73c1ed26-ea76-40e5-bbd9-e380d37d0927", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634283916, "uuid": "58f9f79b-4c23-45c5-ab1b-9c2f5757121b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634283916, "uuid": "cb36f2c8-9f71-4889-bce8-8d4b60ddb6e7", "value": "9651d6cf05d0cf3d8c44c693a666f9fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e136cbf4-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Cerberus)", "timestamp": 1634300684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300684, "uuid": "7809ac0d-7a4e-4278-bab9-1377bf11755b", "comment": "Malware payload (Cerberus)", "value": "63e94222fde7ff90ddd81341c409f148", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300684, "uuid": "05ed8ec3-2858-4c31-a277-a2253ef89151", "comment": "Malware payload (Cerberus)", "value": "fdd9db26f25d0d784b5692003f46320d8400266b6573d5c8ec6dd6c4e2e7bc72", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300684, "uuid": "d6d54d15-d6ae-4536-9810-d68b106d5bed", "comment": "Malware payload (Cerberus)", "value": "4a911259cc5fb7b3312fb5c41435d05819cf4b81", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300684, "uuid": "e3d77db9-8b60-4d6c-9852-1e7695d6f000", "comment": "Malware payload (Cerberus)", "value": "7eafcda9a4d33d9359ad3b19b3b84ca6ce5db2f660abeb2d7b1cca7a06be53384a13be884cea9f1176ab2c39613ddf97", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300684, "uuid": "af91db62-e89e-4e1c-b84c-6ab93aa4c744", "value": "T12DE523C52A525CB9D1F59C30938371D179307B92BAA6F96A0472B9707F93B60820DFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300684, "uuid": "3eaeec61-7f85-432b-92c8-80b1ddf18899", "value": "98304:qM9aGG8dgNlFdOY6H5uWctMbpys35JSckrE1Fc:RaDFNlTKpy+6rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300684, "uuid": "e9290641-63df-4ac3-9255-6ee55e9c782f", "value": 3242029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300684, "uuid": "8c1bf55f-6175-4fbb-9b6f-ce8c23ea657b", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300684, "uuid": "edfe3491-741b-48ff-831a-43e36c5456f3", "value": "Aleyna_Tilki_Ifsa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5c1220-2db2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634300703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300703, "uuid": "ce66f984-b10b-478c-8112-4d1840297106", "comment": "Malware payload (Formbook)", "value": "5949085c9f589beb144d3754ac2e31a0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300703, "uuid": "11caabfd-1025-4d72-a6c7-6edfcb4aabdc", "comment": "Malware payload (Formbook)", "value": "ff0de96ce6d1caa0b3b22ae460548ba6f9e2bb6a14f5adef42649eda1b204b89", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300703, "uuid": "a8c1b547-dc39-46eb-9e40-381c9cb6c1df", "comment": "Malware payload (Formbook)", "value": "abd9878e3a98a33633329845cb83a15401b39304", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300703, "uuid": "09fd9a13-e63d-4d9e-b2a8-8066764b0842", "comment": "Malware payload (Formbook)", "value": "b136ddc2e020bf43035393d64409ce58f9a9cc361891ca27e2c5f21886488b0c97faa0e2d86ed58dc56095f7f6980fca", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300703, "uuid": "acffbd5f-311e-4ab8-8f34-b121b3f4fc9c", "value": "T12594C651902E3D6FF62FE81C1693E1C8386EA57AA4F0056C939EF014DE259EAED4C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300703, "uuid": "cfcf7ff4-2046-4b7a-bc07-9bba82cdeb0e", "value": "1536:i3/fADDDDDDD6oUix7JIqMRHwZeI/59UK1m2u2m0fhXdzFz76mAg5eeVhMDw5wff:iADDDDDDDgisSdzFtr5RDAw5wff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300703, "uuid": "19c28f25-07bb-412b-b61e-6b405b8825fa", "value": 432001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300703, "uuid": "679942bb-b88e-435d-99f6-b42bf4e2945f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300703, "uuid": "feae8352-21b6-4709-a6ef-f39a318849a0", "value": "doc17981120211014115325.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f75b188-2de2-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634320975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320975, "uuid": "36041af7-1363-4ea4-be22-f3e5ce657a5f", "comment": "Malware payload (Metamorfo)", "value": "299d8ea70fa59e9be1e2f6579616f657", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320975, "uuid": "3d8fb907-a80e-4f19-b0a5-6a58ad73596a", "comment": "Malware payload (Metamorfo)", "value": "ff6fb2c5a38153fc77b94121941d066acbc19c4342cc8208fc5293151a22ff29", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320975, "uuid": "352258cd-12b7-49be-94be-60c50c7f7f9a", "comment": "Malware payload (Metamorfo)", "value": "fe1ba809cac87567f3b21add07dd2f6fc7aea564", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634320975, "uuid": "4c0bf8c1-2d0a-41d2-878c-4c3954fbaaf2", "comment": "Malware payload (Metamorfo)", "value": "821d6ac35ade2f073909532d03972045250e2ad29a16c933393d8621976881bb78b5013acaeacb946472f9019c2d5549", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320975, "uuid": "fa19ef5b-964f-45c6-a676-c748461432f7", "value": "T1C641CF1929EA0319C3B3CF7528FAA246CE7ABD51AE534F5E4084478B1851590FC36D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320975, "uuid": "bedc20a0-fbb5-4b87-baac-d00e9003bd81", "value": "48:8+uH+M+L368tuDeuD91cIXv3KaIqiHkb6NS6:8+ueFL368uSuD91cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634320975, "uuid": "b4d602a9-03c2-4f96-b31b-c7f5be7bb72a", "value": 2046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634320975, "uuid": "b619f88a-9e9a-4cc0-ae46-4019ec3dcaa3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634320975, "uuid": "4080b04c-8398-4425-90c5-9ea018c70490", "value": "Anexo - 15102154890.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99745e1e-2d96-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634288538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288538, "uuid": "85e072fa-94a1-42ee-aeba-efc87524b0c6", "comment": "Malware payload", "value": "145a6c3db2d7621487e6ba65a1e8191e", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288538, "uuid": "30c555a0-443a-4009-a686-e3c5135e3110", "comment": "Malware payload", "value": "ffb5b90289bd85ceb763db59e4656a3a4d00f482777da9476217b4c9f501a806", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288538, "uuid": "509bacb8-b14a-4ebc-b27f-1d6cdda7ad96", "comment": "Malware payload", "value": "0d6a4a5da4d91e3aae77a71ad7ec42d85f9ccf6e", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634288538, "uuid": "f7f1bbaf-fde5-4b25-a654-65dc5ed4b259", "comment": "Malware payload", "value": "b5a043693cfb08aba151e61c821734728937481383e24902ba2bb8cf54fa7b80f2f9e78903ba05f7da7b849335f6f0b3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288538, "uuid": "3371da18-6627-4b56-abbf-33a5e032ff7b", "value": "T1A35412B8D6133BF6D50E20BCD2DAF8D96783988B0294295165DD71A07C839D7357CA0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288538, "uuid": "715ee296-28cd-4a61-8e2b-8439e3c18047", "value": "6144:JG0fZOsznJtInItdbbGIzPy6uYYPis8+Fhv7G1MTIahzvjC08xY3gA:JGcwszJtuEGIby6uYYPNFRGKx6x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634288538, "uuid": "f1dbeaaf-433b-4b8a-bd6c-6838c3088d1e", "value": 305560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634288538, "uuid": "fdff189b-5b68-47c5-aece-8bf7bfdd5f53", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634288538, "uuid": "1c14455f-ba3a-40ed-a805-5dabf9af56cc", "value": "New_Working_Conditions[846682].xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77701770-2db3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634300936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300936, "uuid": "a6cb3bbf-2e87-4817-9868-f883db1ee025", "comment": "Malware payload (AgentTesla)", "value": "2e50e9df7bbf8d24198eb8dff860cc45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300936, "uuid": "379e2ed3-8f0b-45c2-a989-14813b897b9d", "comment": "Malware payload (AgentTesla)", "value": "ffbd9f2074b2eaa45f8562aa8cef8e7e71e8302789e4c6e199b2e15b67adc3c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300936, "uuid": "fdb4211b-93d9-4991-b5bc-3db4e7e8e3cd", "comment": "Malware payload (AgentTesla)", "value": "770d50b0063e5bf318857de414474de0f44d5030", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634300936, "uuid": "14fdde73-60c0-4ac7-aad3-e961f2c5b546", "comment": "Malware payload (AgentTesla)", "value": "0be780fb58496d9da75cbf4172d45dcf1ac4b0344335852ab201c23dc6ed1b768f638edcba7f2f272489eaa42d1c5b97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300936, "uuid": "f9699bc3-6675-4be9-bc0d-78bc134f71e7", "value": "T13105834AE3529D41D59A867350E450E3F70C1C96E4889779AFB3BBE3089E3850B4CBDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300936, "uuid": "c89a18ab-2ceb-4346-9bce-8e088c4af06b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300936, "uuid": "4ff6a176-7dbe-475b-8c7a-1dd913eb48b3", "value": "12288:Evf3JDIL6tSpW0jtsHEN2LqDE0Pmoxj9svVXkZFFbl:CIIkW0xrN2YhmgUVXkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634300936, "uuid": "f114a4f6-7758-4809-b5f8-eb1c5ce613d8", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634300936, "uuid": "3589c350-69e9-4541-bbba-15b1f2922bb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634300936, "uuid": "86942627-04a8-4aee-9a7a-467ec542fcf8", "value": "Foreign_Bank Account Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }