{ "Event": { "published": true, "date": "2022-05-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-27", "timestamp": 1653696182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f733426f-19e8-420b-b26b-7326dd1476bc", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639b9bc4-dda3-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1653645436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645436, "uuid": "d815b11f-5a58-491f-8180-35df91144c1d", "comment": "Malware payload (GuLoader)", "value": "46eb0d822eb58088e86583e512370cbd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645436, "uuid": "1b264238-623b-4a40-a4fc-f5cc644a743e", "comment": "Malware payload (GuLoader)", "value": "0065c929b1450a6dcc5f00902012b389364570e76aa935f372605af7b8e59eaa", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645436, "uuid": "bcd02bff-66f1-4916-8384-e9b5515b3285", "comment": "Malware payload (GuLoader)", "value": "011d505a54497663d6de0db55cd4b5a88f2f0cff", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645436, "uuid": "721e6445-5bd3-4f6c-9d7d-05f23e8ef9de", "comment": "Malware payload (GuLoader)", "value": "da6ba13c92924120d6f240c6fe87e586e206372cf30f601e47867ca8292fcd512a2b8f97f04123229bad084ddb4d4654", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645436, "uuid": "1930f34d-22d5-465b-9199-cb117d360f34", "value": "T10DA4232A1F95A4D07362601EF3F6A50652D4271334F7BA79F0346A0E0587F1FC4AEAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645436, "uuid": "87563bd0-cb27-4da0-85d5-a956172cc4d2", "value": "12288:gt+yxdaKspmqgMdmiLLPzZhHtHa1vzJmqL:gRCNhxfnk1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645436, "uuid": "1ea94a74-3902-4457-bab2-364a44ab04a1", "value": 482435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645436, "uuid": "c0b31c03-442b-4a69-a53d-ba8e2c37a49c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645436, "uuid": "4c2a8e65-238e-4c64-8d94-7d809026f11b", "value": "TRANSFERENCIA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c046741d-dd65-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653618962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618962, "uuid": "2043f954-06f6-4fab-b1ab-61508a79fd87", "comment": "Malware payload (AgentTesla)", "value": "960bd44b02cf758f2c60d9f5a2bcc610", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618962, "uuid": "424c8a90-255c-44ba-99da-6b0a36f235e6", "comment": "Malware payload (AgentTesla)", "value": "00dbfa467ef14cab6eb8cd82c787f0694be146972fa82ecba2c243b170125e6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618962, "uuid": "40a95bf1-7d1b-41d1-925b-1e5a515fbb38", "comment": "Malware payload (AgentTesla)", "value": "d574cfacebe063f340ce1458f8e9fda117d5410c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618962, "uuid": "2e9da667-3f0e-43c8-9faa-c1ada19d4886", "comment": "Malware payload (AgentTesla)", "value": "79904630faca46ea29dd7ecce4c78560c8ff6b88fa959842461be084e05ca273430f7f97785e3f531ae7b89776fefd41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618962, "uuid": "643c9085-b1e3-483f-b3fe-96b061cd13fa", "value": "T153E4C220261ED815F2D5F6F641A341F527B87C4F3D92E89E3AA6745B00687C3AF13A2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618962, "uuid": "788d0e07-81af-4afd-81a5-6a0764ce3122", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618962, "uuid": "8efd88ca-541f-4e54-87f1-81bab72335b6", "value": "12288:TZY9BoezQf/v5Fuimjru4jKvyFx0oQWzUSZDyxkzqfJr:T4Bzsf3xUrBusQWzUe0kz4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653618962, "uuid": "09035f0e-998c-4d52-ac9e-37c0ca70aeb8", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653618962, "uuid": "22f64885-a453-40fd-8c9e-fa46b7384f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618962, "uuid": "ff861f5d-92c3-441a-9c85-9f3809bbdc15", "value": "SecuriteInfo.com.W32.AIDetectNet.01.4585.22782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4ee7fb-dd8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1653635033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635033, "uuid": "d631776b-bd3b-41f8-914e-009b10fcd6cb", "comment": "Malware payload (Hydra)", "value": "90b53b42373895894c4308255d22c041", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635033, "uuid": "e10dfe51-2400-4b31-a73b-104ee0c149ef", "comment": "Malware payload (Hydra)", "value": "0172dad67e9b8cf1c3c08433138cf588064d2697c0f3f958fe9819f72b4874c7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635033, "uuid": "9a033a4d-1006-490e-8a20-2d103d6bb4db", "comment": "Malware payload (Hydra)", "value": "44febd5e5f5548fe8730091f86e05a899449a48b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635033, "uuid": "e6cd567c-8dfb-4c25-84e7-036c04f1fa81", "comment": "Malware payload (Hydra)", "value": "321d4979660be2c36348668181962569f3e204d7f959b7657c240b72c4e6b439eda089e2fca0c808c752135cd2d94dae", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635033, "uuid": "cbe1094a-c8ef-4ff0-a140-cb1d5ca14c0d", "value": "T129F533B25B8C849EC9F7BC37241DE5458D256F568ACB651BB88070E3347FCF9A220792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635033, "uuid": "b0343a50-7759-4f4b-bec9-e40b3d1a6f0e", "value": "98304:cXt/dkHGZNmruxhCL1yLKKu2m/bHrmxeb1NvAVzse:cXtlkHgmyWIe6muxg1Nqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653635033, "uuid": "38d6f01b-570e-41a0-b1b0-e8a86cfd775e", "value": 3321698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653635033, "uuid": "f5116771-7806-4f38-ac64-f4dc361c8c3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635033, "uuid": "fe44c846-d29c-4b18-887a-82dd1db8aa06", "value": "FlashPlayerV1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bcfb6e-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653643590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643590, "uuid": "4d8f85bc-f1d9-4f25-9dc5-7f9bfd9de89b", "comment": "Malware payload (RemcosRAT)", "value": "5a6b42a5e0c27c55ba79ce9effd31e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643590, "uuid": "f9c9d237-4dd9-48ea-b01b-a91609a4bd63", "comment": "Malware payload (RemcosRAT)", "value": "01f5e461193a3adce502959e029cf52b8e9bf0a9cd1bf06c9088edddb4f643ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643590, "uuid": "e8dc9a9a-e9b1-4265-93ad-4d2b7d200931", "comment": "Malware payload (RemcosRAT)", "value": "926a17bfb8476ec6357ab444570ba444500a68bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643590, "uuid": "c9c0bfc0-6fcd-4f25-80d2-2a222ed32dca", "comment": "Malware payload (RemcosRAT)", "value": "fabf91e35d5d75a76dd937bea664a1992aa1ee9a467c8e47a974a5032e2eaf604d64761eb157a640d3aae14436f510bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643590, "uuid": "6ef08060-789c-450a-ae71-1b3abde92447", "value": "T197E412687054E017EEC9353A9FA4CAB563A59CED5C165223B6F43FCF3BBC1576900221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643590, "uuid": "0ea02f4d-6c1e-4d96-97c0-a80fd9848b21", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643590, "uuid": "d321c011-7124-4dbd-97f6-8bcf7cb9c981", "value": "12288:5FFJBvClgeE6rcOiqU1Z3JWUNIm6XPVD+oKUT:lTvReE6CqU1Z3zNIB/V8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643590, "uuid": "fb9c52bc-8b87-4897-941c-4eb9de4f4a16", "value": 672541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643590, "uuid": "155203a0-808c-463d-8833-95663b632f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643590, "uuid": "8ea0b76d-e951-4b07-b156-472468fbf9ed", "value": "PRE-ALERT==HTHC22041485==FOB SEA FREIGHT INQUIRY FROM SHENZHEN CHINA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac2b52b-dde3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653672909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672909, "uuid": "f5a2bc8f-8e41-4b06-9b8f-7771098116e3", "comment": "Malware payload (Formbook)", "value": "f9c710eee0ec4b46dfb370e5e2280c36", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672909, "uuid": "4b2811d5-620f-4170-a4ae-cab270833cca", "comment": "Malware payload (Formbook)", "value": "02cda7e8e87599f480515b611d57653429825d45dbfd2bcee0b9f1ea8e845fc6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672909, "uuid": "5a74700c-5ea3-4c07-b1dd-9b0066a295f5", "comment": "Malware payload (Formbook)", "value": "c5b21cdd87ec4c5f8349747ecab5963b40556081", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672909, "uuid": "31d3ad22-bdea-476d-8c26-c67e0622a7b8", "comment": "Malware payload (Formbook)", "value": "f21b2120155d3674cdff40a9c36e002fc7af9954e26b93e95a2e7b552143984d7ba9b2d1ec54064e7c7fc0d9988fa6f3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672909, "uuid": "65c3e315-82f3-43b5-a37d-e3689b4c90ab", "value": "T12FB4E3E605844B32A2A5CB6D1B314157B36F47D43127F391AA923DE58D82E058BCFBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672909, "uuid": "16a8102a-c26b-4cd2-9b15-97f5cec2b77b", "value": "768:EeQeQeQeQeQeQeQeueQeQeQeQeQeQeQeUeQeQeQeQeQeQeQeU:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653672909, "uuid": "4b654808-2019-444c-9917-c37a87a39690", "value": 524049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653672909, "uuid": "d5076074-a4dd-4abf-9750-678e4541de9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672909, "uuid": "616f9ed7-2716-4656-8629-ebd3cf7eacb2", "value": "NUEVA ORDEN DE COMPRA 80107.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf1cbbb-dddb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653669582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669582, "uuid": "8f27e362-11d4-4f78-91ed-10afa2a27fc9", "comment": "Malware payload (Formbook)", "value": "c3230d83ea024fad0e4dc18e3b5ab538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669582, "uuid": "b8d771d2-c312-47d4-961f-ef2e1fa2f7a4", "comment": "Malware payload (Formbook)", "value": "03fa6bc991b15a3d5cd507673d1cccd0b0279315e9a04924d908a9520609a1c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669582, "uuid": "06bf7b31-f5bb-4af2-b843-2adad66505e7", "comment": "Malware payload (Formbook)", "value": "980bbcd33a8d4f78a4e373e199f930730b73b548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669582, "uuid": "ddb52294-88f2-4f24-a02f-09a696239cf3", "comment": "Malware payload (Formbook)", "value": "2be418e32d783764d84d425af6cf31304404c6f19c30a9b11b71706ca587aefa694e445c9e3a7deedaa9706bcea2f02c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669582, "uuid": "eaa55029-e77b-48ce-987b-50426458d2ca", "value": "T1A405CFBC71907C8EC467DE7A85785C6099213C662B17C20B91173C9E6A3DFE68E14BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669582, "uuid": "c43ea27d-a8bb-4c36-9437-3730f7956f51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669582, "uuid": "def4452b-ba60-4ad2-b8f3-fed6180e6e07", "value": "12288:nWK/Ee89bHoAU9vqVCueltghYgEH0fAfCOHF1yxT//JAoG0ynApoHgecgriYRTrI:WK/EeobHo3DUhuHKAfCM1yxjJAdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669582, "uuid": "22f017cc-4094-4be2-ada2-ccdc3d2b74dc", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669582, "uuid": "1d1799dc-4553-4b0a-8091-0a74b501ba28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669582, "uuid": "28bbe10c-2987-44f4-9352-56f64f635605", "value": "SecuriteInfo.com.Trojan.MSIL.AgentTesla.ETN.MTB.22637.31446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312b55f2-dda9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647928, "uuid": "c7489a4c-08ba-4826-8325-9851ed47963b", "comment": "Malware payload (Mirai)", "value": "7f845fc6d136ad7ed807009a0944aad4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647928, "uuid": "9440cc5c-65d1-48d3-8f74-56970955a1a4", "comment": "Malware payload (Mirai)", "value": "055e8f5b17446552bea5cc110e1109d37d236d255be8f6071cac94d0832ca677", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647928, "uuid": "3482d80a-d2da-494b-bce5-a810dac3f683", "comment": "Malware payload (Mirai)", "value": "71a2306110e5439c2aabb1a5705dd824fb7c06ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647928, "uuid": "1f3cb2d3-4235-4530-9ed0-f0fab28bb3d8", "comment": "Malware payload (Mirai)", "value": "19a618b23c376bf9b8e44eb23ed6c02f0069e894137358d781551476342979040f6389ccb2faa8570e7c70eadcd977c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647928, "uuid": "35f37370-513f-4df1-a989-db67f05678e8", "value": "T14F53AFA2C819BDD4C4008234B522DEB82B53F40996671FB58E8789A55447EFCF52E3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647928, "uuid": "63bc1d8c-bd2b-4ef4-8c32-b4826bf83ef3", "value": "1536:ua4XhFb4AEfNmnwt1o4GUaZt/NNUXTHBUuvqCUdu:uvhx4AEfNk3bOH+uvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647928, "uuid": "6c808f48-44c9-43e3-80ff-6fb22d69e0c1", "value": 63864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647928, "uuid": "8f04b225-4885-4493-a2f3-794e30aac120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647928, "uuid": "c5adba91-c708-44b7-beed-e3a8707066f7", "value": "7f845fc6d136ad7ed807009a0944aad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c75064c-ddc8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653661261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661261, "uuid": "50aed6d9-19b5-4a73-adf4-25d26438e7af", "comment": "Malware payload (Amadey)", "value": "a76608f42563198c86f4a7f10ea910cc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661261, "uuid": "e0b41d4f-c55b-430f-8368-763b76cd8ab8", "comment": "Malware payload (Amadey)", "value": "05a3028bc4f10ff3387b486c171178f7d5a4864de59f6693d2dcbdae035820d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661261, "uuid": "94c79924-ca1e-4d76-ba3f-2db0e4beff76", "comment": "Malware payload (Amadey)", "value": "8ea79e0e0523e9b7d1993ab08408d3b369c2a802", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661261, "uuid": "f7d7df8c-2101-4e6a-a3f4-65b64936c12c", "comment": "Malware payload (Amadey)", "value": "507dbcf7fb417c83d44b1bf5f3a4b8da8d56002c050a068e1d46f658aa94ae48b7e7bbbb7658845398d5fab3553899cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661261, "uuid": "6b39f475-5f18-4b14-a098-a42c031557df", "value": "T1EF84E040F790C870E45A1E344464DBB25B3BB8626A709507F7949B6F1EB33D09AB732B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661261, "uuid": "0bc5e3da-7ae9-43fe-b611-53adac3a44fb", "value": "151adccff5e70213fb31de55ca880f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661261, "uuid": "cef1695f-5dd9-481a-b29a-040037c44925", "value": "6144:AEoO9umboh5zS8mJWHiePpHhrrJYyigaJwVf2:+O9joTz9tieBHhrry3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653661261, "uuid": "0917a402-ae0e-416f-8256-c04ac2102641", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653661261, "uuid": "49ee9106-11b6-4b63-a616-d7bde40d44c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661261, "uuid": "7e6b511c-0aa2-40de-b892-1832adf4e83b", "value": "a76608f42563198c86f4a7f10ea910cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68975079-ddc7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653660906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660906, "uuid": "28b72d37-59c9-49df-9c95-98bf47f29714", "comment": "Malware payload (AgentTesla)", "value": "01844ea0e93a3c408e3d37c577723b85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660906, "uuid": "9bacb6ab-a9aa-4e94-8cf1-cf3f28e0bab0", "comment": "Malware payload (AgentTesla)", "value": "0605d3622a953ea5b976b34f80e5fd3704c6937644cb6fb11a88351aaf0d110c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660906, "uuid": "52076f09-e246-4239-8ac9-f6863efe0c40", "comment": "Malware payload (AgentTesla)", "value": "80e590ab91b85948fc890a1726ca529de30c9a3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660906, "uuid": "b2f6833a-056a-47dc-8d87-258c67803c93", "comment": "Malware payload (AgentTesla)", "value": "24502e35d9a850520c6788dba92d1ced577bf9bfaa89386f4aeec08a019ab585bf8ce9e489866ef6425fd620cddb3e31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660906, "uuid": "ab2a831b-2900-46bf-84f1-5b9bf8f17f82", "value": "T1C5F4F180707A4863C2AC15F941A1F5801BBC9D276D1DE1C76CC279CFB8E6F898ACE957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660906, "uuid": "f3f5a576-2f4c-4a54-a1f9-52eab0249aa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660906, "uuid": "99105b77-a68b-4475-ba9a-faf3b7b654e6", "value": "12288:uxdZ9bHoAU/vqVGy3hfiZsRxINqlraIWSA8xTR8YWKfUJlRqyn7dXjg/t:ux5bHo5y3hwixlraIWojcwynJ+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653660906, "uuid": "c4ebd7f0-d39e-4b6b-be3b-5ef186ef15fd", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653660906, "uuid": "f0f0b632-1d7a-4fb3-b38d-1c2bfae6ad0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660906, "uuid": "519271e4-408a-4abc-b6c4-e05462b5e130", "value": "SWIFT,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd31cb2-dd5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653614660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614660, "uuid": "3aa3a854-3f8e-4b4c-8bfc-adfe77bf9e33", "comment": "Malware payload (Heodo)", "value": "0c00164733e326031cfe2c266ee57d00", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614660, "uuid": "fad7b2d0-699d-4d66-97de-0d913eb771d6", "comment": "Malware payload (Heodo)", "value": "07a28d5157194a1d6783772938df15e2602ce3286d1df4fd2c60cf2f9269f09b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614660, "uuid": "38176318-58f1-476e-a825-c92e1e333dec", "comment": "Malware payload (Heodo)", "value": "900594967198267218c8fd9fc37719b24c33f8d4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614660, "uuid": "7c99942c-fb56-4595-9487-da4898aaf208", "comment": "Malware payload (Heodo)", "value": "d73c89f8b4ca8bf0fd31da8a0eec3a512552c8f0258ca372b76a97bea660f18956d2c98a4bc96a127faa9ae15245ec18", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614660, "uuid": "6828b44a-b4a6-4e12-9761-e9b6ea9d4191", "value": "T16BE49D01F2AC80B2D06FD13989A34A4AE7B13C9497B593CB5251FB3A6F732E15D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614660, "uuid": "8e3921ab-c4eb-45ed-92bc-4342e32f93df", "value": "b7b90674fa6c5f9a16bdab0725f21bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614660, "uuid": "bba902a4-0877-4ec4-a811-e80dec2717f2", "value": "12288:8nUIW4anSDGCH0fu1QJKwjbe1gUK7wrnUfpE:kUITnGCH+u1QJKdCwrUfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653614660, "uuid": "a381ec82-b4e3-4b67-b9b7-3039340920e6", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653614660, "uuid": "e7d846ff-d352-4271-9aa1-77c8c25d0987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614660, "uuid": "5ad1871a-e4ba-408b-9eb6-8585ff1daf12", "value": "0c00164733e326031cfe2c266ee57d00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caeb2933-dd5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653614685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614685, "uuid": "ece70b9d-17ab-440e-a79f-4c5d016da600", "comment": "Malware payload (Heodo)", "value": "840fb559ef84d541b435871aa70aa79b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614685, "uuid": "3f93abba-bce8-4976-acd5-8b907c98ea43", "comment": "Malware payload (Heodo)", "value": "089fd4b65a420b5033f4bafa24038872dc903ee589b5ea62899b3faafa832689", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614685, "uuid": "c8fea9ae-dfb5-412b-9330-4cdd3ed8a380", "comment": "Malware payload (Heodo)", "value": "ecbcda9fbda5912ba2102d900f6465c034f307c4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614685, "uuid": "0d962401-ac3d-4607-bb99-a3f4cee37042", "comment": "Malware payload (Heodo)", "value": "e514418b7c3c36ea2532ca09c7927a39f62063136b5f85c8c2574b96c37fae0745ea1c06f54ff601de054197ecfb52d9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614685, "uuid": "59d14864-cd24-4977-a8a6-d8db2cab7006", "value": "T100E49D01F2AC80B2D06FD13989A34A4AE7B13C9497B593CB5251FB3A6F732E15D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614685, "uuid": "d19f0430-a6bd-4049-8fe2-1118d10bdcac", "value": "b7b90674fa6c5f9a16bdab0725f21bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614685, "uuid": "c6d36b3f-e4f0-4314-93ab-f56f74693370", "value": "12288:8nUIW4anSDGCH0fu1QJKwBbe1gUK7wrnUfpE:kUITnGCH+u1QJKHCwrUfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653614685, "uuid": "2268b7fd-c6b3-4076-9280-a501e0d7855e", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653614685, "uuid": "0466cfd7-c0ef-48bf-a5db-86d4a46acdff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614685, "uuid": "0c5a943e-a3b9-48b8-870b-7f24a29a69f8", "value": "840fb559ef84d541b435871aa70aa79b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08040d2e-ddbd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1653656449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656449, "uuid": "2692129f-0955-401f-8f77-1fa0e32f26dc", "comment": "Malware payload (SilentBuilder)", "value": "2e46b11cd58cffb32de78fb7f77de5f1", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656449, "uuid": "677591f6-629e-491d-8702-bcb364c2dcf0", "comment": "Malware payload (SilentBuilder)", "value": "094aaacbec3491ded0f084554f3d27c870558000beaedfa9515397b3bda1d7b1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656449, "uuid": "148e70e3-414f-4654-b52c-ce7057bf9c4e", "comment": "Malware payload (SilentBuilder)", "value": "3392f47d6f4b72dade4eed74adf63002a245a65b", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656449, "uuid": "67a34a92-45d6-4f57-8d9f-3c48c4513751", "comment": "Malware payload (SilentBuilder)", "value": "78b5bdec995e0048a98e686dbc2d7a27f1ed8a885865b992aa4fb2dde93a2e9bca588772d311d9d9d846d9483279014d", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656449, "uuid": "d3d99f2a-d43e-45e6-88dc-041ed8b9c2f5", "value": "T12B634B59B769885EE9198B3048F747D66323FD308F5F0A433259F3926FB95A0670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656449, "uuid": "259d54b0-bc28-457f-9072-b7f3a5fa1c40", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+/+hDcnTLiQrRTZws8E7K:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653656449, "uuid": "c50cf30c-f8a7-4759-a999-45505a6dc51b", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653656449, "uuid": "5e81f5be-ee7d-479c-998d-11339fff587d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656449, "uuid": "9d81c963-78fa-4ff4-84e4-175c8be6e979", "value": "x 27052022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab71a15-de0f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653691941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691941, "uuid": "c592c625-a7ad-4998-a314-2b3797750339", "comment": "Malware payload (Mirai)", "value": "c696f72d96612c4672a9f137590fb49f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691941, "uuid": "251e46be-372e-44fd-8379-3ff30114ab08", "comment": "Malware payload (Mirai)", "value": "0a0800b402d3ff8d44cda6a3183f970fc5c4f5cb7c79851270972ed975c20ecc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691941, "uuid": "36be76e2-862c-4689-bfdf-96c711df263e", "comment": "Malware payload (Mirai)", "value": "b306de912eefc4d7ef971250cf0ffbf520440c6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691941, "uuid": "0d7d874e-340e-4d88-80ff-9d3d8201d7de", "comment": "Malware payload (Mirai)", "value": "f4947876834b12009dce2b7a01b36f5cdceecfad56656ff312848b919cb811f5fa0eb07595496756ee917d6beb0cfc9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691941, "uuid": "cfa66457-3566-4d70-a74f-1985c727bc20", "value": "T1A0E202A7F434278BCC9F063C685C904A0484EAA9E94C5CE189EC267DDC6CF37161CBDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691941, "uuid": "fe149592-d5cf-4fd8-bb62-a7ff93103a26", "value": "768:zNUf3MXfVhhZAKd/jOJHdJ00g9BKTNnbcuyD7UHQRj/:evSdhhld/2feBKpnouy8HyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653691941, "uuid": "4f0dee81-8008-4d79-adba-de2ecaa2b1b1", "value": 32196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653691941, "uuid": "cd30faca-6465-4869-a9ad-538f7fd078e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691941, "uuid": "2fb71489-82f0-4ae0-afd9-47222745ca6e", "value": "c696f72d96612c4672a9f137590fb49f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a95f190-de0d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653690813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690813, "uuid": "a3b17acb-1fcd-4223-b7de-686b34ce364f", "comment": "Malware payload", "value": "76b564c44ae8310f2c6353f2e209f663", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690813, "uuid": "11de31ba-e7f5-4b9b-a665-a5e5ed0be628", "comment": "Malware payload", "value": "0a2a59ec619fe14ee8f2bd86590fb4ce2ce1f59c93f098a946c0e81a01a0e1e9", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690813, "uuid": "0b443a88-8aca-458f-b8d5-d1c63bb703db", "comment": "Malware payload", "value": "53601695d5943036a3e8f4b93f1fc7dfe2a10754", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690813, "uuid": "731baea9-b853-473e-ab58-071ada2c0268", "comment": "Malware payload", "value": "7b07d1c5f95791e8ebe9e4e873620b9af0e748dcf6f9a94a114ed26e0f76d31c4d3c3bf1712d3ded5427093509327d07", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690813, "uuid": "a742ed7c-3ca4-4c4b-a431-26b514912e4f", "value": "T181634B59B76A885EE9198B3048F747D62323FD308F6F0A433259F3926FB9590670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690813, "uuid": "52fc1040-03d6-4ca5-a13f-8ede3d1e9585", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+4+hDcnTLiQrRTZws8E1:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653690813, "uuid": "eea0f6ef-45db-475c-a11f-6c041616ee0a", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653690813, "uuid": "56ff21a1-2801-4216-9209-281204655a44", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690813, "uuid": "fff66b49-3a12-4314-bc83-2c06a0f7e14e", "value": "SecuriteInfo.com.Exploit.Siggen3.32798.20743.7560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5539fdfd-dda4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653645841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645841, "uuid": "613b95dd-88b8-46e4-a416-7f9ce4ab6f92", "comment": "Malware payload (AgentTesla)", "value": "80fd02633b97d01bdda8f3c2f978e70c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645841, "uuid": "213ace7d-621a-4264-a25f-a84ab535e87b", "comment": "Malware payload (AgentTesla)", "value": "0acc20c8c42597c4f5d200630b32e236be2fd41c6a44492dc5612528a3afa641", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645841, "uuid": "39be5e77-e963-434a-863b-cbd4b44a2be8", "comment": "Malware payload (AgentTesla)", "value": "f5c87c1c00f31565b574116992c7edd428088ef2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645841, "uuid": "bd4c9539-5011-4db7-8bd3-09fbbb9a3595", "comment": "Malware payload (AgentTesla)", "value": "a3187f63066a28eecdf411bf6e2f5374a574bd961abd16f6505cf121360d18286ba6e7125211d8a372188b349d3a894e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645841, "uuid": "28312bf6-972d-4f21-a0d9-081be6cccc80", "value": "T12BC42351A30AC158F9CAD78D2A9E50BAAB228D25C72F7FD01B4727BC40DB23F5742970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645841, "uuid": "ade6ea67-a019-4a53-8833-0476547f037a", "value": "12288:xzlism3YGFocKGMTPjh6Vx4nntar2JEScSSVHvetY1gW4km:dGIh3GMTPIGt+2pSzL4km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645841, "uuid": "3f72a6bd-8f13-4e07-a293-6ae23a617b05", "value": 580205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645841, "uuid": "dffb7522-d978-4d14-a7e3-0d4644367f73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645841, "uuid": "fd029b45-3468-4aa0-b428-0cafbc2eb14e", "value": "document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d223807-dda9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647921, "uuid": "1889d723-3ac9-4c55-8e58-bd7430c63600", "comment": "Malware payload (Mirai)", "value": "b5660f088986018fa298d24c130160e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647921, "uuid": "b6b371e9-43e8-46c0-afe9-77e21ecd7712", "comment": "Malware payload (Mirai)", "value": "0b1708f6466590643a7e2b64df04861c23d0916e3bc292f7a7575d811c5904b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647921, "uuid": "d1f97e13-c843-45d3-bf3d-c1df4af47ccd", "comment": "Malware payload (Mirai)", "value": "799e0478a8a2aac7dbced84a439d4de1e97f6e3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647921, "uuid": "0c725f74-54f2-4dd0-bf53-db52ef5b4b52", "comment": "Malware payload (Mirai)", "value": "609433dea556844d61231a2353aa525a6f22056d9e6fa7149d4a4ec208615505d4a37d5663818baced4243a83d880947", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647921, "uuid": "795aafd7-ee16-4b21-a534-1e3e24bf156b", "value": "T141E35C46EA818F13C4D5177AB9AF02893332A75493DB73069D186FB43FC6A6F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647921, "uuid": "38f85c2a-129c-40af-b8df-1d16709f043c", "value": "3072:aJw9JAFjd/McSi9mJOTW6X72gM0liUoNEWztr3FckiDaSLOfM/9oFLxh:aJw9JAFjd/McNmJOC6XOrEWztr3KkdSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647921, "uuid": "f60dc04c-162c-4d62-9095-e71b2c59ddbf", "value": 146259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647921, "uuid": "2496ee6e-167c-451e-b8c1-22309c2d733d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647921, "uuid": "70d0db82-2098-4ee4-b9d5-6abeb9d86c5e", "value": "b5660f088986018fa298d24c130160e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c690a9ad-dd8f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653637012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637012, "uuid": "660de79c-841b-4dd2-9a20-6912449e9650", "comment": "Malware payload (AgentTesla)", "value": "1791072d6721c88d9c810caaa217d1d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637012, "uuid": "f89a97e2-3e9c-4ef6-b988-499b5841f1eb", "comment": "Malware payload (AgentTesla)", "value": "0c62b643d435b90eb8f105b6a91ede35326ae259608e0cc9181cafe1f951be96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637012, "uuid": "911184ae-104e-4ba4-a134-506fe6e2d827", "comment": "Malware payload (AgentTesla)", "value": "bb4484750ce72afaa5389a7aaa407a2b778df962", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637012, "uuid": "835b1910-ae1e-4a1f-b760-ddd2c6109894", "comment": "Malware payload (AgentTesla)", "value": "f8cb7942d79484bc389e33c6ae6e6360ceb45209861f381c27d84e16a19a1add8bb3723a53b2a48a2edd1aab66c78fe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637012, "uuid": "e58542ff-1c9c-41db-ac01-8a0649c1ab26", "value": "T199C4CF21372C7F11D9BADB391164C04003F4954EFF63EA0E3EA728CE55A6B919772A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637012, "uuid": "18fe928c-a526-4dda-b356-99b7d334686f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637012, "uuid": "335a423c-6f3d-41b5-ad41-ed4fd0070b20", "value": "6144:wx5MsDLy/7Ki2WKrjehNhBoK3G3pPqedi8lUQfE/EnD9TXnxkkXMiZQCz3SA:wbMuLyYANrLW5iZJj+1xRnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637012, "uuid": "9f6660e4-3199-44e6-ac2e-3edcb8367070", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637012, "uuid": "f9754770-99b6-44b3-b20b-6e380c0bfa26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637012, "uuid": "79de87ba-642a-44f8-a1fb-88401064578f", "value": "new order RO71011208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914100b4-ddca-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653662263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662263, "uuid": "19cc2fae-d5e9-4cbf-8b80-612f6778cb30", "comment": "Malware payload (AgentTesla)", "value": "02d6ac6ec4a12ebc4c1d9166b9fd0e86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662263, "uuid": "09f349f0-7d2c-49bc-8134-5c58bf4d8c71", "comment": "Malware payload (AgentTesla)", "value": "0cefce0036bdcae72d06ede18a35ae7d38ea378aef702c2bd67006670c19bbc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662263, "uuid": "f09ac09d-3e71-4c04-be89-94dd404d4c54", "comment": "Malware payload (AgentTesla)", "value": "ef8b52fea288cc7bc4c7c486d50b84461d73e741", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662263, "uuid": "eb096035-d710-453a-ab2f-121e7870c3ca", "comment": "Malware payload (AgentTesla)", "value": "a024fa72bc05ec012ceea0f9fa3a8c156b8693dfcf3bde4972b0581c009167128f358bec3e1052b61b90758902b4a56d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662263, "uuid": "2a96a177-0233-4dc0-b765-f6ae431e6fb9", "value": "T103F4F100B2F82B12E6BA67FA9670609407B67D952530E39E1CD17CDB3A71F524E81F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662263, "uuid": "3ce53e43-e6a1-4b60-8732-e412c2b50d68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662263, "uuid": "596eb537-66e0-4169-b25f-ba9cc953d618", "value": "12288:sMa172O9bHoAUPvqVwlQ3o7MblZK9+U3ocl+BUrxQ+7JMb/QHdnPwXT5G:iYSbHoNy3awit3ocl+Wr++7c/QHBaT5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662263, "uuid": "c7531514-b807-4d1f-8ff3-66f59f318646", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662263, "uuid": "c7484ec8-2381-45c5-9dee-b72a1bfb2de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662263, "uuid": "882880f2-0a1a-491c-b536-52291d758b17", "value": "SWIFT_09903094858577_900039388883-TRF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0948dc80-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653664182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664182, "uuid": "3d4d55ad-3167-4e31-a1c7-c3aaed871c10", "comment": "Malware payload (Formbook)", "value": "2fe5fe73c0aecd9f18bb65edf89dfaf6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664182, "uuid": "4b396521-fcaa-4e84-be90-07f5b7612d8c", "comment": "Malware payload (Formbook)", "value": "0d49317865221f81e49e88f6473af6639f15725fa9c894d1d4ee605de3951b65", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664182, "uuid": "06cbc22a-578d-4703-afdf-3fd7fa02faae", "comment": "Malware payload (Formbook)", "value": "73ec41a37aa974a64b0689c5772f50f603bde8dd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664182, "uuid": "32c0c38e-53c6-4dbb-9e94-4fa1ae9c1aa7", "comment": "Malware payload (Formbook)", "value": "c0ec3918b0f6d38ab956875c3cef579162b7a605c52c42923b8203366dc7f1403dc2defcb72eaf3b033f18a2fc6c9ad2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664182, "uuid": "f36c97ec-e056-4579-901e-db875eacf660", "value": "T11184DF1523EE6093ECC9C8B45E85C6B58A6FBE124C359047728C6AD9DF3F5AB80913D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664182, "uuid": "34f8f89c-fefb-443b-b4f7-c04637c031cc", "value": "6144:I0YnOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOE:6OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664182, "uuid": "458c7e33-c109-400c-b49a-25786397e4e6", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664182, "uuid": "0eba0fd3-9818-40ab-af0b-821b1112ce71", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664182, "uuid": "4f304775-59aa-4a94-8b8d-3563f17ecef1", "value": "Swift Copy 05272022.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e382a41-dddb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653669586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669586, "uuid": "84097899-d555-4581-9a2f-d7efe3a5b14d", "comment": "Malware payload (Formbook)", "value": "ac85e260ef18ab08b53e04177e8c04a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669586, "uuid": "bfb8b6ed-fadd-4a87-927d-56bdb7bebdb4", "comment": "Malware payload (Formbook)", "value": "0e3a4f080d2ff0bdfa0a7e39df4982232b2d19245e6355e49940c05becfeecc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669586, "uuid": "245d7041-b4c4-4487-a51b-e6a04aea8afd", "comment": "Malware payload (Formbook)", "value": "1137e2caa9848d3b804fecb01e12624bd5fb62bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669586, "uuid": "993b1467-8df5-44b1-9349-e2bb7d4fa5e0", "comment": "Malware payload (Formbook)", "value": "c9f53705b009ce1f56d4262cd569c2927ffc5ea9ccaff405a76276258c6f718d987342e84707cc65641dd0913de01607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669586, "uuid": "ca309149-5c0e-443a-89e6-3341e2957c2b", "value": "T1D7F4E06A76679E03C11823B480C2E41407F96107A573E3C76FC761D72B1ABE59EC9B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669586, "uuid": "ea720a86-5554-4041-8a04-eca2e5f8e583", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669586, "uuid": "f5b0c484-0ad4-4931-ad40-035d30d6756a", "value": "12288:Moa7mYn3GNG2p0I8WRnyGTd+p2YH0UUO4NQ4mYvZ0obd:Mf7mYWNG80I8W5yGTwp25UUO4C4mYxjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669586, "uuid": "37d5db17-ae0c-4753-a0c4-6cf2e681a9f6", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669586, "uuid": "01be3e9d-95a3-443f-865e-ecc4b3c09b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669586, "uuid": "551279b1-9754-4a7e-af0b-0225ed583c44", "value": "SecuriteInfo.com.W32.AIDetectNet.01.24194.12957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a89a89-dd94-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653639002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653639002, "uuid": "e02c29e5-2c24-487c-9022-204f5945ae3f", "comment": "Malware payload (AgentTesla)", "value": "4376305aacc2e113978ae0843376a34c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653639002, "uuid": "beb1c88e-def1-45d0-9ea7-938da6d9ebb3", "comment": "Malware payload (AgentTesla)", "value": "0ea25b3d97e0ddb5ea1747770ae70c50a6514f7ff975042c7bcea0b2a8a21d11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653639002, "uuid": "67ebf4ef-4fd6-41a9-b876-173faf67577c", "comment": "Malware payload (AgentTesla)", "value": "6b9ce48104669df1fae77db18ea96e96007a5540", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653639002, "uuid": "dd0b662e-7231-47f1-9fc4-d8c79948f147", "comment": "Malware payload (AgentTesla)", "value": "8bb123a7df606a3afca72359f20606bca8648411ca54e4490d0b8cbfe1e78a8e0c908ba3e02b5a07518ce2215ca144f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653639002, "uuid": "7ef774b1-cd2b-4d6e-bb7b-427b6170b94c", "value": "T1F0C4CF213B5C7D13D2BADAB911A1800011F09A8F7A23F62F3EB754DE15E1B41A771A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653639002, "uuid": "3e68117e-fd67-4c0c-9f12-005bc694d7ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653639002, "uuid": "cb810781-6306-403b-aaf2-6e942bab8f04", "value": "12288:sMvr2bwnaK/xSmZHs0yoVJPMg8Kn92z29p:1vr2pmF9v0Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653639002, "uuid": "6bf97408-3f97-412b-b351-446146d30108", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653639002, "uuid": "101c7c4c-eac1-4cfd-abc4-2d3fa4bcb2c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653639002, "uuid": "dc802c96-6ad0-465d-92b0-09bb91b27f27", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688fe5ba-de04-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1653687105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687105, "uuid": "c79c238a-7f0f-4418-8095-f6cfa5c31c64", "comment": "Malware payload (njrat)", "value": "a93b637c6e9c5cc1277a20ae346ad314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687105, "uuid": "8216c5ee-d352-4ece-aae4-ed822e9ae15a", "comment": "Malware payload (njrat)", "value": "1001b44e497b91d1b471c36393a2d7b8570492494af60b3e7d2cb71a91783f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687105, "uuid": "765f017c-44f2-42de-bf1f-a86b6ac6d839", "comment": "Malware payload (njrat)", "value": "b153342cc767ebb6770236bd05bd0361c7c39c8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687105, "uuid": "ca6811d4-b440-44d6-812c-b7b4d45bf544", "comment": "Malware payload (njrat)", "value": "08aac538e60aa2aa6d0fa920743f9499c64cf10381ba5ac18be3c5ecd43c8cf9c8d96e32d1d1e5183b6dce21d942bab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687105, "uuid": "a1eb927c-6c51-481d-985a-a68a7f29753b", "value": "T133033A4D7FE18168C5FD057B06B2D41207BAE04F6E23D91E8EF564AA37632C18B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687105, "uuid": "ec3b198e-8503-4068-86f9-d5d40612171c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687105, "uuid": "5d79fbf3-8765-4e59-9389-0ce071f5c8db", "value": "384:X02KMizdNjnBhFbJ8ycPlXP/3w6E8jrAF+rMRTyN/0L+EcoinblneHQM3epzXUVQ:E2gNlLJfcPlX31EWrM+rMRa8NusQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653687105, "uuid": "a01ad983-6e3f-41bf-9dae-8d3e51ebc80c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653687105, "uuid": "a86c1a5c-f322-4304-8d20-bc402df8d575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687105, "uuid": "7360eba9-31cb-41e4-a56e-6d1f0dae63cb", "value": "a93b637c6e9c5cc1277a20ae346ad314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a38c405-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1653664667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664667, "uuid": "868e2f68-1d79-4eb1-bd8e-76d9cba3a531", "comment": "Malware payload (Vjw0rm)", "value": "3570adb415b3302811030be16c08f2ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664667, "uuid": "4c073464-0e26-4a73-bf95-27195c9ee4af", "comment": "Malware payload (Vjw0rm)", "value": "10087128422049e18547776f5785304fbf760279baddc0abdbf3943f66b780ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664667, "uuid": "a255e143-2ac7-4e72-a2c1-df4f50eb85ea", "comment": "Malware payload (Vjw0rm)", "value": "2da5d97870cfadf90ebb7890f58ee211ea112cbb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664667, "uuid": "d41dc8f7-ed23-40fa-b288-41348e88cbd7", "comment": "Malware payload (Vjw0rm)", "value": "b47575541f9ccbddfb9f0d5a22460c6d162c597c5d2c1043305d8556e14054824ad91b1b666e01fab731c047707be0da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664667, "uuid": "c09fed5a-7f9a-4083-a4a9-437f12c3ac5f", "value": "T1A864B03187809F69DB984D0BD0BD1E1F55F3136AD473B2CCABA3390B2AAEE0D1616D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664667, "uuid": "6a1c25dc-1e4b-4195-b97f-41e029a39941", "value": "6144:BTJdVW6b2AMnpk7ts/gEKg1Lf9lWaFBiJ+DuMPAZHZGPksLvX97B/2xe8JOAj:BTJd7BCss/zFLf9saFq+DPwHZOLV7Zy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664667, "uuid": "36f8ea7b-5da7-4136-b86e-02cf1dd39db1", "value": 334586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664667, "uuid": "514d6274-ab97-45e8-a1ca-52ec8649461c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664667, "uuid": "18b81bb6-c3c3-4c45-bab1-96fa8348301f", "value": "CIQ-PO16266.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0f83b3-dda4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653646092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646092, "uuid": "8f00bed7-36a9-45b3-bc24-c51bf1edf596", "comment": "Malware payload (Formbook)", "value": "a6afd9a11ddb26ea9197b5e6555fd127", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646092, "uuid": "70c95615-c32d-450f-a14d-1b2a32ae64b2", "comment": "Malware payload (Formbook)", "value": "10e55528343098fef510828eea445cddd10d15d04e119ccadc3745c19adc458c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646092, "uuid": "adcdf45d-8b77-47dc-9e7d-8f0c5c35a983", "comment": "Malware payload (Formbook)", "value": "0235b4f30f97002e80903cb123fc31a17c355e5d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646092, "uuid": "93c9c69c-45fe-4475-bc4a-27dcfe06142a", "comment": "Malware payload (Formbook)", "value": "43242c8f1ff1371a5d3910ef64556aa307018de59081783c9a9d1904bb1e4e9f6d616bf20483731b505a29e0ef0a7d2d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646092, "uuid": "ab633805-e1e0-4c0f-b725-bba13b1820f5", "value": "T1CC84EF1523EE6093ECC9C8B45E85C6B54A6FBE124C359047728C6AE9DF3F5AB80913D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646092, "uuid": "7dc22abd-e84d-4f14-9154-0e3c4d034f68", "value": "6144:j0YnOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOE:VOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653646092, "uuid": "7a94f054-7c4d-4fbd-9e83-5756a96bafbd", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653646092, "uuid": "3bcd3750-cbc3-4c20-80ca-94136f3ff6e5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646092, "uuid": "bff456b6-a16d-4185-aaa9-371b2d5d193c", "value": "Purchase Order MRQ-5525.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c9dd07-dda4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653645815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645815, "uuid": "cb641360-ec22-4f92-b41e-4843f808ac7c", "comment": "Malware payload (AgentTesla)", "value": "1c2b261814dbd59afb8b0f71081e06a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645815, "uuid": "2ecc5852-d5cb-40cb-8e15-83593b62ca75", "comment": "Malware payload (AgentTesla)", "value": "1140c23b898b9b30fa6c5f609ca4f3328301f7bb1c83b91e7a66353c52acf6a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645815, "uuid": "7bed310a-57ad-41e9-a5df-df9b24dc7f97", "comment": "Malware payload (AgentTesla)", "value": "b4bcab332718d346c94992f8bb30c13b49523fd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645815, "uuid": "97c17a17-85ae-4d63-8602-9b3b5cef55b6", "comment": "Malware payload (AgentTesla)", "value": "37c2c8c6cc96bf91e28a67529c7ed067bd72fd6d6e318a3859eac013606814af5965a3d9a63d1853b228f8b78980d8ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645815, "uuid": "eb4fc284-d897-4687-87ba-241640730aa3", "value": "T10EA423290175A1DF791617F42321986B72EA58BF05C1EF10DCA32B8BF5462249BD3C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645815, "uuid": "4320d1a9-ddf7-400f-8b33-f30607c93530", "value": "12288:1uhWtLBtrDJYQc8BoWUPl91d5e3hgBL+R:1EWXRDJY+BjUPhAhgQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645815, "uuid": "fce893c7-3475-4b67-b5be-6b8c651204cb", "value": 460833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645815, "uuid": "64017dce-d675-4c41-b9c6-0d655c8e4fea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645815, "uuid": "e60f7bd5-af75-4af3-beff-0c2ca94b86ef", "value": "Payment Transfer Slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c85fea4-dd97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653640189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640189, "uuid": "2cb38c77-b528-4d80-9da4-dd174e9fa5ec", "comment": "Malware payload (Heodo)", "value": "8a60a3934611fb8f67db4f0bd163572e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640189, "uuid": "9759a8b2-afbc-4065-9084-fea138f6e792", "comment": "Malware payload (Heodo)", "value": "12dfc86215ad3193d559ba7cfc30ed5835483dc417652827bc54f668911af8fb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640189, "uuid": "3d43f1ff-da68-4a21-8993-7755501c5125", "comment": "Malware payload (Heodo)", "value": "c3f81e61dfad4814dd0e8b86e5f8787d3df7b7f2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640189, "uuid": "2a422d70-a5c0-4b18-b406-12b944a20640", "comment": "Malware payload (Heodo)", "value": "66fd562187b121d234f26d6bb59b5ef9df2f052e76a3a60ffb7112cb45c15e57f4240bfe179e0a130fddc66933219329", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640189, "uuid": "94831a0e-1061-4fa2-8543-aa1295219826", "value": "T12C94CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640189, "uuid": "db663788-d484-42b2-a44b-a1e0b8b2316e", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640189, "uuid": "ad41b127-ed2b-4c08-b955-9eadcbcd623f", "value": "6144:I9wEpo6/4WaPgMIuxqqDAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqDAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640189, "uuid": "9fe2afcb-4dc6-40aa-9674-b2b56c1bb787", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640189, "uuid": "290b963f-ca30-43b1-9e65-91fa2085ca73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640189, "uuid": "bcae20e7-7a31-4518-981f-f2d7f1a298de", "value": "8a60a3934611fb8f67db4f0bd163572e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d017a2c-dda6-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1653646686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646686, "uuid": "9ebad07f-5bce-404c-b9cf-128a5c52b7f8", "comment": "Malware payload (CobaltStrike)", "value": "b81001487f3bfef91025c4c1b4961c12", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646686, "uuid": "199d1038-2231-40f1-b2f0-f9ab07c7ff22", "comment": "Malware payload (CobaltStrike)", "value": "137edba65b32868fbf557c07469888e7104d44911cd589190f53f6900d1f3dfb", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646686, "uuid": "0a879cd5-d77e-49b1-925e-a2153abdb746", "comment": "Malware payload (CobaltStrike)", "value": "85d0d7acd844f053eb8fbece9fff98e16976b200", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646686, "uuid": "2c310251-9688-4f04-abe7-c0f6e1bfa299", "comment": "Malware payload (CobaltStrike)", "value": "16b20d7233fd1707291e35d89851c3213f24ae510f12ba0973a103b7f32f5707b3a1507b20defd6791d01d07c3ed3b39", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646686, "uuid": "3a8fe08e-59ce-4e26-9ce1-26ce833eea55", "value": "T104057E70FAF1E5B8D81592326461BD3293F17C04C920B61A8E9CF5E51E32EE06F29767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646686, "uuid": "7e194bb4-2b43-456a-bd4c-af56751e052f", "value": "1965ca6ac6bc25b1942b81d0f28730f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646686, "uuid": "8ac7cf49-5e86-4bbe-aa02-bf41aea0423c", "value": "6144:4exTYxzDjbmfPW4XcsYwjwIGIproJweGTIDjhOTRFQ8AbslV5YFeH3N+XhBkzJvQ:dhPWHE/EwehmQ8F/H3N+RBKJvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653646686, "uuid": "e84d7d3a-c373-4be2-9e85-ba23952f8b3f", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653646686, "uuid": "b3ccb82b-42d2-4604-82da-ab267c007f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646686, "uuid": "0474b82b-cd46-412d-be91-a3f7129d91ba", "value": "win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4756f4e-ddaa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653648605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648605, "uuid": "d71257cc-94c4-49f3-ad2e-6abe727a376f", "comment": "Malware payload (Mirai)", "value": "0fdde2c6d0178f93f8616cd530aa5b10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648605, "uuid": "80d370b0-6fc0-4526-afd1-3833502c0f15", "comment": "Malware payload (Mirai)", "value": "137feda267b2aa7ef192820bcd1933f67b2bc739b841e5113825f415672b9927", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648605, "uuid": "4fa85439-17c3-4a0d-8b8d-9b239be7b05b", "comment": "Malware payload (Mirai)", "value": "b6c4705ee23f7d353f44d0881d4dc763242510f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648605, "uuid": "d91cd185-a248-49ec-863c-7689259ed5a8", "comment": "Malware payload (Mirai)", "value": "299f241b3bdc5e5f2f4c59f992978ae3b54d19801e432459fcba47f50bb726e89a550b1c144e8a48c2a5b01ef5e90b17", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648605, "uuid": "8862de38-1060-45e6-ac2a-acd129469214", "value": "T1EF730686BC80AA15D7C04777FE6F108E3314A7D9E1EA72029C295FA07B8EC2B0D67755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648605, "uuid": "ba45b99b-e0e1-4c86-b783-b33b32212f41", "value": "1536:czwFNSneF6IMMfDGsADV3bt6EB7XfU2//uBgxy:ckFgeF6I833AEBLM2+Bgxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653648605, "uuid": "f54c09f9-f3b5-4201-ae0e-a67434f89633", "value": 76348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653648605, "uuid": "44cfb010-8336-4995-8c72-3287c3fa3481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648605, "uuid": "85bb78ad-c503-462a-b6e4-03086805fc26", "value": "1isequal9.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1deb3f-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653643945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643945, "uuid": "cc92e3f1-e4c2-4331-885f-3a5710a3b377", "comment": "Malware payload (Mirai)", "value": "9d8c6e23c4a6d55edf8849401f32ca4c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643945, "uuid": "6800bbfd-650e-4da5-9e23-e0ddc96ff641", "comment": "Malware payload (Mirai)", "value": "13cdc7b6231e4ddb3f3e062def4919fde078d9751b007a1f4e105ed4d0961fe6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643945, "uuid": "ac724a5a-7a8b-4d57-b3e8-d3b035580155", "comment": "Malware payload (Mirai)", "value": "2995d242ea96d0e0ee2980369e8d687e92e78e0a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643945, "uuid": "8541602e-9378-4652-a905-7762f3673d3a", "comment": "Malware payload (Mirai)", "value": "62b756746ab50e872eb8012a24a6c4416c822c73ae9e66197e448d89c3db583079b1dd4d272c6d8f9b2624cb28e05cae", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643945, "uuid": "1869f506-4276-4b98-b455-0abb6744f1b6", "value": "T15D2302DFDD5274F6D0B0C17302992381B91BF1281B856B738661BADFCDB55420E4D7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643945, "uuid": "05c35f51-f1c5-404e-a82d-31536cfd44b4", "value": "768:8Vlo1OeMMg27EbV3UkkgaI3+V/ATmxUiq7LPE/QfVjx00DCb0ARb:MlZMg27Skz219iqJBfUNRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643945, "uuid": "348a7f56-c031-4f95-82a1-8ff6c6920a88", "value": 49804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643945, "uuid": "182c6905-b002-448a-a8d0-450c18f327cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643945, "uuid": "b3587361-6501-4a75-8271-759ce6ef1260", "value": "9d8c6e23c4a6d55edf8849401f32ca4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575dc8c4-dd90-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653637255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637255, "uuid": "a43e1150-6410-494c-a241-8e020355c837", "comment": "Malware payload (AgentTesla)", "value": "90141995fdf312c848747c64716da82b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637255, "uuid": "3caabe51-6d7c-4a27-a1c7-097f41f371df", "comment": "Malware payload (AgentTesla)", "value": "13fe3c45eef9bd8db5b6dbe1adf8cff3ea722f457d1e322c071048b812d14e4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637255, "uuid": "9f3bcdc9-a7b3-4c23-bd60-9e01906d61cb", "comment": "Malware payload (AgentTesla)", "value": "4a165b748d4456e9a70cb5dc37b05a7658da275d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637255, "uuid": "04642eda-3412-4f7c-8571-e44d05797680", "comment": "Malware payload (AgentTesla)", "value": "6135b82dd70492b925896f02bc885795af621e4df67aca25a15c8991e413fdd0567e315e51dd85a3377e2fe45105f4cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637255, "uuid": "6de6ddab-fea7-470d-a326-11b0684914e8", "value": "T13B832AE2A1C8FFC7D6BB62346EE476110B235B48281556409BCC261F7722ADF3781B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637255, "uuid": "077c0220-b720-4a74-99c9-57f1e32c86f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637255, "uuid": "29fffd49-59dd-406d-879b-3b4190ab7d04", "value": "1536:Qp+GrN7bUbl8ljRWcplgMPocPoJ4TGEWx4/2G:QpnrN7gzcwzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637255, "uuid": "b824ac79-2fc0-4bc6-b8fe-69913d5727a6", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637255, "uuid": "76cea833-e181-4a19-9c11-6148568ce4b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637255, "uuid": "4506da77-dbee-4fb2-813c-a88a7a2cfa19", "value": "SecuriteInfo.com.W32.AIDetectNet.01.12395.22112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d672dd07-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653664956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664956, "uuid": "a0aead54-0cfb-45bb-9a68-c7f8d0209525", "comment": "Malware payload (Formbook)", "value": "07131c250d5f2b4b46da02828c5da58c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664956, "uuid": "ab2c9830-02aa-4fe6-b607-bee542d969b4", "comment": "Malware payload (Formbook)", "value": "15e17fe1832e832ad58893aa8d5f2e8e33e2fa756d509d2e855daa6a1f4d4027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664956, "uuid": "8ccf4dc5-1a35-4aa2-91de-7c737e44cc7f", "comment": "Malware payload (Formbook)", "value": "6d0f76adbbcd0088660ded26e97866d3b3bba02a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664956, "uuid": "9e101e90-7d7f-443f-b4d7-44d52937294d", "comment": "Malware payload (Formbook)", "value": "ee1d223312ff2096b5217990ad6145b0599dc90daa643837dfbb2b732aa35314a1d20a50e63d81d74f8a3093a94f40b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664956, "uuid": "7c884908-5097-4131-b9c2-7d8671958725", "value": "T18EE4126835DC4525F7FB1BB92078410017F9B68BA713D70E6E8670E96CD3F814B22A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664956, "uuid": "45aa7b03-1af6-43a8-bad6-2766b532b123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664956, "uuid": "a4f3719a-11fa-4559-946b-12d3d95f3901", "value": "12288:uM1+hfTuIJZbHomdHEUEN00BVn456X38EmoH91bMrVCY8Wn65+Qho:uM1UKcZbHoEEN5B7sKH9xUVN88cJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664956, "uuid": "fc1b307b-c6c8-4ac3-9a0e-d2a3227bbea8", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664956, "uuid": "96a4d45f-d740-4284-b3c6-5201899a969c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664956, "uuid": "8c6dde2c-eacb-4f5b-b357-39840f4ac494", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f255c53-de03-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653686740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686740, "uuid": "0bd4edce-e2ce-4e03-a289-fbe1304629c8", "comment": "Malware payload (Amadey)", "value": "a6d00c6a710021a5f8c99eafcc4d90ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686740, "uuid": "f37b6f0e-43bf-4261-804b-0fd08bc836ea", "comment": "Malware payload (Amadey)", "value": "163717d9ebe4ace6547c05ae5553b2c4d28a1090c8e904d66dee7278239a3b2e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686740, "uuid": "e7121cf9-f7ab-41f8-8c4a-fffd7ab0a64d", "comment": "Malware payload (Amadey)", "value": "6825a450fc8ba28c19743da25a08608e59020fd5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686740, "uuid": "ef81146b-5e87-405a-b74d-771b21e5d3cb", "comment": "Malware payload (Amadey)", "value": "c8858b6bcbc7e66d69a7756be326f1d97bce004e93a3f11434fe47173d09bfc7910f91052a5ce5b08557499af31b904d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686740, "uuid": "8ef0b897-ca69-4979-938f-42e42e2dd6ae", "value": "T1CA649D10B690C035F9B711F485B6D3B8BE2E7AA16F2450CB62D53AEE56346E4ED3070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686740, "uuid": "d5ae6911-507a-47bb-9abb-fc04691ac632", "value": "e14222a66bfe02a8db7cc13088bb5042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686740, "uuid": "ad53c466-0e69-431a-a05c-29dd33e31d32", "value": "6144:LqjzqAmoyatKcbdrbJnRNlNp7zGryh8KxoWJEHo9keu:LGPtptnbdH/NlvWru8ao0koW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653686740, "uuid": "8545ce02-0bf2-485a-b54a-9d112a5674fd", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653686740, "uuid": "6d33262c-ff27-4d9c-ac1b-ead96472ec7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686740, "uuid": "326cc28a-3646-48cd-93b9-f88b5e939fe4", "value": "163717d9ebe4ace6547c05ae5553b2c4d28a1090c8e90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47f4667-ddce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664093, "uuid": "c9d96a12-50fc-47ef-9717-36767fbb359d", "comment": "Malware payload", "value": "9622b29c5516841f39004dfaf26cd28e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664093, "uuid": "67c64ea9-c62b-4e90-b78d-d3dee51cb731", "comment": "Malware payload", "value": "1690bca0ecbf7d7c019bbe41b8683c3e7d63044f4230e00d1547ec3943214e10", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664093, "uuid": "aa6de349-80e2-4e14-b231-c61e67297e10", "comment": "Malware payload", "value": "98fcb1fc82c7e0110e88d8bbaeb4d8fc934caad2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664093, "uuid": "aaa8d176-8818-4ade-a82c-d2610d8c13e8", "comment": "Malware payload", "value": "d081f5114d0804158d9b725c1a693a1ce998f69d7ae7c3ca6a9d7e3a178d5417a13a8d23e6ec44101608f15eca62a22b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664093, "uuid": "bf756860-9659-4a6c-8e05-d0186d77ee4d", "value": "T19EE56D22F28C753EC06F4A3A5937A3149D3FBA636A129D1B17F4488DCF359406A3B647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664093, "uuid": "b7b1b606-9f13-49f7-b927-3b4dbd10ab67", "value": "49152:7m+0weFDX1pkSpWe5wSIkVMIZh1AowT7Ew9wiqQ5YLEA:n0wePwQh2oImM5YAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664093, "uuid": "f787ce3d-e5ba-4683-ae35-8c4f97eb78e6", "value": 3315712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664093, "uuid": "8860222c-d47c-434c-9b32-7b9e90b9bf13", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664093, "uuid": "4dc5c548-0e48-41fd-b552-c4217ff2ca84", "value": "FactuEndesaFacturdigitalnow.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c065dc86-de10-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653692407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692407, "uuid": "a7266dba-72dd-4623-aff1-6232cd78fb07", "comment": "Malware payload (Mirai)", "value": "a1ea3c87be2d2b26307d548bed5c192b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692407, "uuid": "ed7a0c46-b100-46c6-99ce-b69f983ecefa", "comment": "Malware payload (Mirai)", "value": "184f34491a3fd771ef88f242b9cd64fab1e58f84a066df1973a0b1057e5af503", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692407, "uuid": "d115b9e0-f003-4d4d-add7-91923ae3ade9", "comment": "Malware payload (Mirai)", "value": "77adf5b7f8079c1b9a4aaabfdeeb04ce8fcd30c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692407, "uuid": "bcbcf7a7-40e8-4a23-999f-65a59812605c", "comment": "Malware payload (Mirai)", "value": "85940635adb8a3c505c2fa3dc8dcc4796a5ab46ff193fb7726c1c1dbb13b610d21eadffc67a11c683c6669a292b5a487", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692407, "uuid": "188b4569-e7eb-40ac-b73f-27719f497d71", "value": "T185D2F256E3FF355EF49A11B334CB724422189919B28884A7E7D0E03FCC66F642D1E6E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692407, "uuid": "1b66a7d7-4e06-4925-a6fd-ab774d7466ed", "value": "768:qHDWmDd8SKA+S3pSEMnD4TDk0AOROekALZCBjogGnbcuyD7UHQRjE0:AD1DmtAy60xAlCZGnouy8HyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653692407, "uuid": "75f7b28f-3f5f-4abf-a50b-75b9bfdccb2b", "value": 30468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653692407, "uuid": "6857f53d-d978-483f-b735-ba3de800b332", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692407, "uuid": "8c2c2e4e-5fd4-4ffe-9096-7652f783f125", "value": "a1ea3c87be2d2b26307d548bed5c192b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65969df6-ddb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653651022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653651022, "uuid": "529d7da0-3ed3-4980-84a7-5e0d5bc98dbe", "comment": "Malware payload (Formbook)", "value": "8380afc6e34fe722c9e16f6ee797bab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653651022, "uuid": "423bf137-cf2d-45cb-a4c3-51d22036fadc", "comment": "Malware payload (Formbook)", "value": "1868d031ba42f5f9b2f176f218647509ebcbf1171ed0da75a594a26744d03d9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653651022, "uuid": "7a2173e9-6ef1-43c8-96a9-717a6cffe4ab", "comment": "Malware payload (Formbook)", "value": "5dd6c2103053372286d09b6fdb374c1d43e23a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653651022, "uuid": "16e47d2f-a409-438a-9cae-21d38e28ceff", "comment": "Malware payload (Formbook)", "value": "6219c20ddc6e69a9ac760191ae2e272da1cb625bc370daee19b879ad5c26ffa8218d324efe9a312f567ef6a95996baa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653651022, "uuid": "71759dc8-51c9-46b2-a0b0-75b8e29f72d6", "value": "T11F74127124E147A7DAA74EB0C9BD775E97B2AD1829B06717C30C3FB346F1AE1E600611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653651022, "uuid": "4e63dd91-a21c-4fa8-a40c-f1d4460db6b9", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653651022, "uuid": "f8dff478-1617-4f67-9c4d-0008ad48f1b9", "value": "6144:T0YCM+Bv5WSp/twgyu5YuJJa5o/PNjFGEpi6we71NdaJhcI:MPBv5XugFYuPaa1FG0H71vk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653651022, "uuid": "0fb8ba3c-5bb8-4460-987d-8f73d82ab92b", "value": 351149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653651022, "uuid": "9d578231-4866-44d1-add1-81fd1a680117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653651022, "uuid": "c9717f64-04af-4e2a-bd6c-80dafe146b5d", "value": "Swift Copy05262020.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5ce414-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653664726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664726, "uuid": "905e89b3-fa59-40bd-b09a-f9dabcf94cf4", "comment": "Malware payload (Heodo)", "value": "55acd5797d863eaf5517aba051c215b9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664726, "uuid": "b4b0ae2a-7ac9-477b-8c1b-e389e1958df1", "comment": "Malware payload (Heodo)", "value": "187fd9a2bc9bd18e024fc3ca8cb3d6201a41d0279ac3e7370c1b13d5e33a2cf2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664726, "uuid": "78786d42-c56c-4048-a85c-34cec816885b", "comment": "Malware payload (Heodo)", "value": "eaee18a17532d81635fe91091b009f736f5456bc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664726, "uuid": "771285e9-da59-4a2f-a623-0692a55b6802", "comment": "Malware payload (Heodo)", "value": "d0e050d8bca8066a13e15db3878d2010c260382cfe7243650b05e0c0b3c7916da9eedac48320912556d45807242ea455", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664726, "uuid": "3c591637-b217-4ecd-aa17-11dd79cbed3e", "value": "T15094CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664726, "uuid": "20450f00-8f3a-4649-92bb-c2730ed2c0fe", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664726, "uuid": "8094f608-75e8-4fd4-8fa6-e937f0012098", "value": "6144:I9wEpo6/4WaPgMIuxqqZAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqZAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664726, "uuid": "16577fe5-ff1a-416c-98e5-258722d791ca", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664726, "uuid": "60be1bdb-12c1-4b35-ac4e-e48ffa0d5fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664726, "uuid": "45956715-147e-4b1c-89c8-90655ea480ff", "value": "55acd5797d863eaf5517aba051c215b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2a3454-de10-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653692483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692483, "uuid": "1d0df451-e204-47aa-b864-82ffbdf3397d", "comment": "Malware payload (Mirai)", "value": "e700b2d48416fe57249c4944eebddb94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692483, "uuid": "b0052435-39ed-489d-8166-8e0aa050f57b", "comment": "Malware payload (Mirai)", "value": "18c416c3df3f8f2e7e38dae76cfd8f536018f1c81cf255a9e7a1f93ccc834187", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692483, "uuid": "e3ab2f8c-f93d-4f6a-8c37-8045bf544d44", "comment": "Malware payload (Mirai)", "value": "1d0197aaf0c2c972625de24c341dfbddf29adeba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692483, "uuid": "f6776407-4267-48c2-b705-84b1579cd5d0", "comment": "Malware payload (Mirai)", "value": "1ca00448ae0074c16ab16da6ec9f004e8585a2f4b8ea43040721b6132224183d9ee6b720dcaabd7a18d2cde5ba2c4639", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692483, "uuid": "e1b478e1-2c4b-4060-b421-e8f0bd8a1b77", "value": "T179F2F234F96EF6F40BB0387E91EA8F8F16990EE84592337067D809548DE0821E9BD647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692483, "uuid": "cd432a13-a6e3-4409-b13b-41bc11ba1fd1", "value": "768:sWvtUEsIhgNUU2hVmeHyDmRMTMKcvU2i9q3UELJv:svEdhgNSmeHySQLcvBXL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653692483, "uuid": "700bc4e4-155f-4683-8a5e-590a19ec5e7f", "value": 35516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653692483, "uuid": "ba666d48-6f4f-4379-8055-9c9d0ccb692c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692483, "uuid": "f1e54c35-9e0d-493f-bd59-0ab030fd37c9", "value": "e700b2d48416fe57249c4944eebddb94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0ff02f-dd90-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653637261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637261, "uuid": "63a738a6-24be-4e8d-a8f7-beb1587e95d3", "comment": "Malware payload", "value": "074b63d64a2e77fbc16f7d4c6bc20069", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637261, "uuid": "c14abf19-e316-4d1b-b338-98eb2c171f83", "comment": "Malware payload", "value": "190e2510147dda3685a388f7f21ffe97964358757224997814aeca8d885b78d4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637261, "uuid": "dc7ed01d-9097-4ef4-8d0f-06ea0bb89dfa", "comment": "Malware payload", "value": "198767c269ca24b995733f8bcc26833d7fc2be5a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637261, "uuid": "ad1662ce-971f-4c9b-9f75-836cbed0cbf1", "comment": "Malware payload", "value": "1e4d04291094eb91be814ceb9cd6c6c38ae448601d311153b5ba224c95bfd316ab2f572615947d5fbe79eab9cb4a708b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637261, "uuid": "a412a3b7-29db-4ef8-9f80-2ade7249cb40", "value": "T17233E11CC50ABDB2CE3A07B8DB988AF4F5594E5EBD88BA4D355DA3D440C03D32B1E496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637261, "uuid": "2e590996-87d9-4aee-8a1d-eb2d66320e7d", "value": "1536:3RHxXpKXP/Pvb9ppsT9vO1/S+7bkQfdlotkv13TVuysxl:BRXpKHVg9qx00dlotkv13Bup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637261, "uuid": "78c8654c-e976-4d98-ae90-4156389011a6", "value": 53314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637261, "uuid": "aaf8f603-6674-4cad-b322-178f59d1a37b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637261, "uuid": "236361da-f0d9-4eac-94b8-4f3a3bbf6a62", "value": "Spring Call Ahead Series- Gaming Lodging 5-31-2022.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cf4b4b-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1653664688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664688, "uuid": "28ba0e31-2e81-40b6-a780-a09cd2df9c9d", "comment": "Malware payload (Vjw0rm)", "value": "72f6a15477f6e648563087dcef64058a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664688, "uuid": "1b6526de-a6af-44b6-9abc-99b4a04dcbb4", "comment": "Malware payload (Vjw0rm)", "value": "196b431218cf027fc0ea001f0f37c48fed57813c99d528c15791f4bcd2f4c910", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664688, "uuid": "c6a852ef-867b-423e-acd5-a6a4f056d853", "comment": "Malware payload (Vjw0rm)", "value": "d33b0444cdfcde780f9674c50aff50686df20912", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664688, "uuid": "07c86b2e-0b4e-4c4a-b74f-36b2e8826023", "comment": "Malware payload (Vjw0rm)", "value": "2cedff8488650d95296ec7be9e9490fcfd50896647489ecf7edb2f36af72359c414fad62ce3c933ccae4b752706bd600", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664688, "uuid": "84f322e7-6589-46ad-8c68-049d0cb113ea", "value": "T15914CF80EFB05A66F65CB620047F6F2942CF4746D088A28CF4F5AEC596D5689C30E77B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664688, "uuid": "e44b6cca-9242-4637-b9f4-8ba8e19a3afe", "value": "3072:mc5p4mttQFkVDHCkuJC7VP31rZD0/C7R9JarYaIVL9F4ithvMm/urBdp3IQK86hS:mcr4m00DH6INMCN9JcsVT8m5y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664688, "uuid": "f1519431-ae2d-41c6-9f41-2a95cdb7eb37", "value": 204021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664688, "uuid": "2e6f7935-8008-4e73-83e6-889c50abbd2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664688, "uuid": "57ddc6c5-7bd5-4f84-aa5b-b7fd8021255f", "value": "Payment AfvHeqhlhh_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e9ccf3-dd91-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1653637861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637861, "uuid": "17f0c5fd-4e4a-4cf1-8893-c2882d934d43", "comment": "Malware payload (NanoCore)", "value": "a65b44e9c6fc036c1e24394cf475df93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637861, "uuid": "2dcfbdc2-ffd7-4a3a-9209-e64e351535d2", "comment": "Malware payload (NanoCore)", "value": "199cd32465aab7d29744db6c1556394d6124210718ac8a10518e4683ab69f659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637861, "uuid": "6c7c55d6-29aa-44af-a12f-8593bafdb33c", "comment": "Malware payload (NanoCore)", "value": "ec33746e4d36fee2a7ae641d363a92485bbdde96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637861, "uuid": "2f06276d-167f-451f-833f-0b84e5c368b5", "comment": "Malware payload (NanoCore)", "value": "6767db1651bbb5acd91fae68571795be8db1cb8fdb178aa5977adbab8a5f00c75b8febb0066d10207ced42ec7134a8a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637861, "uuid": "01f088a0-d6b7-45c3-8bbe-5ef9a413cb3c", "value": "T1CC14BF5677E94A2FE2DE86B9602211128379C2E3E8C3F7DE28D454F79B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637861, "uuid": "53fc98e4-5fc8-43e1-aa87-c062289fdeb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637861, "uuid": "e8ad8da5-cccc-4768-ad3a-1bd1b01fb722", "value": "6144:wLV6Bta6dtJmakIM50lWUu5LYkO0TrWSC:wLV6BtpmknlM5LYkO0TK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637861, "uuid": "c073b277-3933-4b02-8ecd-61e29e0bc978", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637861, "uuid": "fa4ac7ce-d3a0-44dc-9336-5ad3b42b3666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637861, "uuid": "e601d1f4-5418-4cce-b553-850712ee111a", "value": "a65b44e9c6fc036c1e24394cf475df93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f779d0-de0f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653691877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691877, "uuid": "1a0f1c39-ed08-45a3-8bac-1e139a6971d0", "comment": "Malware payload (Mirai)", "value": "cf99cb346fa111f71cc4209f4b290905", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691877, "uuid": "48b0d900-8d61-4f5b-bf58-45c6bd83bfa9", "comment": "Malware payload (Mirai)", "value": "19cfb2191411a2812b82a2681927e1c93ab2687f7f5b3b2842483f1358a6f5fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691877, "uuid": "d1ca8279-006e-4781-a4d1-35fd1078a9bf", "comment": "Malware payload (Mirai)", "value": "a59e847a933bfa032e4528474d45b392ba89a74c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691877, "uuid": "519c5a97-972b-427c-b1c2-f04447cc0284", "comment": "Malware payload (Mirai)", "value": "6abe54b73a0f342095368e28cbd59373b286284209499c5a1a4708f999899a87f136a13c3985ac382b3a4b0a7278c152", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691877, "uuid": "27e6a65e-000e-4ead-b7df-26e4e6d3792d", "value": "T1D1E2F103E5FFAB1EE15B02324ABF368E254DBB7159040CC6AD89306E287375C655CB43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691877, "uuid": "7538488b-e36a-4935-95a2-b8ba9e512785", "value": "768:tLPpe8508td3PqlslKslRonaHEPOSyZ7wvbek29prgznbcuyD7UHQRj8:tLPpeA0+lwslFoaHE9qsTek29Unouy8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653691877, "uuid": "30518b74-340a-49af-91c6-6699e2ee11b0", "value": 32468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653691877, "uuid": "aee0ebee-0d6b-4012-96bc-eaf21631a6df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691877, "uuid": "5679b440-6c12-4c3c-a0fe-247e0d1074ee", "value": "cf99cb346fa111f71cc4209f4b290905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7030e5ee-dde5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653673804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "5e61429c-714f-48de-81aa-93b1a70c0b6f", "comment": "Malware payload (Mirai)", "value": "dd0cdabc3008bb93f0ec2476337bd15c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "acab2371-0396-4cd8-b452-c5f8fa620a7e", "comment": "Malware payload (Mirai)", "value": "1a011ac69e0e4ec28c3b2fdfcec8285d56a2b8fad94ced140ec6c3cee56e0c46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "e201d3ec-13dc-409a-9979-42efc094724b", "comment": "Malware payload (Mirai)", "value": "5a3f07ce4ff6536ca93db6594756260b8c6b7d20", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "28460664-bac7-4a0f-b61f-59e0c4db2c02", "comment": "Malware payload (Mirai)", "value": "e5d15e05477305d2cb72c14084bdd012205acd4a0da189d5240562c521f4a53561c0542dcbd7748b97a2ecf5bbc998b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "beeafba4-530a-428a-9984-8a26b7ff419f", "value": "T11A730949E552C6F7C4821BB20297BAEE0765FD394E7A9E49F30C3CB49B724D83919311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "4c41337a-6239-4293-9a4c-d7ef6d82565d", "value": "1536:xv7i6uAYiPvoVjRWS7kJySRkLWFC/9hKt3iFRw2vVoZOLZ5:o67YiPvoVjRWS79SRhw/9hKt36w2N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653673804, "uuid": "bb551111-2acf-4afc-b722-037bbb5f8d53", "value": 75548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653673804, "uuid": "a284dd6d-e87b-4b32-b9f1-f2d062396aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "cad5ca7f-f155-4c57-80df-f5edae355762", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23638410-ddd4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653666373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666373, "uuid": "20645d1d-b6e8-4d7d-b6ef-dc0d45940b25", "comment": "Malware payload (Loki)", "value": "6be5104655c833e61b679dd64e44321b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666373, "uuid": "43d06c93-77fb-4dcc-96d6-c44a461027b1", "comment": "Malware payload (Loki)", "value": "1b26ef115b65a06537bdae7476fc08b8724760140fc683cbc3669ea3deb5581f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666373, "uuid": "5958fa5a-66b9-4310-a78f-7fd503bd3f88", "comment": "Malware payload (Loki)", "value": "fad0292b3a436313d7f04afcd734d4789c742100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666373, "uuid": "65cc56e4-345d-418f-89ad-b4fccb30a6fc", "comment": "Malware payload (Loki)", "value": "fd174cea9870d0552a193cbe13991924a155136276c8c81469beb7e13476e5091ccf2e02b446119d8a7552c01fc9d198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666373, "uuid": "e2a6dfaa-e28c-4d79-a243-805a43006566", "value": "T135E4BE81E58056A4DD69AB706A7BCD3542237EBDAC34A41C28DE3D6B3FFB2D35022057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666373, "uuid": "f72ad40b-596b-4d02-92b7-96ee4fb880e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666373, "uuid": "07874a56-fdf6-4d53-a616-589201703675", "value": "12288:r3gpvdeS7uraCouqh067qppxEKPQpsWjG5Nao/gMl63DOuP7r9r/+ppppppppppN:r3g/r7bCouq067oxxPksWkNv/gPb1q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653666373, "uuid": "214f7836-be84-409b-85b3-464194f98283", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653666373, "uuid": "f5dd6a94-a18d-4a4d-b407-4962105685b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666373, "uuid": "6ae8f762-7aeb-46f1-81d1-dc16e22681e3", "value": "SecuriteInfo.com.Trojan.PackedNET.1159.29806.31808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557a97a3-ddd6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653667316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667316, "uuid": "d886f1d5-50f6-439e-8952-7ef55821b8ec", "comment": "Malware payload", "value": "d6d17a31642f08248300a68e951fe49f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667316, "uuid": "ff9eddd5-2ee2-47c9-bd79-8d9ba9e5f575", "comment": "Malware payload", "value": "1b4864ce7547eee9dd8bdefe454ce940b4bf0381a3419ce7033785dffe2efdfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667316, "uuid": "26e174e1-714d-490f-82b8-91a4946f4828", "comment": "Malware payload", "value": "37f2a7145d1619e339a9d162df229eb3a841847c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667316, "uuid": "fed2b784-6113-40e9-8199-048487241736", "comment": "Malware payload", "value": "36ecc2d3de49c4452bc2322ca0fecfddbc4dacf683ae2e35d001ec56dd5304b9c397acfc0395afc050559e943fdf7e6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667316, "uuid": "fea3a084-3a69-4c83-9470-2ea724b81a08", "value": "T13F059DBDB2827DDFC527D972CAD45C64A7206466930FD243A10302ED9A0EBD7EE091E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667316, "uuid": "d9a5bca8-7b91-48b9-a13c-e01ba2168ee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667316, "uuid": "9c662173-12e8-4d6e-9677-6b1eb331fdbc", "value": "12288:5ulebplS6g1z52Na4fJPEFxJirvJpI2zXn5xW7ABW6jormnSu/62Zj2SuITJWi8g:5u0bO6C5KHfi+rBe6fa62mTGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653667316, "uuid": "344e39f7-36e9-4a7e-8d1f-f1923d29f90e", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653667316, "uuid": "9bf825ab-7603-4bea-abfc-14864ab68840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667316, "uuid": "d29e9659-10f1-41a2-bf6a-d872665bf9ec", "value": "d6d17a31642f08248300a68e951fe49f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac30a68-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662520, "uuid": "a30a42b5-e934-4142-af8c-bab57080512e", "comment": "Malware payload (SnakeKeylogger)", "value": "38894572965f4d76e4e3c20313852ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662520, "uuid": "302a7787-fbc9-4923-8b27-4ad9069cc045", "comment": "Malware payload (SnakeKeylogger)", "value": "1c6dfa6a024873273ee748a2cb6f0fe7bdb8288e666b7641e3e394fb40d5c80d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662520, "uuid": "d682254a-798d-42c2-a09a-1a8194259825", "comment": "Malware payload (SnakeKeylogger)", "value": "2cd99429fec8b9a03a34c2d080cf77eeb6452acc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662520, "uuid": "fa60230b-b164-475c-8fd6-ca08e1d68657", "comment": "Malware payload (SnakeKeylogger)", "value": "a243410b11c42102e57f57324c926406d45bc366abfcccac633cb3398fb1a9a83eb3029d46039895554b5c71672ba17e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662520, "uuid": "65eb6381-20e0-44b2-af09-d2a5c0a6d722", "value": "T1EF94BF04EB2D3CD1D65EC7BE507088165A608A5FBCBFA51E59A32A8F6C343C20167DB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662520, "uuid": "1026f69d-33ac-4e34-b668-4453fb514d30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662520, "uuid": "d4e4deab-baef-43c8-b3e6-92537c8a4322", "value": "12288:PQ02iNKUHOEEcJbyAsBM8ZaCt8uXSt0pn:P51yEEcVMZ3t8CU0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662520, "uuid": "f71b04b7-b833-4a39-a869-54adcae3b0bb", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662520, "uuid": "cb9b21b7-661c-4351-bf8c-ef1e11ea4e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662520, "uuid": "165f437a-19ce-4d54-9604-9ffbd9e86534", "value": "New Order PI-19-09878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c49a488-de0d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653690816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690816, "uuid": "62b3a377-df15-47aa-9f6c-a6a09841c772", "comment": "Malware payload", "value": "5ea69683d7e3d0fd3a35bba0816b745a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690816, "uuid": "6b1b6d8e-ea2d-4822-870b-e5e66564ba1d", "comment": "Malware payload", "value": "1cda4d7b5f707e0a1dc12d16151cff7b6f8d5606db7bc4a760cf10b2444b6ec8", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690816, "uuid": "5fdb6cd8-c936-4ef9-a916-968deb01e966", "comment": "Malware payload", "value": "d435d37fdab9bc1e30261e14d274d4f44ad8b282", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690816, "uuid": "61139c6d-d79d-4bec-ba48-aee66679f02c", "comment": "Malware payload", "value": "862ebe07c54c9efadb96bfeb341b9f7e075c5fb6ba057a26429bf82d5033b032f65da63fe43ae75c6a5f256151978c10", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690816, "uuid": "7499ad3f-e349-4acd-88a7-2c90b53dfb86", "value": "T18B634B59B76A885EE9198B3048F747D62323FD308F6F0A433259F3926FB9590670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690816, "uuid": "8b0102fb-2b74-4e75-abca-47849ce5873c", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+4+hDcnTLiQrRTZws8EV:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653690816, "uuid": "a630bee8-2e35-49dc-b46f-556f7c8e771e", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653690816, "uuid": "fd662a93-1e47-4e28-90ee-f711d27b9641", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690816, "uuid": "ae7184f9-768b-4fcf-8120-40f7187e8085", "value": "SecuriteInfo.com.Exploit.Siggen3.32798.30295.10195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a63611b-dda4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653645769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645769, "uuid": "56d24cf0-2957-4f35-a11c-895d42700336", "comment": "Malware payload (AgentTesla)", "value": "97e296876bbf20937ee35cede68d06fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645769, "uuid": "7981a7b9-8fa8-49b0-97c3-1e59566d94cf", "comment": "Malware payload (AgentTesla)", "value": "1d122d13a852893c72d42fbbfc5893d9876a1bf73899c9691a7131addbe279a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645769, "uuid": "020cca6f-ce53-4723-ae5d-70eec7fc6bcd", "comment": "Malware payload (AgentTesla)", "value": "5461e5405dd30f88e80f3a5162722cf359176c77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645769, "uuid": "c411407d-168a-4106-af2e-26cbf35dc860", "comment": "Malware payload (AgentTesla)", "value": "dd39857d9a38d2cedc81043cf013c5b42ff6022cd1924cd9c69acdda96ad0be5fa49a0f220065c1a3f0ae5c4ee3f2df0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645769, "uuid": "3cfe4748-0b5e-48d2-8402-2c8d59af11c3", "value": "T101A423290176A1DF791617F42321986B72EA58BF05C1EF11DCA32B8BF5462249BD3C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645769, "uuid": "a7d392d2-62a6-4770-abb1-6325b0152217", "value": "12288:juhWtLBtrDJYQc8BoWUPl91d5e3hgBL+f:jEWXRDJY+BjUPhAhgQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645769, "uuid": "254e94e5-388b-426d-8b1b-f157a398244a", "value": 460797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645769, "uuid": "553543b2-dcf1-4405-93f1-d48519d8c576", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645769, "uuid": "e6c8f5ed-0d11-4987-af42-cfd71fbfc25c", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5935af24-ddda-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653669041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669041, "uuid": "0c51a66e-45e3-4004-84f6-5cf22d4223ca", "comment": "Malware payload (Amadey)", "value": "c9c39393f86144e20663fb773790e039", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669041, "uuid": "05d1a255-e554-4081-841f-4c79a31fc255", "comment": "Malware payload (Amadey)", "value": "1d34e7165582ff5379228d5467597b43e9a9e15b08bee136eb84fbaca0f70c51", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669041, "uuid": "b678238f-4e1a-4067-b15c-47fe2f444bf1", "comment": "Malware payload (Amadey)", "value": "d205e2f22307c15b5c61657bf5504a048b1bdd4c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669041, "uuid": "20507bbb-c728-4967-b016-dbfc6d771ad0", "comment": "Malware payload (Amadey)", "value": "ac58201c839020e043887c66da4d8f9be2b31c2c6346c71ec58508a145b591272611130a30eb7f54388fb0bd95b19e3d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669041, "uuid": "418f3270-38eb-45a2-9d90-534072a4cc71", "value": "T11574E0117290D835D0663E309465C7BC2B7BF822A670A403F750AB7F2EB3381AAB5757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669041, "uuid": "c77171c4-73d3-4a08-8905-e11a5cc1eafd", "value": "b628ca1d73aa557d205f2b12ac720564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669041, "uuid": "b6b46c04-20be-46c9-a9d0-7f0463010799", "value": "6144:GV0hOSUfioYOQfQH/pmHGIPfxdZxkR6H0H6igavwVf:GV0uKoY/fQH/YxdZxkR1Hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669041, "uuid": "ed8c3a64-30f7-4a0e-802f-d066be69dea2", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669041, "uuid": "9a813c46-27d3-4be2-b109-0bd40d43c293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669041, "uuid": "afdf96b6-8164-463f-be04-35bb5c2074c1", "value": "c9c39393f86144e20663fb773790e039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f3ce98-de02-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653686423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686423, "uuid": "ba91b7ac-98dd-4ce9-abc5-08635fcf5ea8", "comment": "Malware payload (Amadey)", "value": "a54a2bc1b2200e5fa19192a8b98e28d6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686423, "uuid": "fa34d6d3-1bee-4537-86c6-b84cf57ff814", "comment": "Malware payload (Amadey)", "value": "1d7f35b09ed722bbe2b1e307ea136c3af0a15e25cab20a96fffc7a81d38c4283", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686423, "uuid": "2b9f56c0-d167-4c74-929c-86bc16da03d2", "comment": "Malware payload (Amadey)", "value": "3592068a2accbe6a1308c58d9878a9bb5cdb9eae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686423, "uuid": "addedff8-177d-4205-981c-b9353cfd25f2", "comment": "Malware payload (Amadey)", "value": "4d0a53342d28b79370047306185404f1ac50b5b92345da67b5a2ff31960750900a8f3ad4cbd74d40774583391c5d96a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686423, "uuid": "9ae3379d-b756-45a5-99f0-3a03d393bff5", "value": "T1A57512C73584858DCF6991F2A2138B40B3A6DCFFC6545A4DABC433179EE57A6082273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686423, "uuid": "1dcef2e7-54f2-47d5-aa15-07c7ef7c4f05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686423, "uuid": "fe6a9989-98a8-40b1-916b-8f32f8d0defd", "value": "49152:zx21wBHvYu95XCbK8CnI3dJ4PKqBwQ0OjqKoe:w1wtwy5KRzMjjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653686423, "uuid": "30730a9a-e675-451c-b0eb-21cdfd0fe75f", "value": 1632256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653686423, "uuid": "a2c2439e-b0a5-40c6-b77c-c8c0ef8bbfcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686423, "uuid": "aa28fcd8-535a-4ed1-a0ff-296d4b0d77c7", "value": "a54a2bc1b2200e5fa19192a8b98e28d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7733bd1c-ddc8-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1653661360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661360, "uuid": "acbfeaa4-f68c-49fc-ac8e-41f0a44cfa5f", "comment": "Malware payload (IcedID)", "value": "7fbb4d11d86d4b4bac5b400b28884527", "object_relation": "md5", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "Documents.iso", "colour": "#8531EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661360, "uuid": "01e26e18-23e9-40b7-8e78-82aba07bd2c1", "comment": "Malware payload (IcedID)", "value": "1e3ee4ca3cb45b8065bb17e744fa1ed235b0679add09bfea4bdefede04a70822", "object_relation": "sha256", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "Documents.iso", "colour": "#8531EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661360, "uuid": "83b0f92c-1a4d-46ba-9c5f-2b279c4cf0c8", "comment": "Malware payload (IcedID)", "value": "20f99d8b4093f45fc3c4032a2b87cb5f6dcbd0c6", "object_relation": "sha1", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "Documents.iso", "colour": "#8531EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661360, "uuid": "8d8e47c8-67f2-4d26-b0c7-6b7b4b87980f", "comment": "Malware payload (IcedID)", "value": "dd09c519654fcff8c4b591de79e26795c47f37ac0defdcbb9211852a3509d3ab3528b659a421d21f13c4b18d7d264d5d", "object_relation": "sha3-384", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "Documents.iso", "colour": "#8531EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661360, "uuid": "c7fcaff4-0b07-437b-a0eb-05b3507feeea", "value": "T1BB65AFB876146DE6EA7E467BC9D7BDEC17B217228A8BA9C9807477C30573362FD01804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661360, "uuid": "771f078b-3d43-4800-9cd9-424610ccd9e9", "value": "c19a3a55d7498eb201a0d34adcbf72be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661360, "uuid": "a75d227b-d908-44ec-8505-2e4e6925bd1a", "value": "12288:MrgVGICPEhtIvWqsMgbIhu5yb72ZQPHdXeMfQoqSXI8D+fZcm8i6hMf2E:MuCwt2W3Jscw72ZMNIoXCfn8uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653661360, "uuid": "f87736ef-12b5-4b36-8dd5-91f511e67a37", "value": 1439744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653661360, "uuid": "4f5f6194-ca1b-4c56-88ce-9fcef396811a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661360, "uuid": "82cc7ff8-2f50-4202-beed-a7f079563fe9", "value": "alomart.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6bb958-dde5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653673822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673822, "uuid": "fcd5c067-db5f-466f-8211-b203f36d816d", "comment": "Malware payload (Amadey)", "value": "a3a205bcfe162c74e11793edc2f6a7a0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673822, "uuid": "9680003e-e0d9-41c6-8670-a76eda1e42f0", "comment": "Malware payload (Amadey)", "value": "1e82760314153787fb728bd1723592865bd848fae87bd46b008ec5d44a3fc77a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673822, "uuid": "9688a933-66e2-4dc1-a448-cf8da609d494", "comment": "Malware payload (Amadey)", "value": "de5c33c4f67e0e93ec625847853a608b6a7a60ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673822, "uuid": "3c980cd3-93e0-43aa-b911-1bb52d80a28f", "comment": "Malware payload (Amadey)", "value": "497f59cf22ba6312222e608005874d55b6a6f65039869d3c10b31ef7156b75f433e62fb9044aa4c4fe26c33f943acca8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673822, "uuid": "11f0362a-7cb3-4a86-b650-faf6a2f3fb84", "value": "T1B76523C59663168ECA807E3335A49E867BF27D5C4E12729CE0B83E1819B3850ADFD1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673822, "uuid": "d4ea5a44-d80d-4c01-ade6-ee2d090b2d91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673822, "uuid": "8ac01c37-0096-402f-9e1d-fcf241a772dc", "value": "24576:bzF7K8/B509jOodulfGfwhEEiOYF470RIbikIGDwpChCDDC9qLEv3/eJFIuW7+A:fF7KG50Uon8iOF70RMDwpkCi9qLcmJj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653673822, "uuid": "56d46149-8c3e-4d19-8d51-5f487ca059c1", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653673822, "uuid": "c2305bd1-6584-4017-9bf3-9b75036eca14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673822, "uuid": "2c962fc4-d76e-4e58-883c-851a694cfe96", "value": "a3a205bcfe162c74e11793edc2f6a7a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b02f268-dde3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653672963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672963, "uuid": "92cc1111-9aa4-4a5b-a360-6e9abfcc9a55", "comment": "Malware payload (Formbook)", "value": "dc70eefa088f688d1cd4c4cf2c6674ca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672963, "uuid": "36d3c456-7fcf-4bc5-acae-ec9eadf49bf6", "comment": "Malware payload (Formbook)", "value": "1ec2c2c0a29c16146400c52880e887cfae57223b2b621c0f433ef9b619af5343", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672963, "uuid": "65deaf51-bde3-4b7a-9a86-56e26945e01e", "comment": "Malware payload (Formbook)", "value": "c358867a468d9722b3c40f0bcd0cbe2534756545", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672963, "uuid": "8d8a0fb8-e52f-4160-82f1-70879599612d", "comment": "Malware payload (Formbook)", "value": "eddc6e5e8e2ab8e318e7363c3203cf045e589b600f7dd2b2fd9e30976ebbb5579aa16ed71a956a03e5f572e6123cefcf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672963, "uuid": "c7331a96-6d83-4cd1-9a84-c5ded21200fc", "value": "T1D705F22332DAE0D871E5B6C74B87F5B907FEF6E4543D59A998CD09898BD1E0488063E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672963, "uuid": "40efbf7c-a833-4296-a277-bf73803ee06a", "value": "192:6KqCQKQUBSRd6h7r1+5FL+HoFuM3BBxO1wjtg1v2U:6KqCQKQUBSRdK7r1+5FbBw1vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653672963, "uuid": "8a7d1cbe-9294-4dfd-9872-17e8752b805a", "value": 848042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653672963, "uuid": "88ce6065-db8c-42ac-a278-96d9f20d8184", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672963, "uuid": "1d934cdc-4d0a-4928-9d9d-b944346d5d91", "value": "daveCrpted.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce5b669-dd90-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653637532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637532, "uuid": "0dc8e8d7-3a88-4163-a72d-fb680a961adc", "comment": "Malware payload (AgentTesla)", "value": "e675d0523acd909a7b2056d9b82460dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637532, "uuid": "1a384c46-b973-41ff-95e5-9053844aeede", "comment": "Malware payload (AgentTesla)", "value": "20868f51ae1fd520f5c2912a53305a791ac21aa0236e15d465d6ea622327d6e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637532, "uuid": "2d40a1c2-9736-4317-92d7-5bee8d9664bf", "comment": "Malware payload (AgentTesla)", "value": "ccd5c8558d28acce5b7040ad98ab75c123033033", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637532, "uuid": "05731b80-3db9-4cb7-8960-5cfbe08334d4", "comment": "Malware payload (AgentTesla)", "value": "1654380ccbdd22366453b2666e227e82f61a72f259930b80526173d4b5b366bf973eee3e45c602530d8b1b578c2467c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637532, "uuid": "2ea4514c-6e71-45cd-b2b9-f69f9da4a721", "value": "T12F259E9D3650B5DFC99BC9778AA81C60FA60797B470BC307A05322ADAD0D99BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637532, "uuid": "aa172333-0514-43d0-a481-e4c54eb59d7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637532, "uuid": "552b1fa9-3c90-4585-ad32-3681614bd636", "value": "24576:zn9d9qbwZbHoBL+azIBZo0UjK2GTt9D7fB:8bwcVzIBZou2GTt9D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637532, "uuid": "6a3a4ec1-a3f9-4329-a000-986c9404fd0f", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637532, "uuid": "c9df9d7c-2e2b-4ccd-ace6-2e050c9f3026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637532, "uuid": "b0048397-d2d1-4ae9-89a7-1f341b0d870f", "value": "uoWaH0S2pE8lVyP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54433d77-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664308, "uuid": "6b96675e-1913-4387-8a4a-eee808abe77e", "comment": "Malware payload", "value": "74541a38df8a0e543c6c3fc8443c0edb", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664308, "uuid": "0520e3a6-9af6-4caf-a15d-42418099227f", "comment": "Malware payload", "value": "20a697fa902608bcbc01776a8f24230fac8e3840964f6e441f5ac79192e53bc6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664308, "uuid": "bdd34f48-3132-48bb-bf23-0795a5e857f2", "comment": "Malware payload", "value": "21ce43ed7c586283d76f3255c2762c31bd29e4bb", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664308, "uuid": "bc1c9a80-f7e6-4fd4-9a50-5bc89265fd72", "comment": "Malware payload", "value": "d01fd9835d114e899e17fc5e67b908044c7dfe96bd6cda5b6d019eb7a4e5ece604ca48352a221c33b4a3ba2e3585b14d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664308, "uuid": "55aff435-d880-462d-b334-eccbb064b083", "value": "T1E5241283B7A444A1DAFDC7BC9C990B057A75ED37E867A253E45B3930063A4488F2845F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664308, "uuid": "a7b55b4f-664e-4731-9666-5526bf2727c7", "value": "6144:pToMmBzsGCrJMYLH3QBEW7dQpMydJ7onG9fZ80:pEnBzsbJNLH3UdAdJ7EG9fZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664308, "uuid": "9848513e-a2a5-49c9-ad7f-15667a834f60", "value": 229176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664308, "uuid": "543c5066-006a-4a1a-b98f-09bb0e2d340f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664308, "uuid": "47a46829-e5ab-4902-af16-c0127a7e1d1b", "value": "Bacs Remittance 05-24-22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b48faa-ddc6-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1653660383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660383, "uuid": "fd3917d1-460e-4825-bef4-0af37f16e69d", "comment": "Malware payload (DCRat)", "value": "b3813a5d96b4ee27eb387fd4b2785ca9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660383, "uuid": "3bfc3ded-d832-4b73-a70c-81f5aff2aed8", "comment": "Malware payload (DCRat)", "value": "219cbb3d1c07c779119f9a0d01fb487dfadc682d1560f25244472f3270e2b1f9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660383, "uuid": "8f6eb430-bd0f-44a8-8c1d-846a343f974d", "comment": "Malware payload (DCRat)", "value": "0b22c3e6eb8b098d2de8dcc99e44bac19c2fbfad", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660383, "uuid": "88e979c4-886e-4c8a-a18e-5fab0163a743", "comment": "Malware payload (DCRat)", "value": "285fa612dec6df575f859672293984fb1cf7a78b862bb3245a0b6609e4eae2f82bb1da9925b4b2429e327e3c9c2ab700", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660383, "uuid": "768cb303-aca2-4b60-9701-72474cb8b255", "value": "T17575337A99E97D37CCA8F9739F8943A352AA10AC7D3F930426D932CB11175679400FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660383, "uuid": "4f30eafb-2dcd-4942-8781-a25f2a21730d", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660383, "uuid": "27526ef8-c463-415b-8b4f-d0776f296563", "value": "24576:D/Kot9nZbs87hRxJpbx220aOVsArLvagagUkfvYGv8rMJcDgXjzxBRuHTN5t:bD7hb7I2YsUaTgRf8sJXRnuHp5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653660383, "uuid": "3fbeea4d-afb3-4d7b-bc57-4ed4b319d1c7", "value": 1664512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653660383, "uuid": "9053442f-2842-4017-abb8-f4487fcd813e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660383, "uuid": "a8eea094-8ade-4ffe-9875-4f7853051881", "value": "b3813a5d96b4ee27eb387fd4b2785ca9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2155cb0c-dd97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653640171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640171, "uuid": "1c313451-302a-46b2-bed2-3e1a91b51066", "comment": "Malware payload (Heodo)", "value": "7402ebef5aeb5d3a7107739974c6d70d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640171, "uuid": "dd44c472-8a3e-41df-9f72-c87671697187", "comment": "Malware payload (Heodo)", "value": "22d7cdc4ec9abf68119095dc1dd2e13b9b7cf45ea1fa3d5f9c02aed243405f99", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640171, "uuid": "c4c1b20b-2b21-4ebe-8105-95fa38bc2c4f", "comment": "Malware payload (Heodo)", "value": "c1b2fe8debca41f48dc3fb581ed2e6d20f63338a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640171, "uuid": "82f43f66-a92f-4b6f-a3cd-14195a4b7388", "comment": "Malware payload (Heodo)", "value": "2b672950ce5cbb3523889165711f4d6ee9ef054c70d868eaba3e2bfe156c385bf070f271fe86b2044891e72d7f0322ab", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640171, "uuid": "3c974dd7-0993-4344-bea6-b3f150055669", "value": "T1B494CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640171, "uuid": "a45f78ba-a3f2-4fb1-a20e-201fb92104e9", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640171, "uuid": "368442f1-2171-418c-b340-34f37eb7ca92", "value": "6144:I9wEpo6/4WaPgMIuxqqfAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqfAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640171, "uuid": "29ac5bea-9908-4b72-8c8f-631305ac175d", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640171, "uuid": "fc68a631-db74-44e0-bc4b-74e6e101d351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640171, "uuid": "fa5aa3e5-fcc5-4771-8cd7-ba11026ac863", "value": "7402ebef5aeb5d3a7107739974c6d70d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0a0213-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1653664480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664480, "uuid": "bdeb259a-1797-4dcb-88b6-7352feca6a0b", "comment": "Malware payload (IcedID)", "value": "95b5a16b72a1a23f441d733c9d100e16", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664480, "uuid": "91db0fd5-5502-4ac9-bbc9-847a00aebb8b", "comment": "Malware payload (IcedID)", "value": "23f84621cf527dd0be8d8ae6389d408d842031bc72039a574d319e93703d9295", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664480, "uuid": "89568080-de68-4b1f-bcdc-49b0359f01c2", "comment": "Malware payload (IcedID)", "value": "cf041d3aa6e68e9211c552bf9831127c62cb1500", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664480, "uuid": "6cedfda6-9f62-47c9-b337-b5d9a28c19f4", "comment": "Malware payload (IcedID)", "value": "981123618ee0b759ff9829a5156169ea889c8d8201356c8a49ddf8ce44d21e0ca4285a097ab56a69c3fa70d3585bd3de", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664480, "uuid": "561eaa82-719c-415a-b0e9-efff679d41ad", "value": "T135519E1CCBEE116CD1B6D578A6FB675396A17E43591C4F8F08C03385195D5C27841A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664480, "uuid": "55b3c3b9-626f-401d-ad48-0e977e564959", "value": "48:8nLeoo0m7PpJQt06k6xDGmf63xYHUaeA:8LvoTbo0ZsDGU63xYHUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664480, "uuid": "7ebd4fd8-7bbe-47e8-850d-792c9f46e279", "value": 2615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664480, "uuid": "c42c3808-a2f9-4e39-a184-b9fcf7fc701d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664480, "uuid": "33954564-be17-40fe-a2b4-af895926b0f5", "value": "W-4367-54-3--2-.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4012c08b-dd6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653622613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622613, "uuid": "8c9ca2b9-0968-4d25-ab8f-60359740b458", "comment": "Malware payload (Formbook)", "value": "ee9e1252b05b8f0ad34d0eb5f6d87365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622613, "uuid": "d07adb93-4f30-4f17-aa4c-863a119320cf", "comment": "Malware payload (Formbook)", "value": "24b22264a9954fe9763f2a35d92088be412600ae1e0e6fc8586925a18216c967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622613, "uuid": "7cd6a5ff-c01f-41d3-b637-55964d863b95", "comment": "Malware payload (Formbook)", "value": "bac19e4a702d886d4739e45c0c310e62c93eea7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622613, "uuid": "1a93e306-6eac-432e-80d2-2dce2af7a794", "comment": "Malware payload (Formbook)", "value": "d79dc2e0e2c7536889b26db4b91678f5c0e99c8fdd8ada63cba0c77ad719e53e1caa2032f67ffdebe407307a1d480352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622613, "uuid": "f2c831af-63e1-4b90-897a-81d80cee859a", "value": "T1D84412E3E6D08993C9032F310A37DBB593BFEF953871A5491B1A7B315A376E92402187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622613, "uuid": "6dc087d9-821e-45e4-96f2-8abc595acc77", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622613, "uuid": "ce5aa5a5-c5c1-4da8-a3ee-dc098eedee68", "value": "6144:s0YuF7tgpFBzMPTqc1ufMzi6iZBBI/eDk/NkdB+N67q4DI:xtgpDMTzzi3VZDwNEC67qR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653622613, "uuid": "f80423a2-9f80-46f6-b176-a28744691b7f", "value": 277768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653622613, "uuid": "8d7c23ef-8215-42a1-a7b5-9379ada7bb80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622613, "uuid": "26dc4a8f-f38c-4791-8351-a646be62857d", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.8997.9549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a1e7d0-dd8f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653636957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653636957, "uuid": "1c0e7717-b918-4a70-af26-4dedc14e7c9b", "comment": "Malware payload", "value": "afaa3f4a9a241593ea30e05773c22980", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653636957, "uuid": "5ad9873b-04cc-4be2-a2d2-0c23aed68fb3", "comment": "Malware payload", "value": "25966cc19f04cbbdacdf04249247d606c037cb527669addbfb0d52e0cd948519", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653636957, "uuid": "dad2e817-5f26-4eea-b5aa-d0446aeb35fc", "comment": "Malware payload", "value": "1d9dabc7f48e7d3c50c3d7d36a371be6bb63746d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653636957, "uuid": "49cddc2b-3a26-46e7-be2a-de9062c2e527", "comment": "Malware payload", "value": "9c94d2e636aff99de67c51367cd2e4e0417db4737caa48c60fcec99162bce93f9e50608cdf3bbc33caf76e6d1950a610", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653636957, "uuid": "a5425ce9-5d4d-4b05-ba0a-b110dd1bc92b", "value": "T17B815D33B65C5EA7D729C5FD424B7D569252F1670FCFA840315CD99003697B08A6C1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653636957, "uuid": "37697966-36d0-4f79-94dd-4827cf25be83", "value": "96:rXNv4zQBSRu6lT85c98HwedaKR/UHpTQXbfZauPjspq:r9ALHTqc98Q2fR/UJTQXjAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653636957, "uuid": "48867521-7ab7-4290-b8f7-c365351f57e1", "value": 4205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653636957, "uuid": "ff5f8d88-9ec9-4860-837c-b622737d40f0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653636957, "uuid": "9fdf1bbf-36b0-4b1b-a557-2eba6878ab50", "value": "Revised RFQ-PO180911.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47c2e51-de0f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653691930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691930, "uuid": "098c2e5b-aa18-443d-83f4-2138b8152980", "comment": "Malware payload", "value": "b5f1aaa48619558a3ef6df47c50045dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691930, "uuid": "e76b1aba-ecc6-498a-9dee-023760139138", "comment": "Malware payload", "value": "25f62edaf2a7ad995ceb2d47178e7df1c55bee528a3a8385c7f179ad4e416999", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691930, "uuid": "5b860165-b9f6-428b-a78b-b4a1c18200a7", "comment": "Malware payload", "value": "be306a045f5dd81cbf89271f9f28e2f0a4e70c88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691930, "uuid": "f4d3ab55-585a-442d-9ac7-2bea56b6a510", "comment": "Malware payload", "value": "eab1be528b5f0e91554a2c829aa9fa0328c40fda61b387104c5438438b3544df04f6b84c871ecec36a898dceba5ca783", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691930, "uuid": "c9bb004c-7d3c-4156-9d88-a06ff2782fb4", "value": "T1F5D2D03DD56DAD45DB66ADB21DD582442BFB93EF7091DF603251B7901209500F348F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691930, "uuid": "4d7aac13-929f-4f65-814c-2e119982fecd", "value": "768:VNnVM9PuZPO13lrJKFVdknQueMpg/4uVcqgw09t:VNnVGE2Zu19/4u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653691930, "uuid": "0dcc619a-20bc-4d4f-9d10-497b36b38800", "value": 29420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653691930, "uuid": "fcb7dedd-1526-42c5-ad98-144d9b3f20f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691930, "uuid": "a039db9b-9a50-4274-9101-2fa98cb509cb", "value": "b5f1aaa48619558a3ef6df47c50045dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d8d506-dd7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653628261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653628261, "uuid": "d2053add-7b11-4fff-b22e-db9657710841", "comment": "Malware payload (Amadey)", "value": "bc94f9f5320edb6096e2503e9bf7cac3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653628261, "uuid": "d66b984b-d746-4a4e-9bf4-49d49c11c5e5", "comment": "Malware payload (Amadey)", "value": "2643cf9a55c2658f27c063bbb5092795a2c439d0f47bf2e4df6e73f74a15b0d3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653628261, "uuid": "96f4ae97-41d1-4478-8f27-ab74a6f22de9", "comment": "Malware payload (Amadey)", "value": "aeacb18d3703cdf16e24d32e80f2a71405cccd88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653628261, "uuid": "50d7b9a0-738e-4058-85b0-c870bed39176", "comment": "Malware payload (Amadey)", "value": "607428491972d8e64e01cf19fb9db2b3665168ec882d0d5d9893911dd667f618be65eac000ae2cfa23ae6a1e2fccb929", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653628261, "uuid": "8be045d7-5a79-4170-b10d-71e0747f139e", "value": "T14065230A15D9E5D2F76A08B680FE492C986ED6B15CF8DF193FC9AB82F48D4201B5D331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653628261, "uuid": "a459bd96-458d-4f4a-b2c9-4584e517d763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653628261, "uuid": "eadefcd2-ec3e-443e-9e3b-6b2a4f34e770", "value": "24576:YUt6VwTy3Cq0A6GIq7456J+TW/wUxeLvVl1ah4ct/hpBweKgxkGTQxZ6j:Hhyyw6GRW6xwRVChJt/7rVfTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653628261, "uuid": "5d501910-8f9c-475c-8d16-4a39f6f54dd6", "value": 1412096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653628261, "uuid": "856b920a-3812-4344-9a51-3bf5bb5f4f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653628261, "uuid": "8d444c57-f73b-456e-a515-284de0ea2553", "value": "bc94f9f5320edb6096e2503e9bf7cac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2adea04-dda3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653645649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645649, "uuid": "01afc490-4bbc-4d41-a58a-5879af215c1a", "comment": "Malware payload (AgentTesla)", "value": "163f28914ad14c19736ac6e46ce39c2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645649, "uuid": "7271f272-c56f-4c96-95c9-45a83be7eaa3", "comment": "Malware payload (AgentTesla)", "value": "26b161f882a3d8fe7a5d36b3499dff1fc50d9f46415610a2e11923d7723a79bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645649, "uuid": "e321090d-2e9e-4830-96f1-f02f82934fe5", "comment": "Malware payload (AgentTesla)", "value": "8efba47cad87c7c6c51d57038de8c2fd116f8dbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645649, "uuid": "280dc21d-72be-4fef-a829-f6d6fb7e35ae", "comment": "Malware payload (AgentTesla)", "value": "5eeae393f1b2f0d6f53e9a969061debd1a08c465e72d788c8ae35a30f7fe7ebbed43b66ab0c9c3cd84f6415c91656942", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645649, "uuid": "66e2a59c-9fc7-446a-a650-2525295c787f", "value": "T19D452311A7748B25EC6D2BF53085105293B4B00F6859F3847EDCA0FAAB3AB96CD53E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645649, "uuid": "6795930b-18f5-4532-ac23-de36333324c3", "value": "12288:YQIAjuzyMDZ0Fs8VbrcnJnXXChq4irMdfg3jyKdauD9RsPAEeS:YQImwyS0FHbrcJnHhBEfgTbddj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645649, "uuid": "d208a5da-8bc7-4bec-b2b1-041d00c1a5d6", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645649, "uuid": "7564b3b9-a7a9-4fbc-93d5-1f3c7d0f2702", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645649, "uuid": "48d0a9e0-0112-43f5-9516-58c3d6e4e258", "value": "instrucciones.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ec33df-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653676524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676524, "uuid": "dd8afdf2-f152-4432-8b20-c07e4ae6f50a", "comment": "Malware payload (RedLineStealer)", "value": "6d13b7d83b9cabff878aad640328449a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676524, "uuid": "0c913bac-b4c7-4047-b59b-f39ef6650f38", "comment": "Malware payload (RedLineStealer)", "value": "2779fffcb0e7fb79979502e7309d9e405fa0c3b3505e871fa0acd76be6d28203", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676524, "uuid": "b3df111f-f368-4a28-b211-8107e7e2d3ef", "comment": "Malware payload (RedLineStealer)", "value": "618f215b9fe992eb727c35c25d531109c21373e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676524, "uuid": "e22f9e00-4e1f-4e31-b71b-85ab5c976c21", "comment": "Malware payload (RedLineStealer)", "value": "1092a2a55bbc2f3dfbdcc01ec47823a23274ed91f3bc0e1b7050aef1d6e756c6ca59d1e00df0835c113dfc164cc31462", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676524, "uuid": "5d47d2da-0d08-40de-ad9a-a90b4ed75692", "value": "T1B3749E00B7B0C035F1B752F489798368BD2A7AA16724C5CB62D5AAEE57376D4EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676524, "uuid": "e4f85086-217a-4c50-ad4d-bc96ea096fda", "value": "c71cf9f936bf569e6fcebca0f1507d45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676524, "uuid": "8790d501-5f1a-438a-9d29-08d3c84b6fd2", "value": "6144:anTfBq8w4Twvv1ch0rnDN0V2CTa/FzTFwR3IZSDmLLs:y9q/Gw31ch03N0QC2/Fz61wSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676524, "uuid": "ef9ce37e-5e68-42a2-a8e7-9b1a198ea498", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676524, "uuid": "c521561e-8060-4cab-8296-d41ecabb9a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676524, "uuid": "772c4aeb-6beb-4c2c-899c-1e28a0c7d5bb", "value": "6d13b7d83b9cabff878aad640328449a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333173f8-dddb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653669406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669406, "uuid": "4085c86e-998b-4035-aba6-46ac5c9fd4b6", "comment": "Malware payload", "value": "f7c693266030e150076028f659665667", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669406, "uuid": "92187ce6-0260-4b02-823f-8e960564c5ea", "comment": "Malware payload", "value": "27e1cf8e4ebd48d83db12b2b09043e5be2d8d5785cdfecd0027b53f6f41efd00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669406, "uuid": "6db257cb-4e79-4e9b-a5b0-6b4001cbb2d3", "comment": "Malware payload", "value": "63d22c0bf83ebdc394f61b6783f823bc775f81ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669406, "uuid": "13eef25d-767a-4c10-af28-f120974e5de2", "comment": "Malware payload", "value": "5557f0937af21b71a18650daca94bad186fb32356ba30ea2e9cdd2c722dd2e6b5a794ae567b6083c985692a1a2792fcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669406, "uuid": "a02123b6-8b36-4560-a572-c2015610142e", "value": "T19EB272149F8C4E36DA263BF25BA3F1410635EEC25956CB5864E030466DF2FF10EBE925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669406, "uuid": "07eb1542-e9c4-4d1b-aadd-3ba86d6155b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669406, "uuid": "503cec21-9f32-46b4-affe-b0aee572dbdd", "value": "192:JEV3UtyAY9CO3mox4hWo3wUZlllllllllllllllllllllllllllllllllllllllr:JEV3jH4Ymox4ko3wmT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669406, "uuid": "7a35f193-4db4-4e05-bb50-2e8f02df7d76", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669406, "uuid": "de7527f8-9439-422a-81d4-1b5b75160550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669406, "uuid": "8fff0b35-19ae-4c49-8e45-4e14a7236aa0", "value": "f7c693266030e150076028f659665667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde01332-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653643896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643896, "uuid": "d502286c-f0ac-4665-840c-308793144c9e", "comment": "Malware payload (AgentTesla)", "value": "d1ec247ac74c419fe7840279fc602109", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643896, "uuid": "711deeb2-f999-4d80-879e-7632340b599a", "comment": "Malware payload (AgentTesla)", "value": "28eef9b2a3b34588cae34935f3adbe6fe22082b334782ccb4ea8f725eb743ba2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643896, "uuid": "605bdfb1-dfdf-4527-a513-47df872b8787", "comment": "Malware payload (AgentTesla)", "value": "46d61d7a5a7bf10b9d1f2312940264e3a4278803", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643896, "uuid": "e0f3abf7-5a2b-4d77-9be5-8f6f748f64c8", "comment": "Malware payload (AgentTesla)", "value": "78dbd31c21c4a057a62db1e7c97c70d09598d48fe008e0fe05ee1aa71ef4a2b7a5770f95fb5e7dedd5e6f15f0a862877", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643896, "uuid": "8631bd26-62f0-49f2-99df-1399ff12d8f7", "value": "T19BB4232A805B29F73FF126505DC3FE370E26FF0442CDDA9B4115E175F6AA13E6A68A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643896, "uuid": "fd33ef88-0ce8-4f9e-adf3-ecf998f619b7", "value": "12288:Y9THicWrFPBChePC9vdAQ7BGFUvoeO21AosWlLkayNVV:YoxYDldAQ7IFc1LjSfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643896, "uuid": "82b37f00-81fd-43ae-b067-3aae95bf85c4", "value": 528217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643896, "uuid": "2382c5c9-5af4-470d-9136-dee14c405778", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643896, "uuid": "7c0acf99-0d58-44e8-8528-182d988d1762", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c875809b-dd74-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653625419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653625419, "uuid": "148fc6fe-5506-4fb3-8d34-c4eaa07c7c70", "comment": "Malware payload (RedLineStealer)", "value": "ed64f06e1980a703b470450a284cbbc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653625419, "uuid": "01975f0a-67c1-4b0f-868b-76078c9b2c45", "comment": "Malware payload (RedLineStealer)", "value": "296f6f3725ca757cddbb4237d6563d780c69e57298a3e1dc04d741bf5ff201af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653625419, "uuid": "1fde2b8c-f9e4-4010-abc9-0507919bb896", "comment": "Malware payload (RedLineStealer)", "value": "5e76d777e0e48258d126f86c9d64b0a161005f3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653625419, "uuid": "5969069b-f6e2-486e-b0a9-204ff119556b", "comment": "Malware payload (RedLineStealer)", "value": "2a951ad761a1debf8a35e0e3eb1e9533807f6964455ee022947dc1bc733c3091fd462bf116e0fb66f25c582aa2dbfd72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653625419, "uuid": "8a50a1ef-b859-4efa-902d-5fc345860434", "value": "T1B916337BBF598AEEC089A0615E63FC0D79203E7F9E89B17A73D14BC703948A19D1D424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653625419, "uuid": "9baa8469-43f8-41bc-b0bb-ebf54c2a90b7", "value": "98304:duSyVlSaKBRV18y81LbAR/rjpAi3UrPZ6Ntrn8c5PtVd7RYvWMPRqcWq1:duJnSLO0/rjp+INtIYRgWMP8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653625419, "uuid": "bde33d95-c68f-4a6f-bfd0-f3517dc5915f", "value": 4395224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653625419, "uuid": "ac8d76dd-94a1-4cc7-a566-91ecc6b18536", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653625419, "uuid": "19ca3f35-6004-417c-ab8a-a882c704c4c3", "value": "for Rins.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceab32ec-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653664943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664943, "uuid": "a3fdfa0b-a30d-47d3-8e67-63f36d29256c", "comment": "Malware payload (Formbook)", "value": "d891e26c0707977398e963d6076eeae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664943, "uuid": "94033e23-859f-4b4a-9c6a-9dda7942c549", "comment": "Malware payload (Formbook)", "value": "2979a77144d0df70f4dff084420d8e034eb6f751027fa44d158de924960f2a6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664943, "uuid": "fb12d455-19dc-4f57-a1ac-2e4931ef29ec", "comment": "Malware payload (Formbook)", "value": "039457a2c4d73c24ef410a7665a04e9d456019e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664943, "uuid": "00f2be4a-345e-44a6-8af6-c39a246adf10", "comment": "Malware payload (Formbook)", "value": "6d749f31992e566c5ded29a829f437e79cf3b409212270a5584e9df35112b0e7ef44c81304b59c6c111fec5424294ed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664943, "uuid": "8c016b4f-ae6c-4671-88a1-28fa7f114431", "value": "T14EE4F10072F81B22E2BA67FE6578A18403B67D946520E34E5DC278DB3B71F918E45F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664943, "uuid": "4127970a-2689-47db-afb9-679b1d858548", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664943, "uuid": "d75c59a8-0169-4947-b115-469ae2527603", "value": "12288:O092x9bHoAUOvqVpleUE0q8cf7qb4dHDn8LaRASedck6Q:nUfbHodlC0qj7qcdHDn8La+SCchQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664943, "uuid": "68326fce-f985-4c13-a83d-0d829b7514d1", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664943, "uuid": "515116a3-813d-4621-bc80-74d1a52d71b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664943, "uuid": "ffa1d4c4-2a7c-4af1-80d5-4a715512c1fe", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac466da-ddbd-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653656722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656722, "uuid": "65aa4175-df69-423a-958b-82b57cf90dff", "comment": "Malware payload (RedLineStealer)", "value": "b486e660a5325fa3fb08517723fc2acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656722, "uuid": "9b3746ba-7879-4c9d-8dff-d7565c4acb46", "comment": "Malware payload (RedLineStealer)", "value": "2a122375ad468cf72e87bc27b2fbba8664ccfc7dc6d60a59d7990e8debc5f680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656722, "uuid": "452c64ef-9d26-44cf-a7d6-829ec1ca9304", "comment": "Malware payload (RedLineStealer)", "value": "59e5502d6c3ed46080f72ce6297577988b5a4543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656722, "uuid": "d9a81935-d787-4afe-92d3-c0e162267171", "comment": "Malware payload (RedLineStealer)", "value": "0d7b4f1bfa342e91db4dd8f4af695a2cbf51f5dcf9727c6812a46be5da8d159d21bcc7ba9e37d3dba152a4abf2c089e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656722, "uuid": "14fa342e-6b52-48a1-b7c9-619199d24301", "value": "T10FB509035A8B4E75DDC33BB461CB633A9734EE30CA2A9B7FF609C53599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656722, "uuid": "d2f4de16-6cc1-472a-8761-302a48786c0a", "value": "89757deda76ff34613a913675f115eab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656722, "uuid": "0909b5e8-f907-46a8-85eb-44e356a945ce", "value": "24576:usIapPA8tmJ6aPvd2rcmo2qQ3BY/RxVwnTTD4A53PkJGbOgLIKzuQ5V3h3KK:usIapPA88JtV2nWdVwz4AdkJqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653656722, "uuid": "db5952b3-90a8-45db-90d4-923e10a1158c", "value": 2310852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653656722, "uuid": "06b8846f-6dbc-4036-b7d2-8d9b18bdd99a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656722, "uuid": "5d1bbfab-f49e-4793-95bd-3a9899420283", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b087055-ddc3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653659031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653659031, "uuid": "342057eb-0840-44d7-941c-2bf5b5990093", "comment": "Malware payload (Formbook)", "value": "8c6e26080f9ee5e69d9ef04a99329511", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653659031, "uuid": "b40e7a7e-fe13-4f19-9e13-de9fecaf3333", "comment": "Malware payload (Formbook)", "value": "2a25e0a533b850782b1fff19767de5ef74df1c9c02541c510f68d42dddf35cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653659031, "uuid": "51366f2e-5f65-4f63-889b-2b3e9d3bad20", "comment": "Malware payload (Formbook)", "value": "37e45bb13afdda5529d84b516a81e909db9233e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653659031, "uuid": "1789fc13-5491-4217-990a-a1b693aefb6b", "comment": "Malware payload (Formbook)", "value": "741e438953e453f058548f7cf67b3f86eaa73a7fecbdb2f636dcc1815007381dc278a24fe3a06224b0c2e938c1e69c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653659031, "uuid": "219bd568-5cfb-4482-85a1-aca0832036bc", "value": "T199645C49B876D161C048EB383D92C2305761BC27AA31C82E95C63E6FB7F71A73A451B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653659031, "uuid": "115cbc36-adcc-476a-8ce8-9d06c5d7ebb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653659031, "uuid": "8cdd0aa7-a417-4d0c-b693-d937beaac606", "value": "3072:9kUnwLS2Vbze+uZtuQ0UzDNw3C0wR2c2vVZ9pwPtV3vJPg1NXHII6FgdZwgJRZ/D:Fehe+iXFBw7w0cQxwV3vaHIIeHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653659031, "uuid": "bc73cb24-f780-4e4c-b90c-eaefbce777d9", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653659031, "uuid": "ef1c6a01-b1e8-4ae3-80a1-8201e9c8c8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653659031, "uuid": "da882483-9b02-4ef5-aa4c-bd13e02680f8", "value": "Confirmation Transfer Ref_MT103_00234568910992898.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa61b0e1-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662734, "uuid": "596357c3-38d7-42b0-981b-cba929a8a418", "comment": "Malware payload (SnakeKeylogger)", "value": "b8372f6c3a0e4e2dab3fda25640e66f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662734, "uuid": "9625c9db-fc1d-4a65-a14d-638faed0b585", "comment": "Malware payload (SnakeKeylogger)", "value": "2af6715b50902b94ba44a89f814f5d38e4918541242aa8686c587ff97ecbc094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662734, "uuid": "77f82e8e-0ab9-4010-96bc-9123f6292dfe", "comment": "Malware payload (SnakeKeylogger)", "value": "729900b1d657dfff844ba06d11526e37c37b7be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662734, "uuid": "ca704aa6-cfd0-42f8-8d02-4bc485c994ad", "comment": "Malware payload (SnakeKeylogger)", "value": "517e688d59b6b0ab16e5192c38c745cf4599f907385a87f2f80caf1c3d57edae8f6cf8908facffa9aa875e3de426cb60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662734, "uuid": "53c06f85-8b05-441f-a74e-5e63c56b3843", "value": "T1FEF36881E780974FD83F89B93875939C2E42291C5A132BC1DB65BAAED3365463BFCC11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662734, "uuid": "7d476981-e861-4d48-b846-1475a41d8699", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662734, "uuid": "f3f70d15-dd86-47a2-8dc3-a25e2e0006f2", "value": "1536:GZg1EE8E8E8E8E8E88EV1qQqi+7C4JdcQQqUdpx:y1qQqi+7C4JdcQQqUnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662734, "uuid": "eca44818-10bb-4d93-a2c6-815b754a3b9f", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662734, "uuid": "eeffcfd9-9f4f-4d5d-bb13-99ac258724c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662734, "uuid": "6b9192d8-3642-4072-bcc4-c6e7da1a2bf6", "value": "YASAR KEMAL - ITC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f64074-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653664742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664742, "uuid": "868adb4f-543f-454c-93be-caf5e13d0161", "comment": "Malware payload (Heodo)", "value": "a38c501a847b4764e53dbaaa3faf7d14", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664742, "uuid": "20ccdbea-9baa-45e0-9ad9-77957bbda847", "comment": "Malware payload (Heodo)", "value": "2c9b8133034aa466c398e5ee7e8583c0a238dc40f5049ce84f309be03dc7bcff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664742, "uuid": "dd6c9260-4190-4eef-a9a9-3f0f37be12fb", "comment": "Malware payload (Heodo)", "value": "aa0f4364c5c69fba2ddd8566045dbee7de3b46de", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664742, "uuid": "77cfb59e-81ac-4be6-aae1-7d537d1b5ee4", "comment": "Malware payload (Heodo)", "value": "4a615558d1faf54355044d722e4b7fb97a45e445235bd0a68b509f0e99836106e10581a2e259033d210368c11a154e20", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664742, "uuid": "fb045d11-4231-4870-ae27-df8571e97094", "value": "T12994CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664742, "uuid": "4f451323-8f35-4e95-8832-82ebbccf7f9f", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664742, "uuid": "46ae74cc-30cc-4e44-8375-0382d074bdfd", "value": "6144:I9wEpo6/4WaPgMIuxqqqAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqqAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664742, "uuid": "5e5ad528-b761-4d92-8536-66450a243264", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664742, "uuid": "e56c2940-3603-4cd1-a168-da6f71b88e57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664742, "uuid": "3d4f7a09-0a77-4785-89bb-fb8f445d32d4", "value": "a38c501a847b4764e53dbaaa3faf7d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cddcf6a-dd97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653640136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640136, "uuid": "8b48efab-894f-43de-8bbf-a2e1d1b9b784", "comment": "Malware payload (Heodo)", "value": "fa920d1507fa931b5bbd784dac9e8450", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640136, "uuid": "0542c503-cd96-4bb8-974e-3c4e752583ce", "comment": "Malware payload (Heodo)", "value": "2da256565e7f5affa758a559f833aea2629702ce1bd7368c85b73dd7044cc1d7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640136, "uuid": "a8578152-39e6-473c-ab53-0856eb06d277", "comment": "Malware payload (Heodo)", "value": "86e8f9efb9653ff3aa7bd02f90be36eb85635253", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640136, "uuid": "215d8aad-0e3e-4df6-8e78-f0afc3436414", "comment": "Malware payload (Heodo)", "value": "d8c9e2cc122f6a9862cab52a20ed2f6fc96423bf8149c30edbe3d9b2baf6e906297f20584359982328908a802be5363f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640136, "uuid": "8db21447-5a7f-4881-9835-ec67d096fec2", "value": "T1B894CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640136, "uuid": "ad9810c3-047d-43d3-b984-64f43c8218c7", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640136, "uuid": "eaeef5ac-102f-4559-93a1-2b36b036cd31", "value": "6144:I9wEpo6/4WaPgMIuxqqEAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqEAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640136, "uuid": "4d67c66d-aeec-4305-bc2f-4c515ee68848", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640136, "uuid": "904a7760-81cf-4c00-a598-304c94ce2248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640136, "uuid": "9b584c38-98be-45ac-b797-51d123d7a031", "value": "fa920d1507fa931b5bbd784dac9e8450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ac713f-dda9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647889, "uuid": "f4187a13-4694-41bd-82b3-43c286148afc", "comment": "Malware payload (Mirai)", "value": "1f18681af0883191322893a9a410331c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647889, "uuid": "ed5fc212-c4f4-456c-858e-51f84f7b27d1", "comment": "Malware payload (Mirai)", "value": "2dc85d7d09c9312c10ba8ec52e9aeb7356a78780cf9f416394ed93fbd80eba11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647889, "uuid": "ea1ff26c-dea9-4e53-9694-582c68db85d9", "comment": "Malware payload (Mirai)", "value": "bd0c8e1dd0cd22e92801d45ec3b294ecd6367999", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647889, "uuid": "cd844205-76e5-469a-a4ff-4ee2da906de4", "comment": "Malware payload (Mirai)", "value": "b70fcd641cf19e7b3af3004d7eddd25d64000b736249fe202de30075a58a467588bb185633075d196aa7ab2e01c5f0e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647889, "uuid": "d478ebe0-8f82-446c-b8f0-e7ba8aae9ddf", "value": "T18033E85279C26A16C6E0637AF96E81CE332177E8D1DF325BCC211B0476D651F0DA3B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647889, "uuid": "8b6fb048-b10c-4fe7-8691-768ee6e44ff8", "value": "1536:5g2uZQ1i3UgyHpVKKaxgDg60UsHHHgId2Zoh+fg57s:STZWsnPd2mhAQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647889, "uuid": "b51c09cd-3a48-403d-922e-733973243685", "value": 52140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647889, "uuid": "1b37808c-a98d-496f-846f-316a2663fb8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647889, "uuid": "d625f338-b892-452f-9d5f-6c474f641720", "value": "1f18681af0883191322893a9a410331c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c41878-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662487, "uuid": "5502596d-b03b-453d-81ca-1c21fa8a244d", "comment": "Malware payload (SnakeKeylogger)", "value": "276869013f150e874c58bd3e37a6e88e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662487, "uuid": "73e9a558-bc4a-4f2f-9d04-028a7031de5d", "comment": "Malware payload (SnakeKeylogger)", "value": "2df40dc5e28d4d1a1281cb243746f61a2b04b460556600775b0c080bae8b173e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662487, "uuid": "2f128c85-ba7e-4ff8-9126-56fc4b7cf903", "comment": "Malware payload (SnakeKeylogger)", "value": "9e328ae29a8f807eee2d1c4c4cf105a3e03d338e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662487, "uuid": "e2c0fac8-8e40-4554-9f1a-1aa59e984e1b", "comment": "Malware payload (SnakeKeylogger)", "value": "829e2226fc5e6d42a1b1a7247dd3621987141bca653232f9dde9a8804f5bf940cc4bb14f5e98280818be253c9f0c90b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662487, "uuid": "2d00aa5c-7067-4d70-89b8-6a0dec74346b", "value": "T159C23B03B25EC170C6689BFBE55BD64303BEE643D553C70E345A238A2C137E9CA4966E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662487, "uuid": "4c0248ab-31c6-46f6-8653-0aa2d48ea33d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662487, "uuid": "6f75762a-27cc-4d3d-8349-7e057811db8c", "value": "768:F8dkUt2xITqdkyKvEnJDi2WDSwzuNg01m:FxU8ITYfJVVwzuq0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662487, "uuid": "d6d70888-7e0c-4c03-8a40-4341e41567fd", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662487, "uuid": "2bea3412-5622-4b31-ad93-e3a60805b20f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662487, "uuid": "f3c38f70-b768-4bff-bc7f-d030cf3bcf41", "value": "56516426-056C-4DBA-984B-979F68AB8D18 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1462c5c-dd65-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653618964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618964, "uuid": "4134262b-93f5-4427-9f59-23054f0b81a4", "comment": "Malware payload (RedLineStealer)", "value": "831350fb7865f40e548352350c87c740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618964, "uuid": "899261c7-e0ef-42b7-b7f6-75194e8a7aee", "comment": "Malware payload (RedLineStealer)", "value": "2edc1e4bfaf73196e95ef1a4790971d031605004279e71b8e3d2f1e6a11190ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618964, "uuid": "d15e0ccf-6eb3-46ce-b9df-190378d719f0", "comment": "Malware payload (RedLineStealer)", "value": "00e5eb53c190d6d6048b0366bd37bd808a2c52ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618964, "uuid": "449a5802-5046-4cf3-acce-cd4acc526b86", "comment": "Malware payload (RedLineStealer)", "value": "83f21fc993e913d78ebeaccd413a5063fe004ae95c9fbaac04bd41fffba097ec715e13092c1a9d3cb6e1350b2f7dff1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618964, "uuid": "910f9291-8e96-4f0c-8d55-8975ead4d31b", "value": "T18564D01175C5C032D0D725764122C7B58EBFB8A16A366A8FBFD93AB99F303D1963130A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618964, "uuid": "c25bfc49-d5db-40e9-a7e4-21f3165fe675", "value": "6ed3e1e1abd7428e917207642b1fc1f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618964, "uuid": "e1cf18fb-e526-4562-87c7-73c0d45c42e2", "value": "6144:VETLTk7oT19x/B7TsK4Ax1k22STJg3Pg3/H:VuM7C1zB7TsK4MT2gJgo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653618964, "uuid": "61acdd4c-48f0-42d1-88d8-71a253669f68", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653618964, "uuid": "ba21f3f3-103d-411e-8515-30ba98677530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618964, "uuid": "f8dab5c3-2ff5-4712-bb4c-09c1471fff75", "value": "SecuriteInfo.com.W32.AIDetect.malware1.13545.16825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea60731-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653665292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665292, "uuid": "fa256131-8b0c-4b54-8e9b-46d633f91527", "comment": "Malware payload (Heodo)", "value": "c9a7d5a6f9630ebfabeb62620fbc4240", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665292, "uuid": "81b290ac-819f-404b-85e1-04f385ccc5a2", "comment": "Malware payload (Heodo)", "value": "2ef1062c3a143384de78238598e032c379b02b7462d5a4f8429b625995385f95", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665292, "uuid": "6b54b10b-ac4c-4efd-b7cc-a601c91ceb9a", "comment": "Malware payload (Heodo)", "value": "a6adf56b72d705058a3b1f3b76f1898175f93078", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665292, "uuid": "9ae67e47-c214-4282-9386-bf03b5758e08", "comment": "Malware payload (Heodo)", "value": "007c95b133518e7eb62087509c6183c9c3074f36ee2ebc9858faa3e67872210fb3e46148bbac376c52e5042677f1536a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665292, "uuid": "c67b875f-395d-4350-99c5-aca4bfd3685e", "value": "T14394CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665292, "uuid": "667d04b3-30d0-43e9-a857-891c0afe9e53", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665292, "uuid": "36f8b4db-2073-4ac1-8141-c43b5ba62a41", "value": "6144:I9wEpo6/4WaPgMIuxqqQAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqQAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665292, "uuid": "4ffbf33b-181e-4eba-930a-9c914db7263f", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665292, "uuid": "80bfc5c5-5d09-492d-8af6-da2dffe7e9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665292, "uuid": "cf88bde2-1705-4c92-878d-7bcce12d0198", "value": "c9a7d5a6f9630ebfabeb62620fbc4240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b37a09-dda0-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1653644357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644357, "uuid": "6231384b-f0a0-4d62-ad26-bf2bd1b242ab", "comment": "Malware payload (SilentBuilder)", "value": "14c612519ff0030463b32a3d7d29d155", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644357, "uuid": "f38748cb-51d3-468a-a760-432b061e6cf4", "comment": "Malware payload (SilentBuilder)", "value": "305ff24aefec3e331b80ccde2cf9b027f81e26950fc1dc34421f5d0044b19fc4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644357, "uuid": "9e72bcdb-b57f-401e-9802-cf12d4cf4599", "comment": "Malware payload (SilentBuilder)", "value": "b6f5182b5e4b0af4cf9f2eebe5dfbb57d40245b6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644357, "uuid": "c54c878b-8c45-4129-aaeb-def240162587", "comment": "Malware payload (SilentBuilder)", "value": "d413f710885b0dde7031544ed5da4caad72017bffc3fc67d418e526281dd10e8b626e52a6bdebc62588ef3f3ecb603ee", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644357, "uuid": "a1c47d8a-df58-4d1c-b07a-77039adef4eb", "value": "T1E1634B59B76A885EE9198B3048F747DA6323FD308F6F0A433259F3926FB9590570390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644357, "uuid": "05bf2c6d-98c7-4e62-ae56-737bdda52c88", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+e+hDcnTLiQrRTZws8Egk:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644357, "uuid": "8f1ccbf6-1e71-467f-93c4-0ecafbbf71ce", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644357, "uuid": "d86fd4b1-4b37-49d3-a645-b1f62b7f94b9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644357, "uuid": "f76498d0-0a74-47a0-a508-a8737d03f603", "value": "DETALLES 33.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976db02c-de0f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653691908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691908, "uuid": "26a67f13-911f-4f1d-a0cd-1cbd8451f1fc", "comment": "Malware payload (Mirai)", "value": "4be30bd7c4eb4bae2d7101634326081f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691908, "uuid": "2ac151da-c0fc-4dba-ad00-966255ceac00", "comment": "Malware payload (Mirai)", "value": "30610de748385b66589b904ea64fc09204d8c06cf9a316935f3f10d83704e054", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691908, "uuid": "3b4344b4-9ef8-451f-ae09-760695169ce1", "comment": "Malware payload (Mirai)", "value": "df8c137d9b0f767f6ba8983cd19884c88143f34c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691908, "uuid": "2505129c-9e66-4469-b18b-6975518659b9", "comment": "Malware payload (Mirai)", "value": "796bf0cfe13acded580b9e6fd2da22e56ea84f50d29191d69fde7229a69a000e58648d32cdf7c7c46f0a10086ac39398", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691908, "uuid": "294350c1-76fc-4d5c-8813-98049f05097d", "value": "T105732814AD7D2E27C0D4A13E12F7C716F2E5360E24B0826E3D790F8EFB54790A9466B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691908, "uuid": "e7c83028-4d57-40ad-bee1-4c214bff3d06", "value": "1536:C0GOL5xSf75nuTRn7eNph+/IY/Whcrye6KtmgFZFPvwJ:p5L5IExY6LMcrbt/bvwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653691908, "uuid": "f3424c72-0870-4d57-9281-7bf0653100e4", "value": 79544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653691908, "uuid": "9657ae8b-7510-4429-8206-bf8588df64d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691908, "uuid": "884556d6-096c-4159-b26f-248326059d43", "value": "4be30bd7c4eb4bae2d7101634326081f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9badcc7-dd8f-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1653637044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637044, "uuid": "c563e303-cf29-41b6-a6aa-cbcb8ef3d8c5", "comment": "Malware payload (NanoCore)", "value": "c75223216e6c46bea1c4dc7de9f31f9a", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637044, "uuid": "7f1959f7-97b4-4fc4-93b8-a838871a31e9", "comment": "Malware payload (NanoCore)", "value": "32d4eaef5b531750a4fe5d4682d9917c3014e04265605d4becccb0f6752abd2e", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637044, "uuid": "4aa34673-cfba-4fb7-bc1e-895c85ee0a40", "comment": "Malware payload (NanoCore)", "value": "c55e77ab1361495b7ace56eea06f1461c1551a9b", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637044, "uuid": "007a61f1-10ab-4dd0-9e1a-57981e191c25", "comment": "Malware payload (NanoCore)", "value": "06fa21650cace2918b0e0413505ba49d8c8d76869f847ce495ee39270029e0f5cb3dc706bd2162c54d95054ea061daa8", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637044, "uuid": "aebe4bb0-da58-4ed4-8b10-ebd4e135a15f", "value": "T1BA915B52F659F607E080B9BC3F218BE4133481712EB64657A8EBAD2BBD21AF6015F118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637044, "uuid": "9edc828c-cc80-41ec-a87a-39a4c88f5e36", "value": "96:kVtxr1oTSpClcE4sZThUwtr+hJOvJ4KrCqSVrhosCA2on:IBphHuUwtrzaKtUoiZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637044, "uuid": "cc5d19a4-1fdb-4510-8c28-54d674123053", "value": 4509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637044, "uuid": "2efa0ed7-4d70-4194-9c42-6718725c5990", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637044, "uuid": "62195fcd-0723-4a55-824c-0938691bb3cd", "value": "bankslip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e32df02-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653664378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664378, "uuid": "b468e96c-3f83-4115-97b3-1eac01caacc4", "comment": "Malware payload (AgentTesla)", "value": "ae32dc554c2388d6d8fe2ba33fe94d5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664378, "uuid": "7a4318ea-9e1d-4d12-9825-c092691a475c", "comment": "Malware payload (AgentTesla)", "value": "33032729cf5a72f893460bcb8d5c1e04778437dd53f68af7ba3d5a5d4481e220", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664378, "uuid": "4cd958db-2960-4bce-9e61-ffd7c5bcafdb", "comment": "Malware payload (AgentTesla)", "value": "07b2da506e5e25ab96ac47d025600bd068bda4e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664378, "uuid": "31a92c2b-c8be-4fa6-a9cd-43210be33acd", "comment": "Malware payload (AgentTesla)", "value": "755a2e6be2f8bd5f7e2b61daafad03e4de544a5ece46c01a8d836e633cf7ab61d8989521c660d6455501841f8b47a037", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664378, "uuid": "58045e62-b4bb-4982-9123-2d376024290e", "value": "T12A82D042238F335E90E4419C5AD1037A3B8E25E016BE9D62067DDAE20B64498F64F4FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664378, "uuid": "baaca1e2-0cbb-4cc5-8f94-540ee78ab97b", "value": "384:32ZxTcvaasbrB0+4yWMk1RfPXxtvwVpokkmVpsf1xst9Q:QxTcvQmP91NPBt4CVmVJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664378, "uuid": "80006194-25fa-4024-b949-39a672a54842", "value": 17724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664378, "uuid": "5ff4824c-1026-415c-aa77-32f578d350b8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664378, "uuid": "2199d77b-e1a3-4eb1-a54b-c54e7b7ac703", "value": "Vsl particulars.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030453d9-ddcc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653662883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662883, "uuid": "a4674b34-d7e5-4245-97c5-1f65f7f24b1f", "comment": "Malware payload", "value": "d055fe04df61e2cecf4c1acc281a2db9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662883, "uuid": "e3860178-888c-48d4-b134-87ad1e61a8f0", "comment": "Malware payload", "value": "331544995497a907841c3ea0f6554c0fc47bb0c01945546ae31764d1726246cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662883, "uuid": "6c80a42c-9ac7-42b8-9fd0-e76f8df04131", "comment": "Malware payload", "value": "a45e3359fcbc9fb2f6e4e4ca30001774e429afc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662883, "uuid": "dbbfdfbc-ff04-41eb-bf7a-53236e7d0d5d", "comment": "Malware payload", "value": "f8a3c474d3e7ffb6b0f73a13e18ff1e39d9563f136743fe1aa6820b407cfde9c3839e4ce9447099a15fd6e5dc24fab62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662883, "uuid": "79ba45c9-53f4-47ab-9ac6-def670d6426f", "value": "T1A0B392667E68923CD63033B5E981C9C61E28BC081D1A492FB4E1F34F56BD58BCDB169C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662883, "uuid": "2fcfe01c-5a9f-4e99-96ab-0b1bb358aef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662883, "uuid": "2b3e7fa1-254a-4659-a062-e117dd6bf6b0", "value": "96:COm3IzcTX5+vTSzPixN+UC1nRpJM3WxXdhzB/LvONkTDoQvhT22ZUCmUD3QnEdzj:COVzcjxzPstC1n/YyX/LWKwH2ZlToEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662883, "uuid": "534fecdc-3fd4-4fe6-9679-e47679bcef02", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662883, "uuid": "36bc8291-6d42-433f-81bf-85ba21c0e11b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662883, "uuid": "aa17daff-e9c1-445b-8d48-ed7dc0ba3644", "value": "Profoma_Inv-01298627354IC pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362cc337-dd8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653635481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635481, "uuid": "53c035c7-f51f-4bef-be04-3ff87e748cbd", "comment": "Malware payload (AgentTesla)", "value": "fa56809ee74bd3c0192f7e7c9f28ecd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635481, "uuid": "ff789cc9-6f1e-411d-af11-8fdbb99a939a", "comment": "Malware payload (AgentTesla)", "value": "33b4ede467b4a2ae4c3901ed26140bd18404c597f4587933b21b8a8a1c759912", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635481, "uuid": "e812aced-06f3-4c52-96c7-21bd511fe105", "comment": "Malware payload (AgentTesla)", "value": "c7dee2c081dc23fe7f3f4931d55d4cc63ef65514", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635481, "uuid": "3e066dcb-73f0-4fb4-95b9-a81ac4a26afc", "comment": "Malware payload (AgentTesla)", "value": "16fe2f5c7925b8f1ac594024e9a3e2e3c67b852295e581178a3262e4dd1f9ab71d7ab87136615d8f4906c05f5874db1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635481, "uuid": "e8d0c5f8-1a64-4789-b1c6-7be445937019", "value": "T1F3842301FF1F7043830B8D9E3EA35DF58CB8CDD4C9D02592CEBA5221969918A65A7F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635481, "uuid": "c1a944f0-3b6a-4c74-9294-949db0c93b18", "value": "6144:PYqx+5dOi3TUPqrJL976Lb/MwYSyq4sv34TZpvDrRy6PaEemNvcKAJ/+Kp8U8lXe:PT+asT8qdL92HkVxmInrrRTemm9JVp8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653635481, "uuid": "f24125cf-f3b2-4c9d-a542-8d4870ef45d4", "value": 380505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653635481, "uuid": "44225c98-cd47-43f6-8516-914e73dd40e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635481, "uuid": "1253d79e-5259-4399-b0a9-dbc3992885ce", "value": "MHD009765432345600098.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4703d30d-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653664715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664715, "uuid": "29388f98-3ffc-47b6-aa79-46fa3903fb5a", "comment": "Malware payload (Heodo)", "value": "b3a0206e4680e621002c3447b1734b24", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664715, "uuid": "67b7ac45-e032-437c-b53b-1804e24a6276", "comment": "Malware payload (Heodo)", "value": "355b3c22e74ae11313d3be536588776deac1caf9a00b6c1a803bd5c30bee5255", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664715, "uuid": "a935bb02-a3d9-4a20-98c5-d643d8e99501", "comment": "Malware payload (Heodo)", "value": "c12744a002d8c642f2e99c32dfcba7d64e2d6e3f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664715, "uuid": "b20f8d0a-96e0-43e6-8823-759921ab379e", "comment": "Malware payload (Heodo)", "value": "0b650055b2b1b3992c0de27b8cc197e4c57b4e91e57b63d694be0be0372980a0c370f921058685795bcdf5371ea6a95a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664715, "uuid": "6eeab57d-4ccb-48d2-a768-247f1c7e9757", "value": "T19194CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664715, "uuid": "30035f54-c3da-4a95-a8ff-837d050590e4", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664715, "uuid": "c5d98324-c664-42bf-b502-6ea1c06a2bb4", "value": "6144:I9wEpo6/4WaPgMIuxqqAAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqAAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664715, "uuid": "5c368bfa-5441-4d83-8c5a-c79318dfe16b", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664715, "uuid": "1aaa2b25-0ddb-41aa-a69a-7a1da6472f30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664715, "uuid": "1b9a4668-0352-4cd3-886a-dd081d6a306f", "value": "b3a0206e4680e621002c3447b1734b24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea184b3-dd96-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653640086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640086, "uuid": "70cd529b-26bb-4fe2-a1e6-160ad07731b3", "comment": "Malware payload (AgentTesla)", "value": "ba7125dc0faaa96b05a944a004691159", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640086, "uuid": "5e93f7b1-2642-4ab1-bf82-97d043c73978", "comment": "Malware payload (AgentTesla)", "value": "3560acd3cac29a55ef74deac8b2080b0d57be6e901699a780ae59cf3eff8c7dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640086, "uuid": "0c436291-c561-4a52-ae42-c47f514f2d93", "comment": "Malware payload (AgentTesla)", "value": "c99db3740cbc2d70d61df179707eb763e786416d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640086, "uuid": "4ec789eb-ee3d-41ed-aef5-4a9946da8465", "comment": "Malware payload (AgentTesla)", "value": "aaccb001aaaf0f03943516ce80da34bba839b9c897fad5440a9ad63ed48a9fe1dd011eecaeeef58a2d24d55edd8ef057", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640086, "uuid": "8b9c0ba8-a087-4b21-9c4c-688a61e90758", "value": "T137C4CF313A6C7E13D2FADA7511A0804006F1968E7A73F55B3EB3289F25E1B419B71A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640086, "uuid": "d6b3290f-6f2e-475b-9e6c-66a186f45d79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640086, "uuid": "569a290a-976a-43ec-a4b4-e39106f078fa", "value": "12288:j2FFOudyOg/yc9TWcujkOShbA0EHYAbLX1bdRJ:qFOudyObqWcuAA0EHJbdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640086, "uuid": "9beef2b3-d977-49fd-9c65-462a82b0da1b", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640086, "uuid": "33c6dfd1-01aa-4e36-9829-aa11c0217eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640086, "uuid": "a160c2bb-6d2a-4843-afc3-5cc7edd94b35", "value": "G4tQVT2iUBOkX0S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90302877-de07-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653688460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653688460, "uuid": "4bedf57e-5754-4ec5-be03-1b9d351b2af4", "comment": "Malware payload", "value": "fb99b1ab017cfe35ddfb30f5f3fcf6c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653688460, "uuid": "f1286436-6eab-4107-b26d-dd7bc65d6c6d", "comment": "Malware payload", "value": "363c3288efc15bdba3db28988766e6554fca04e6bcb49e094f7a521388016fe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653688460, "uuid": "37c87d4c-24b6-4cbd-bcda-947e5aa370da", "comment": "Malware payload", "value": "8baa5b4d5cfcc7b5d6adb819ffd89a11b7540833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653688460, "uuid": "4f1d8ba7-f734-429e-9d2e-f320ba6e3691", "comment": "Malware payload", "value": "be32dd213351d4744772d9518e442b0a91487899ac8bd7dbcd8ae2e09024ee894c05e16add42d6e6617692190726370e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653688460, "uuid": "62d393f4-5001-4f2d-8bdb-55ff05effd28", "value": "T186F4E02972725E13C0692BB9C1D7FC1917F05907E462E2C32FC662CB2A06BD94DC9B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653688460, "uuid": "c6e0be46-1101-448c-a800-9e0768f48172", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653688460, "uuid": "6eccc97d-abe6-4472-9249-a8a2739f8538", "value": "12288:KQCJO4843R0FOclsbfXHcsstj8wJmlkM+MREPd3U2a3+vqgKM06YldkJXmVCu430:KxJOdixclsb/cbXJhFV3PRJKMpUdk8VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653688460, "uuid": "48872829-256c-49e4-b859-b73b0d73993f", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653688460, "uuid": "aaf126dc-d8d2-4473-ab5e-a026763b8be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653688460, "uuid": "8a029888-da4e-4eff-8129-3947b9ce206d", "value": "Transferencia____________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adc26fe-dddb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653669580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669580, "uuid": "b7488bdd-2eba-4330-b607-1fca90379622", "comment": "Malware payload", "value": "082d9a2c3299a9e3b827b41e7a936fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669580, "uuid": "cbbaeba8-ad13-4a9f-b41a-ea368ec710c6", "comment": "Malware payload", "value": "36b2b00947615efb07be26da546653e5bb5562a6f8c067bf14ec171d9cc9f5cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669580, "uuid": "ee641c35-a6aa-4b50-820b-54ecb50997b4", "comment": "Malware payload", "value": "df9dfb765b7870165afc4952152400418d40bc69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669580, "uuid": "b28abe26-2a23-44d4-ac92-ed46556eaa7f", "comment": "Malware payload", "value": "2521c957e5ce542b60a064ba2e8f775d44fadd63967d85ef2d2720294fabdafacb418e4c926ec4292aeedc10f78bb532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669580, "uuid": "b00f5102-20d1-4082-8eda-a06ee72963f1", "value": "T19015ADBEB2423DDFC5678A71C9D85C10A7606466830FD243A21305DD9A0DBEBEF192E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669580, "uuid": "ee098e21-e5f1-48b6-9330-2613d1be5c15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669580, "uuid": "4b71dc61-a415-45ab-a184-e0d1681f9fc2", "value": "12288:lLuLlFDJCJSFbq4qE7pS9x72TQc1vrPbXnFQZkt1LCYviv8u6ycW4Qljgit5T0Qg:FYbDJ+SFbqU7pSPmvTbXnFQoLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669580, "uuid": "b36e6f0b-e9c1-462b-9659-ab0f03635d0c", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669580, "uuid": "f1143836-1e70-48fa-945b-2e201591a82b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669580, "uuid": "c0b5017e-f671-4c4b-8864-333edf1d30ba", "value": "SecuriteInfo.com.W32.AIDetectNet.01.30279.9062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ffe0f3-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653665034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665034, "uuid": "c88deebb-9f85-493a-93d1-3b08190df4ec", "comment": "Malware payload (AgentTesla)", "value": "56a08fd913bfc20fa0f15a4fb204bac9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665034, "uuid": "81230c4e-1923-491c-bced-be2c54affa04", "comment": "Malware payload (AgentTesla)", "value": "37305d441b0332e9756a972f0585748807fb90ef363116aa6a224cefa120d09e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665034, "uuid": "01698f5f-24a0-46e7-8560-8323f2eab0b3", "comment": "Malware payload (AgentTesla)", "value": "b135f9c44b2847d494f1b2d843444711c8421cc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665034, "uuid": "e5916943-3434-4e34-9f42-e59955d5ccd5", "comment": "Malware payload (AgentTesla)", "value": "20db0ffcc8a39bed326e29f953ae38b92fddc649538a50512222549e034ea61ade221fab03645ac9339873db46c26375", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665034, "uuid": "54191b43-0f3c-43aa-9624-6c79046fda2c", "value": "T130C4129037B96F2BEA7E4EF98176106443B1B6066B50C3CE2DD276EE11E3F018E55A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665034, "uuid": "c0492862-7fcb-4847-a50b-7eececeacb2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665034, "uuid": "7c18d39a-fb00-4639-bea0-4cf8203d5700", "value": "12288:KK2HUdEv8+F2wPLcYfqqDLNoE3TkyuFmcFiGZjC8Ng9n:KK2HrvY8zHNoCTkyuBFM8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665034, "uuid": "07b1baa9-2446-44fc-9518-0dbfef336d97", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665034, "uuid": "72a53706-e4b3-4c71-a493-9fee564ad81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665034, "uuid": "0bfb9d32-65d6-47cf-8ff8-20a3216f8b1b", "value": "DHL DELIVERY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb626873-dda7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647382, "uuid": "0774624a-46b3-4091-9f09-fcb5bb940c5f", "comment": "Malware payload (Mirai)", "value": "42bce836a60519c4e5dd0d436db23845", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647382, "uuid": "0703db74-5653-447e-acf7-645b9752a162", "comment": "Malware payload (Mirai)", "value": "374c0273b3712f6cb1e9396bd56786176d946e1a6968ef9118d56da62b6be301", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647382, "uuid": "4d5f5c4c-59ad-4af9-9b06-74f022e89b75", "comment": "Malware payload (Mirai)", "value": "c8a516406dea4198ccba153f99722dc38d7563c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647382, "uuid": "57d603f1-327f-4f51-a165-5ab884965147", "comment": "Malware payload (Mirai)", "value": "0d6056f78cdb4af3af09774711b7ffa6788391b68b13d298f6a360fa62387c79ea65fc36417a65bb110530f66cd1716a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647382, "uuid": "a96f447d-5363-461d-b535-8b2223c4a3b4", "value": "T150634C4272280F47E5A21DB4253F1BE083FFED5024F4BA88694FDB5A8635E761186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647382, "uuid": "443377ff-340a-4220-b27a-009f4837b02e", "value": "768:3tzXhsT4axOTlLRnE/qPxTS16xeqqPvHr85vJl9TwJbAWIKZhHFRZfB2BMxCq2GH:BigL6kTS16xZWD8bqQKZo3qsZIZyub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647382, "uuid": "dce19c01-bfc6-46e7-8948-d5ade959118d", "value": 66792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647382, "uuid": "e37bfed1-403a-4a36-af8c-92d9d10374aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647382, "uuid": "12b186c6-4b49-4ce5-9373-725772776866", "value": "42bce836a60519c4e5dd0d436db23845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1d0200-ddda-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653669101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669101, "uuid": "052e6d5a-1753-480d-8be3-84ac474d6559", "comment": "Malware payload", "value": "417871a780adb8b537d5d49272da3196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669101, "uuid": "a0ce76f8-8bdc-47e3-8052-ce9010fbed79", "comment": "Malware payload", "value": "3765e92234de653b426472c63f4209801cfce1c231a3c88f5ca9d44d6b317251", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669101, "uuid": "0430f270-6c21-415e-9485-9f37eb1f5483", "comment": "Malware payload", "value": "f223d6782c99b0f4227ab96903466cd30a252771", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669101, "uuid": "28935290-48b9-45eb-afd4-288e72209221", "comment": "Malware payload", "value": "529fe7b57988d10db1466e55b8cb106b03af9fa2967b5e93b7527210e3a31064073c03d2c1851e890b00fdf6460e12b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669101, "uuid": "8a752438-7f8e-4f29-8d03-4878af67cf08", "value": "T16B15BEBCB2527DDFC5278976C9E46C64AB202466930BE243611311ECAE0DBD7EE091F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669101, "uuid": "c558cceb-ec2d-4653-a7f6-6f2db895d9db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669101, "uuid": "ea9d10cf-2a18-4474-acc5-61682e51d6f0", "value": "24576:TVLc/CLxcJJ9umceNTLV+LJ0ry9/4wR08/PSGG:TtcnWmc8y0r98XSGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669101, "uuid": "b68e6a7b-1a9e-4dbb-8f08-c7fe23b1da5d", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669101, "uuid": "c6bbe18a-ee8a-441c-afce-6bd761df36d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669101, "uuid": "1e221f6d-9141-4bc5-8013-d9842756c6dc", "value": "417871a780adb8b537d5d49272da3196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee8ca79-dd86-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653633053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633053, "uuid": "6bda7f9e-6444-42e6-8d17-136c9c621083", "comment": "Malware payload (AgentTesla)", "value": "7872384b818051ce7708b5da1625b4b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633053, "uuid": "5ec8185e-de2d-4439-8abd-3ae4d73acc82", "comment": "Malware payload (AgentTesla)", "value": "386d1d77650707bdbaae831b56662183b946b8c8588ec5860f1bede73b05f9a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633053, "uuid": "85d8700d-30a1-46ca-b82a-49cf40488e0b", "comment": "Malware payload (AgentTesla)", "value": "5a0d5fd5eda898425eab182716fcfefeec7d3045", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633053, "uuid": "15361f0e-5679-46a6-aa3c-1ef50a340e15", "comment": "Malware payload (AgentTesla)", "value": "45c0dbb4f2496a4473af65786597eeb340d8d5470c138b3a6994dadcf59d3c0033822b5710af6b7ff0201a8fc9b2715f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633053, "uuid": "c2398330-17bb-42e8-abdb-b11e6fc9ebe5", "value": "T15903E61DAF5C8F21C6095EFACA87F58502A19DC2750BCB5E24E5321E0AF2BE6CD7D901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633053, "uuid": "179838b4-2f1a-43c0-acd7-520247efa893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633053, "uuid": "e037506c-f878-4b4c-8cdd-5f1e919b0e82", "value": "384:AMPCRE2ZwYdlDbw+CQiC8ehPEJNIoCpYC740jjOS0arKo:ABRZqYdR9Je+xqJ0mS0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653633053, "uuid": "d6825582-d353-4d91-bbfd-f5f6646959b8", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653633053, "uuid": "5fbc2397-c1ac-41a9-8104-6a42175ada37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633053, "uuid": "2ed69f83-45c9-4cb6-90eb-9abd7fffe296", "value": "New Order052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffd6aee-dd5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653614721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614721, "uuid": "ddb65ad0-ca77-4ff5-a6ce-6923fa3a5088", "comment": "Malware payload (RedLineStealer)", "value": "9b04ffcc743a5ebc118e19c95d99633c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614721, "uuid": "d2ba5787-479c-4d12-b935-89a6b1be80da", "comment": "Malware payload (RedLineStealer)", "value": "38fe361584100f7ba0fd1391f4ac535543bb72c5dfd5dda045f35eb657871cd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614721, "uuid": "9eb17272-e857-4d96-b5aa-d5b6c9b2602b", "comment": "Malware payload (RedLineStealer)", "value": "238893a668403d3272ac6dd89c2aef3f1f777502", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614721, "uuid": "56e5a1a0-11ec-44d1-9616-556f95d14c11", "comment": "Malware payload (RedLineStealer)", "value": "6a1db61628946662e914c2dafa5ca2539b6705d21bd1bf158cb43491ad7f7b3c00172bcd38e5c338ba5170795e32ffbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614721, "uuid": "647e8320-cc02-44f8-8760-df8f430e5241", "value": "T1E214AE1035E1C032D5A3657A4471C3B54E7BBC666A35E98F7FC62BB94F293E2872430A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614721, "uuid": "3070e6e1-a45b-4c97-aa2e-9d7b3e94a0f5", "value": "3a69ecd3b6da2380dfb06b559d9785ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614721, "uuid": "4517543a-8bc6-4b36-b93a-7d99849bf821", "value": "3072:gBWSgLcWb8PZJiBFH5R5plkbf6qC4AsTyiVWFy4OQ1/dBTRHNT5OYtLBpJG:ugLPRp5R5pmbJC41mikPtfkYtLBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653614721, "uuid": "625aab99-b580-4bb1-8087-77aec46a359b", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653614721, "uuid": "43d418f4-e1d2-4b0e-8aff-a2385299e4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614721, "uuid": "9ef55236-8bde-4551-907a-3d696219f1d2", "value": "9b04ffcc743a5ebc118e19c95d99633c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64ae262-dd98-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653640957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640957, "uuid": "6294fae5-d62e-4e5d-8f5d-f528eabb8f3b", "comment": "Malware payload (AgentTesla)", "value": "3269ff9d4450fb6e5dd14c1b10936755", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640957, "uuid": "dccf6bde-8fd2-43ba-b795-2ec72eb5fc66", "comment": "Malware payload (AgentTesla)", "value": "3a3e2b1a1d34846b4f2f96604db1b9722cad2d3538ff9a23b909660b4ddc7d33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640957, "uuid": "87624d5d-2cc9-4783-ae7c-8542c2ca606f", "comment": "Malware payload (AgentTesla)", "value": "21cba69bfdb77db1653553edfbe989689aae9192", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640957, "uuid": "05654d8c-dfa2-4edb-9999-32e1cecbd6a2", "comment": "Malware payload (AgentTesla)", "value": "faa1cb9b9001efb71150249873783ec40ea361541807f05e90d06e37fe01fece92f661742f49e1c30fae7340250ede04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640957, "uuid": "356d8016-3127-44f9-9922-3a6fd9409fc8", "value": "T178732B52BB048A55EA2B0B3D846ADF5005369FBA6932D40940B47D337B33BC74DA9CDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640957, "uuid": "b3241578-891e-4b5e-bf05-7d1bdec68e43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640957, "uuid": "d27805df-df38-4741-a362-4ad2f0cd645f", "value": "768:m/BervOPxKV9M+AXdt6CLC0Xi/1uFIZMYIIIIIIXllllllWvfIIQIWR1gRkg8Zg6:m/oeK7kdt6CLC0XCzHgeGUvDg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640957, "uuid": "0a7f1a22-1758-4442-858c-1520ed51b3de", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640957, "uuid": "4b0a83fa-bfd5-4783-9810-dd811f8f41c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640957, "uuid": "cf000472-1a7b-4103-af1c-ed7dc571b828", "value": "SecuriteInfo.com.W32.AIDetectNet.01.25878.32365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b400bbe-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653664212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664212, "uuid": "20d70811-d561-4283-a465-44c02e26b8e0", "comment": "Malware payload (Heodo)", "value": "309b54b5adddb8576be56726a2179829", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664212, "uuid": "91c0a095-53f0-4e23-a874-cc4c8adaa7cb", "comment": "Malware payload (Heodo)", "value": "3ab9bee2dd8525c171330503ae1baa58b3ad8b1cca95f64d2f6464bbd77815ad", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664212, "uuid": "aa1cccbb-d085-4bb5-9296-e56b098d2ac0", "comment": "Malware payload (Heodo)", "value": "4585635ee49befc36ecf01bd883f3fd30ba6bf94", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664212, "uuid": "1fc7c8e1-6f88-4149-a4ef-a8ba295e8525", "comment": "Malware payload (Heodo)", "value": "fad54466c7cfdc01422ccee1a0c09aa86d90780e31859ab78960db4b6ce71cf00e732219e3d72550eb07f4fe0bc18bef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664212, "uuid": "bf5d0c76-ca55-44a7-9e3a-8c147c307275", "value": "T13594CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664212, "uuid": "2ac5dc55-e2e2-4631-926e-1b1c3ac5c611", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664212, "uuid": "f7a2a971-9eaf-4329-8fe2-e1c7ea4cecf2", "value": "6144:I9wEpo6/4WaPgMIuxqqKAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqKAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664212, "uuid": "ddeb52bc-bc78-407f-a197-fb48ea1ff88a", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664212, "uuid": "aa4b5cd2-4060-4581-be91-ea830d815d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664212, "uuid": "8c46a806-57dc-4882-9486-774de2c1a0be", "value": "309b54b5adddb8576be56726a2179829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288941c9-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662516, "uuid": "47c62646-4ffc-4b0b-a93e-e755ffcaafdf", "comment": "Malware payload (SnakeKeylogger)", "value": "08d43afc1cf7636d93c242aa4840e9f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662516, "uuid": "3619ea62-8584-411e-8ba2-23baa71d26a6", "comment": "Malware payload (SnakeKeylogger)", "value": "3b3558c6b3cbed2cb65aff443f32326bf25aa51c6905f6e60852dfdf999ccdac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662516, "uuid": "c98c76f0-c035-4f70-a465-44bd15fabc84", "comment": "Malware payload (SnakeKeylogger)", "value": "faf8301669c393bfd7982c412d4792aa1bafa615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662516, "uuid": "d4d81dfe-16b8-4b8a-b6a5-75e1856749b1", "comment": "Malware payload (SnakeKeylogger)", "value": "1642e361b972460f0cd2adf4ce6d5fe82972ebe519d2b823db8d2c670a4494a658bab58ba29661a3dccf161c83107a49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662516, "uuid": "d50c14fe-167c-468a-862a-47f5c38bfd65", "value": "T132D4F100B2F81F22E6B5A7FE6574618007B2BDA92531E34E1DC178DB3671F518A89F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662516, "uuid": "5e3a93cc-214a-4763-845c-d4e38f04a66f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662516, "uuid": "cb5e41e3-b3f9-4bb2-8636-dca370fbf18f", "value": "12288:3y1yU2J9bHoAUVvqVi7I2p9V+ZNG215DcpNo7PW4e6phlLRsQ:i1y1HbHoRH9VcHjD+i95aQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662516, "uuid": "b74135df-3688-4746-8b6f-fb7b6a449cd7", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662516, "uuid": "91644611-5d22-4e83-9265-a3f370e71f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662516, "uuid": "c3c7ec76-6d29-44ae-88dd-7a8d211e2818", "value": "Payment Copy.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948a5868-ddee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653677730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653677730, "uuid": "7a81fa7f-5c94-44d3-81d3-4a871eb27941", "comment": "Malware payload", "value": "ccd20d6410991fdb3ec21129313266f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653677730, "uuid": "23d1e578-e14b-4c02-b1ed-62074ff67fed", "comment": "Malware payload", "value": "3b46f4f5fd9390616b9b5ebda6fac32ca446e2eb93960d3f3f70659bd33d2f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653677730, "uuid": "e8466aed-45b2-40cc-8f91-c102967d4793", "comment": "Malware payload", "value": "145710606b01bed46c57973f7b12c66846b37e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653677730, "uuid": "0c92e7da-4c9d-4b6a-acf1-47a668e9870e", "comment": "Malware payload", "value": "0e0d7c3b9ddd5dffa55509007d83a7588df7164210c83d2dda82831c6e028d35afca0c11387be3dc6747afea415f15ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653677730, "uuid": "9c115e72-1150-4a66-bac7-8edcd00cab0b", "value": "T1D205E02872A35E13C45847FAC0D7E51003B15453E836E6D72FC7EADA1A4ABE28EC9747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653677730, "uuid": "dd21c6ed-4bf8-4aa9-bfc0-d27530df641c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653677730, "uuid": "b9e629b1-64a8-459f-a272-2c535c6e2bf1", "value": "12288:x9fpKRfBV1zxvivFyf0dR0atBMhVFAYjH1YEI2yUHzHBU510TELj2BOjAm:x9xKfVBxUyJEYVFxW2yd51YG++3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653677730, "uuid": "0030babd-fd4b-48ac-99ce-9a213b18ce67", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653677730, "uuid": "8409faf4-8153-4c0b-a866-fc6816b17613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653677730, "uuid": "62f792aa-b03f-446b-bd45-9420c303ab41", "value": "BL293425176_OOLU2034251761.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9a2f69-de0d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653690820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690820, "uuid": "f3738844-a6be-4dff-a630-1026673df082", "comment": "Malware payload", "value": "2cbd09c42111e2a2eebfff928375d460", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690820, "uuid": "c75acb1e-6f94-4820-bfec-9e6121ede900", "comment": "Malware payload", "value": "3b55ac015b225a6f2eed4e9470026960043a59f13ff175b3a23ed6699f2a63ca", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690820, "uuid": "6b5151f6-cd1d-4cee-a16f-35875109ecae", "comment": "Malware payload", "value": "8c5c3435a70578dcd4bda3cb15ec669f516091de", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690820, "uuid": "5c46bf06-b0d5-4d04-a26a-25c9dfd698fc", "comment": "Malware payload", "value": "ebd9c41262eee799271d8041df001cd0f212376e303d5f7cde75e039c5c47e5756d1d6bdfdb1512180235dc09da53af3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690820, "uuid": "b1e6d74c-648e-42ca-92bc-693855d8deb8", "value": "T130634B59B76A885EE9198B3048F747D62323FD308F6F0A433259F3926FB9590670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690820, "uuid": "a10657ab-61c1-4907-af1e-4e3ec28b8de9", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+4+hDcnTLiQrRTZws8E1:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653690820, "uuid": "a9370f47-8121-41da-b49d-1cbb779134a9", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653690820, "uuid": "517266b8-d526-4318-85dd-06fb35cbbb66", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690820, "uuid": "12a4909d-a067-4e62-9881-b76351933401", "value": "SecuriteInfo.com.Exploit.Siggen3.32798.16704.11255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a78e89c-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664318, "uuid": "6c601753-e51e-435c-ba96-f7ebe4320dde", "comment": "Malware payload", "value": "5d61da71430e6af35356f9575b54d817", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664318, "uuid": "ee0411cd-c45e-4a84-aab2-6d1f34f8d6d3", "comment": "Malware payload", "value": "3b986f6959a2388240d85900e1cb5a8f79c9b53dff87cd50851c2a55baf2a5e2", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664318, "uuid": "7e3630d8-b240-4cd3-8beb-1f9c62912fc4", "comment": "Malware payload", "value": "5061b4fa72f3ca9b3e1031cc102d67add5a3329a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664318, "uuid": "3f9a97ed-459a-49de-91bd-68ae92cf71ee", "comment": "Malware payload", "value": "db986213906e0736944212b984be422332c42976dded58556708d0e3c9b1cb6a01c5c57fb6402cf4989c44ed4ae4088c", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664318, "uuid": "b3ee9978-94df-4cc8-b95f-9c8d4fb6ed3c", "value": "T15824126C6A50655AC4618B7D8B704891FDFC8C7779BB9A36048B73BBD23CD02D0C9A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664318, "uuid": "63f79ca0-a01e-43c3-bddb-1cd1c3838343", "value": "6144:qEh0qajAGffTHgB/SoAJ4tVHnwUBaa9wfEFrYJXFvW:qEeqaUGffTAB/Q4tVQUUa9zFkVFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664318, "uuid": "8ddd6f6a-17df-4b79-8517-c99d8b9a65d1", "value": 211624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664318, "uuid": "c6ce8c67-13de-4ba9-ab72-2c93e5e3770d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664318, "uuid": "8dcc2799-819c-4e0b-bf4f-f321a114d205", "value": "Inquiry Sheet dtd MAY2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b425bfe2-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653676495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676495, "uuid": "b60073bc-0906-4e04-a9a6-aa3a907114f2", "comment": "Malware payload (RedLineStealer)", "value": "e43709e054a554f898cea8e0d14159dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676495, "uuid": "f2116607-fcea-4d9f-ad61-7f46a3024905", "comment": "Malware payload (RedLineStealer)", "value": "3c026c0c6e69de9a2c46769fdde898ba08892905cde6fe7b83aa15892e65b643", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676495, "uuid": "0c177b58-56a8-4935-bd12-e9e944e9b457", "comment": "Malware payload (RedLineStealer)", "value": "0f7ddbbc9fd7721f625b54518c1e00125f2f5715", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676495, "uuid": "dfc1db8e-4e72-40ea-8feb-1050a5cb0a74", "comment": "Malware payload (RedLineStealer)", "value": "318b040fa80cc1f208bb67101af76bd46ae9ad385bd5ba3acf25f43cb1ea06bc66a83728380c56a022987d02c85099ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676495, "uuid": "a80d7a6b-71a2-4d6c-8d3b-3da8ba143e82", "value": "T19784E012F7A0D830D0562E708465CBB16B3BB9726634950BF74C7B3E2DB3380A6B575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676495, "uuid": "a5dc6cca-9b4a-4047-9fe7-db5d47955ea7", "value": "936051dc8adff508935df6441a5fb70e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676495, "uuid": "58464e42-1b70-4196-9758-797c0824f216", "value": "6144:/fXKCZPU58VPdgNG7wdyC0naRBwT0igavwVf:nXK70mNG7wdmaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676495, "uuid": "13f2882a-9fe4-40c4-a968-6d2c8c050f2a", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676495, "uuid": "f4041c13-d650-482d-918b-86476bec8471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676495, "uuid": "a76332e6-8224-4fa7-8dbc-4e21f614d342", "value": "e43709e054a554f898cea8e0d14159dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dd2e1c-ddea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653675937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675937, "uuid": "cf8fcc81-b83a-45e8-9d8c-bff5c8d782bc", "comment": "Malware payload (Mirai)", "value": "445ea153f39e7868760107609a343b28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675937, "uuid": "eb9db1f7-9296-4b42-bf2b-9aa248e1dfc5", "comment": "Malware payload (Mirai)", "value": "3c9c1a3e7f02d9a27f946c3edc5c45554e8884262833b6c648a98880070ac017", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675937, "uuid": "0169be29-a7eb-4cc1-8d3b-a6450b748c86", "comment": "Malware payload (Mirai)", "value": "1ab794165df55bdd9a4a6d1e7023b550fa29e277", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675937, "uuid": "df6d4f13-43b9-4bbf-a6d8-be2bdc02efa9", "comment": "Malware payload (Mirai)", "value": "811df62ae771bd12673c0a640683ee014608d968deff1dbc23c296fa5db51684b736b2666232451edbd3853b9c263568", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675937, "uuid": "6c0b8311-5188-4f3f-9307-e87d9266eba9", "value": "T1CC933B97F800EDBEF809D7774453490AB230B7A04E921A727257396BEC7A1E4193BF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675937, "uuid": "d56fd0b9-63fc-4ea3-9f47-1677f921c34d", "value": "1536:Mj+9mKLMisFvCuyMydl91jkjgAnsuouXqz88hZZro6SBvAhGDZ9agQk:fL4iaCfMydl91jCsupXqztZro6mN9hQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653675937, "uuid": "2343cf3e-80c1-434a-b2d0-c1a52714cf44", "value": 93480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653675937, "uuid": "666a0ba5-932a-4a30-a928-4cdc91bb1b94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675937, "uuid": "165a6d91-f248-4c24-872c-04572977da77", "value": "445ea153f39e7868760107609a343b28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ba7df8-dda7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647394, "uuid": "e5193bdc-0ca1-45df-a8a8-b8d5acbd2253", "comment": "Malware payload (Mirai)", "value": "60c16bbdea70d058618c85e3e7d5a7c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647394, "uuid": "f3734088-ec8f-4cd2-954e-013b5c31c3d6", "comment": "Malware payload (Mirai)", "value": "3d8b14056393a46c2f3b2c2db245f3d3bef205eae544ab7a01cb47d56cbb8e8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647394, "uuid": "d468079a-10cc-4afb-a08d-bcda57dc7a3c", "comment": "Malware payload (Mirai)", "value": "333cc469a02c21fdde6206127bc0656919f7d05c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647394, "uuid": "f5a8ef31-8bd8-42e0-9bd1-4f3a77fcf134", "comment": "Malware payload (Mirai)", "value": "25219faa7f98a4f34e2638dd4024a4b25b181c1828eea5b52a79279e0c615c59444947983fc29854ac13857dea075d39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647394, "uuid": "1c7a8ae4-ecf6-43f9-b5d4-ad39fe513678", "value": "T1AF5339C0A993DCF2DD1146B93177FF328636F436212AE9E7D7D9A923AC81E40910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647394, "uuid": "e836a8fc-414d-4afd-a7dd-b1b6eb0cea5a", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5BSSs84IlZ6fUoBiA+pTLEx:VMzVhePlkmetvBcxJhyu5BNAIlg9oAuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647394, "uuid": "bd531496-53fd-4a7e-bfd4-9bff230cdf6d", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647394, "uuid": "6061ccce-8e65-40ff-8c82-24a3b8206ad2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647394, "uuid": "4ef7bd51-d71f-4830-b7d5-c18640f6bfe6", "value": "60c16bbdea70d058618c85e3e7d5a7c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea3dade-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664808, "uuid": "a4b8e3a1-6611-461b-adb5-ecd388204a21", "comment": "Malware payload", "value": "e6c7a808df5fe8e94dac589357cfbaa5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664808, "uuid": "584cc3c8-02e7-4177-bbf2-6800a0d23572", "comment": "Malware payload", "value": "3dba451a4e1f2c476d7910a5c64ff87c1c21ac7fbdde7eaebe73ec8fbd525638", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664808, "uuid": "f55c2968-925b-4723-8b7b-479ffbe8ae9e", "comment": "Malware payload", "value": "2ac71a0e5a9bc8ebb27f75c3bba0eb55da2773d0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664808, "uuid": "3302fd1d-1dd0-4dfa-99a4-729c5cd5afdf", "comment": "Malware payload", "value": "1255a6d3ca0a3479f6012240f871a256de232737d09f63d6404401ad8e292b9287a207d441cf10546c60a1eaf92c875c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664808, "uuid": "c138cd4f-5531-4341-92a4-c604360962ef", "value": "T1A5A3B499791E86E0652E45B6717AF288F2A1C2C12EC75CFD302BE51783F382B6DCD548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664808, "uuid": "d0e4c05e-8e14-49f2-af82-09b1d250049e", "value": "1536:1DtSyl4n0CZ0vgTF0F1tJwnsuqRoj0cox844D1JlxmfsxGDz1YyJy4Y1SBOwA:Rl4b0vgTFQenmuE74D1JCI8my4tSBOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664808, "uuid": "abfbd577-d816-480d-bff7-731748314881", "value": 102332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664808, "uuid": "6919cf48-8923-40c5-b366-40bdecd34349", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664808, "uuid": "0eab9728-a316-4fa4-8676-b928ebd439cb", "value": "Aflang.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70cd0a6-ddf1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653679184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653679184, "uuid": "4d1b365d-537b-4980-ae81-10c0d6ebb948", "comment": "Malware payload (AgentTesla)", "value": "f3258c047be69799b5c01229cf7bf451", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653679184, "uuid": "d12ed1dd-b9e5-4c6a-9ec2-fb6eaec18c89", "comment": "Malware payload (AgentTesla)", "value": "3e63a6ac7005b4a485be33309d09c80395408c3310da4db8dc1a8e12535644e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653679184, "uuid": "1d978059-b4c4-4347-b93f-7db1850f0a9e", "comment": "Malware payload (AgentTesla)", "value": "d59072ce0da620df4148267b0e4debfd470fc805", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653679184, "uuid": "55d3b4d5-4b5f-4bcc-a565-6303cb5e2c46", "comment": "Malware payload (AgentTesla)", "value": "b86a2657e8c61a10a3a8468e0eacf1306f10a459be67d1d3c741baff7b753923e5adadda68a28d3fb9c189c87d977507", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653679184, "uuid": "c33cd280-c6f8-45e5-aebc-de84b1342bfd", "value": "T1EEF4E01A72979E13C0A813F981C2D42493F61517E431E3CB2FCA65D62B457EACDCAB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653679184, "uuid": "9fcabe97-65e9-4ecb-9667-da3a36f30d75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653679184, "uuid": "f00e3b3b-6933-4cad-b2ff-63cd392a5bf7", "value": "24576:ycEEnNAgs/WnsIqCV/bhgW892PjSbCjUQ:HRS0sIqyV/S2PhUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653679184, "uuid": "e5a279cd-7c1e-493a-a6bf-4b96b7c4756b", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653679184, "uuid": "ab6414e2-187e-45f8-a5a6-5cb1f24208e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653679184, "uuid": "f7b74a06-7b44-4f4f-a57d-58466e58e792", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4436ad70-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653676307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676307, "uuid": "91ffe751-8ab0-4f4d-9217-d664d011bab6", "comment": "Malware payload", "value": "f26ba069226116295db28a8cbc03c65f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676307, "uuid": "600fc2fb-5ce1-44f0-80e7-f97d795c146a", "comment": "Malware payload", "value": "3e7e7e81f643f8eba3954aad438c2841dfed974b817d8dba06db6a3ce3965e18", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676307, "uuid": "93b39a0c-2775-47b6-aa39-76823d09203e", "comment": "Malware payload", "value": "6f661b7c5548b94429c75f4b1c10aa01b42e3bfd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676307, "uuid": "6594f439-c06d-4646-9fb4-0a5957b249d4", "comment": "Malware payload", "value": "26b2ec19e3295bfe865c6bd02a57707372391dd7f169b7c2827988d894e244e78ad7e5eb80dc13d1cdf8b31abf6dd019", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676307, "uuid": "d629b153-4bfd-4c5a-9f19-71bceb42b6a1", "value": "T1B4159606B1BEC12BD5882E354DE6E2EA36B47C47AF9D61933055736F3DBEA40C80A741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676307, "uuid": "9c69ee74-1fe9-4f46-b0b9-9fdb664f27d3", "value": "12288:blp9FbEAwTGvnamfc/EPR8Ztrpt+63+RH6dO:xN4A/6dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676307, "uuid": "d557faaf-42d3-4a6f-ae99-7133c268c3c8", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676307, "uuid": "3e8a101c-4094-45dc-b38a-af9ee87044e5", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676307, "uuid": "8f14c2a4-4ef3-43ac-a602-95a2446910c6", "value": "SecuriteInfo.com.VBA.Logan.2477.23864.6716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55eb0414-dd90-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653637252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637252, "uuid": "a1ec778a-332b-44c7-8398-30e62acb5e45", "comment": "Malware payload", "value": "c425c007ed7b3ee305dbea78ec07d10e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637252, "uuid": "5383a1ea-8062-44cd-bb9b-fdd593bfe5f8", "comment": "Malware payload", "value": "3e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637252, "uuid": "9113ebfc-9dda-483a-bbea-24db8bfbd605", "comment": "Malware payload", "value": "c254da6e0a53106504bc6f8db88e3ba0678498b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637252, "uuid": "08a5fda8-1935-43a2-97d5-8ccf49c15603", "comment": "Malware payload", "value": "fff96812ceb85a97f95495d742af8ed1b7720f053d2f83f81769e55a6aaf42c8d9df1d1d2360e9f48bd27c15133b341c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637252, "uuid": "af0b51c1-0a46-41ee-b361-de8df3a4c390", "value": "T1A5D3AE4031D281BFD8656AB158688A8196AFFE322D398F8B734C157E8C745E0477BF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637252, "uuid": "0921ee11-208f-4732-8c5f-622b69fbb0b2", "value": "bbb2f32f8d365f3ad9879bc589ae5fb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637252, "uuid": "2dbd506a-3e4a-43cc-b1ef-719e2c81b596", "value": "1536:cfTOG+x8+YaGDARvmJVBqNvnlajcCOO0LdXU8JiA1OySulhQRqSnakMP1BOBYCHF:bfbnR6BqNvncvhw4uGqSng1kGCUH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637252, "uuid": "ade0c4af-8886-4302-8e30-38f077c2cea3", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637252, "uuid": "49470af0-ae3d-425d-90bc-0b720abd82c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637252, "uuid": "717efa4e-1e71-48bf-b22e-5f0be29f43f0", "value": "SecuriteInfo.com.Variant.Jaik.73412.3054.12956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9e0bba-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664641, "uuid": "8bff3954-f72c-49f7-bdc6-e5ce1bd5b190", "comment": "Malware payload", "value": "bbc8e18c54b15fffbe89832c40cac778", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664641, "uuid": "616c6a54-4355-4082-b181-7c1c1a839581", "comment": "Malware payload", "value": "3f7221a464943eb60d1ad7d37a5babd2dad94e8870d27b841d90c400c01a6f4f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664641, "uuid": "b230c453-c9ca-4799-8742-5014c2fe07b1", "comment": "Malware payload", "value": "04ccf7883d854968821cee3a87d36c444cdbfb94", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664641, "uuid": "10d7cb4f-fbdf-46a1-8309-a34cf3a575ed", "comment": "Malware payload", "value": "84b97cce757ec5d41a521a72f7a9086f1d54f5a47263970fc531b47ef792b0be5de6c6d4c2192acd4c8b87c45667bbf2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664641, "uuid": "8f58bd50-7da7-458a-9b8e-f5d66d5849e5", "value": "T14C64C0318B849FA996980C0BD07D5E5E95F3176AD423F2CCABA3380B3A7FD0D1716985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664641, "uuid": "87dc6004-8e52-48bc-bc1e-b6459b9aa665", "value": "6144:GTJYq4Y+06FflYKgK1ogYpus15q56Q7TXt6FEYyXh+TM4HKsK6U6xK:GTJYv06plYFK1pl68XNYyRLCxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664641, "uuid": "797c446c-b0d3-430b-bede-78a5d9bc9b81", "value": 334530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664641, "uuid": "b5d91907-c9f7-4ec5-a136-046dc758b4f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664641, "uuid": "cf58308a-a8a4-4356-91fe-6272133ac6e2", "value": "DHL Food Draft Att2205251806.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bdb6d6-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653665007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665007, "uuid": "faa66078-1eea-4a2e-9322-9be40a48e63c", "comment": "Malware payload (Loki)", "value": "fd5be840876d9a8ecee05d990159d74b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665007, "uuid": "e1f5d795-c4ce-4f3e-9303-cb829102bd7b", "comment": "Malware payload (Loki)", "value": "40e8ffa96c3264f7e6d81804bb89f1a8e6cdf7122f8f2dbc6b2edf7e9e721ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665007, "uuid": "58da734f-0067-4ab5-bf41-6a57083aaa72", "comment": "Malware payload (Loki)", "value": "23193de6ae6b49dba17c8c0438ffa38d6bf1175f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665007, "uuid": "17de504d-0d2f-4e04-89b0-71efd4f49be2", "comment": "Malware payload (Loki)", "value": "1b8f72c29e0028f5577c069f6602862f18ad9da6ffcbf49f059b0695c83a7e6bdc769c22db12539363a07bf22954b98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665007, "uuid": "5b191d4b-45f2-4dc4-9b4d-d80be4c040cc", "value": "T15294AE31376C2903C6FADA7551E0804016F1868E3E63E51F3EA369EF25E1B819B71A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665007, "uuid": "d341a5e6-ae93-4c99-8d29-f6645694ef9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665007, "uuid": "37fbbb2b-7e08-4645-a0a7-f0eb9b390d17", "value": "6144:ViP6U7dKto2WKbC4L0+G/XkU1v14SrIa2NNVMEXUe6vNmML0UcfA7QElo:VkiJp0fU+v1uNNHz6r0UcY8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665007, "uuid": "564807aa-28ff-45c3-8e62-60981653302b", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665007, "uuid": "116e1e65-442b-4b6b-aa9c-f4742a4bc2b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665007, "uuid": "df28f98e-a487-4d94-a823-b92b96255ad1", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558072e0-ddd9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653668605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668605, "uuid": "29aed073-9f23-49dd-9a98-e4ad33a505ce", "comment": "Malware payload (AveMariaRAT)", "value": "3eb4e7e0a0e0b0c0f75e20d0a69dd361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668605, "uuid": "2c9ef283-4b21-472b-8219-4644a8d49c21", "comment": "Malware payload (AveMariaRAT)", "value": "416735c53ed03f379cbf6318593e410d41c0d61f5eb25525f14c3e10e047c255", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668605, "uuid": "a637825b-0475-42a7-b440-8a99e9aad519", "comment": "Malware payload (AveMariaRAT)", "value": "b904601a7da67f777d804e5d819fe86fa10d9dcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668605, "uuid": "9e8ead55-f8d6-42d2-ba63-8ef2c4046fd2", "comment": "Malware payload (AveMariaRAT)", "value": "c184646991bc6e8546a518a1b2744fd10cc5487f810f8a6808e9e9e241edc6923d8fc46969d3e5948d85994ac699745c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668605, "uuid": "1b00826d-0c55-47e5-9631-3f3921dd3b1f", "value": "T105547C10BA90C035F1B7F2F44A7583E8B52E7EA15B2450CB62D53AEE56396E0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668605, "uuid": "54cf5240-a1df-4627-92a9-61c75bfa97cc", "value": "c16dd46cbc11e53607645ca176b26b3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668605, "uuid": "79b80dd2-1dd4-49f6-86b9-0f7fd9b35f9b", "value": "6144:bv+LkdpctI8c1KXSZNBW9+96kOzvV76QsoXUP4LZyF0bjSbN:bWMctXM/ZO9+9Qzd76QgAZy2SbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653668605, "uuid": "0132f6a8-870f-4313-bd73-319ce1ca30c8", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653668605, "uuid": "1f4e1311-eb49-44f0-b87e-b998dd1c7bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668605, "uuid": "7c0169e3-0db5-401a-8fb1-be3fdbab2440", "value": "3eb4e7e0a0e0b0c0f75e20d0a69dd361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da288cd-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1653662471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662471, "uuid": "64470705-bc4c-4c7e-bca2-583bc6e2c4bf", "comment": "Malware payload (njrat)", "value": "a826a9dda069efa6dda5ef9d0e5984fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662471, "uuid": "f1861a01-e30e-4cbe-840d-09a4fced4469", "comment": "Malware payload (njrat)", "value": "4429abcc87b519e564fb443eac261da3f2976056c87a61a55c177c46c72cd474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662471, "uuid": "7bd0d7cb-2dd0-461b-b45a-9ee3800e1651", "comment": "Malware payload (njrat)", "value": "a6148d612ea1dae4edbc307f8a605ceb89ed6672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662471, "uuid": "36eac9f7-4429-4683-a7e0-ee36add77a34", "comment": "Malware payload (njrat)", "value": "be7e2b48be0fdfda3257b96dc433fab82be7861af29460b07bf932fff9ba811b160f996134412842cbfd99b06c63fb6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662471, "uuid": "39d53f17-577f-4a5d-b1eb-2f88035a6ac0", "value": "T13DA5390DF6F26E21CB2D02BBD723857841E3F5082601C596AFE839982F567EDD9CB944", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662471, "uuid": "bb32bc8e-f23d-4ab3-918f-2bcc6931c8c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662471, "uuid": "6c417309-4f8c-4354-87d1-b69cca1873cb", "value": "24576:0ZyCA8CBmn+RrNj9ay5IerO8P8zMw/R2UUO4UzD/5DwR/J6whCu:0iwYpIIOn//R23OVzD/5Upmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662471, "uuid": "1fa2635d-6001-4825-9f42-51b47973cc6b", "value": 2122240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662471, "uuid": "0f6186d3-06df-4a20-878a-3f5818566db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662471, "uuid": "a7faa0ab-b9ac-45fa-a7ed-825cd9fc1860", "value": "a826a9dda069efa6dda5ef9d0e5984fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622d82ac-dda5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653646292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646292, "uuid": "43b7dd83-9e68-4afa-9998-770ccf7fb992", "comment": "Malware payload (AgentTesla)", "value": "db0a91102a4a37be342ab37951140232", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646292, "uuid": "4b818f3a-5af7-4664-9a13-ecc4997fc37c", "comment": "Malware payload (AgentTesla)", "value": "4439e2cd0a33b59b3db56b59d2c6e553e838c87b4c3b5b24b9d12e11d39f3fad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646292, "uuid": "ff9185fe-7968-4529-b9a2-fbe3a677b5c1", "comment": "Malware payload (AgentTesla)", "value": "91b5d77f25951114dcef19af32b605dea854e983", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646292, "uuid": "e4d951ad-2ce6-4570-ad31-0350696f1f6c", "comment": "Malware payload (AgentTesla)", "value": "1c43846cee7cc189d5b27d2bdaef4d719141339325af8a28beab2a2ddc63a35d193b586ba9edc3d8edb0ad9000a2e94f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646292, "uuid": "6c0f1a96-2070-46a0-9c19-cffcc42cdaae", "value": "T1E674233DF413060D0766E6A89247628667B7A49A3106CD87770288D7ECDC2FFA7443BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646292, "uuid": "4a4ff020-49fe-46a9-98b0-32d51e8252c7", "value": "6144:wKgzYGgZdiiA3WkHWZZMfAhBlQaNqSX3RtUrJYuoPggmDvTXPIzka0v0:1Gkd8WEUZMfggaN53RtCJYuRgmDrIIL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653646292, "uuid": "e632610b-a5f6-4332-bd8d-3a27686b58f6", "value": 357976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653646292, "uuid": "6d29fbd3-24a1-4979-b429-bee06f17831e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646292, "uuid": "2e6ef3c0-1256-4ebc-a5e7-81ee554777ce", "value": "OR098765458900009876540.ZI.ZI.ZIP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30f5cda-dda0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653644388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644388, "uuid": "b849298e-407b-4b00-9535-491b5bc82a8b", "comment": "Malware payload (AgentTesla)", "value": "e40b08b06e0204aec8f0311cd1e6463d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644388, "uuid": "a89afcf0-f530-4432-9ab6-8131e2af6322", "comment": "Malware payload (AgentTesla)", "value": "44859c4a45a632aaf3fe63c663e747b4a5e2d4e32f23b75393b66abf19cf1af3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644388, "uuid": "079ac9ae-7c75-42f3-9ecf-7650dc1ecd0d", "comment": "Malware payload (AgentTesla)", "value": "3212a290efc17ffd4090c29925d0b0ac10d10e5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644388, "uuid": "aa1e0a3f-05e3-4b5d-98c8-04d2db7d807f", "comment": "Malware payload (AgentTesla)", "value": "4d738563324d4e3dfc23ec5343eaed4ef2ac919f03bfc39a2a300bcaa749bfb806eaa24aa79c8f63c675ee6c3b3e22a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644388, "uuid": "80c3ade7-1863-4d94-a3b8-fd161cda9083", "value": "T1CAD4010CEB22AEE5F12D43BF7075682A3F65DB22A5AE956C64A531635D30383054BCCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644388, "uuid": "0dd14888-0f91-4268-a708-0e0bfee4dc38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644388, "uuid": "275d9bf8-960c-4534-b0ba-3d5ac460ddc4", "value": "12288:1mbHo6UEYfycdnjFyVVK2ki3YvtCBR1wr+asllq87V:1mbHoS7cRjFqVei3YFCBzw+aseU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644388, "uuid": "6a49ce15-4940-4cd6-bf41-d04f06c115b1", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644388, "uuid": "62db0285-fe7a-4bc4-b3e0-a34bb90aecd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644388, "uuid": "fe36153d-9a2e-46bc-adb4-1c9e432ede4e", "value": "document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de942ff-ddd8-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653668189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668189, "uuid": "1b1c6601-ed37-427e-8b18-6cf91ac97c8e", "comment": "Malware payload (RedLineStealer)", "value": "938ebf3229d0f13cbf0ce45bd5c72710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668189, "uuid": "194210e4-da8f-47d5-aab0-90cfdc19c161", "comment": "Malware payload (RedLineStealer)", "value": "449cccb685cb50c00c305e5fc1c9a00b3a02646d8bdbdf0d3566b1f18afe07af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668189, "uuid": "bd54c502-e851-4e3d-ac56-af6e8032b073", "comment": "Malware payload (RedLineStealer)", "value": "e560ded3fa683a1a130d8726526fd9414f3a2290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668189, "uuid": "4b53e598-8451-4ac2-9378-c8a5c3882f7d", "comment": "Malware payload (RedLineStealer)", "value": "5619ccda756fb861d0a0a8d56a9a6ca5830ccb07ba3625221a8268548ee0231b81c0f67df06495c500254cd5d4efdbcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668189, "uuid": "8050def3-1992-4229-b13d-880ae719d76b", "value": "T1D7F4AD00A6F9EF21EA7557FB867471900F7E7E945160F68D2C85B8DA3EB0F018A40B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668189, "uuid": "ee8427b1-bd29-497b-aea0-55ccd79ffb20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668189, "uuid": "3148b639-e914-452c-b750-b22b37fda711", "value": "12288:N+mXS2J9bHoAUTvqVzZwbtbW1fUPBIFxa+7MkPWpa1YTVyvAq4foDk:djHbHo1biF8+I2QVXnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653668189, "uuid": "1153b8b9-e370-4ce2-aa3d-0917373d7831", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653668189, "uuid": "a8f66ad6-670d-44a9-b554-d2dc9fbae089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668189, "uuid": "a501991a-709f-4b9d-b048-88637751060e", "value": "from-imgMACHINE.EXE1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c548bb3-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1653676320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676320, "uuid": "d5d7f421-7834-4c13-8a61-f943f4fbf002", "comment": "Malware payload (NanoCore)", "value": "2f2c5bf460d7e6a98b28fda25fc97181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676320, "uuid": "4aa46606-fe6b-4f77-91b1-cfc2038e6687", "comment": "Malware payload (NanoCore)", "value": "4525f8366e8c5c026a44cabbafd66c0dada4289009881a8a409080f1040ae99c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676320, "uuid": "20453733-febf-42c3-a8e4-223caa331bca", "comment": "Malware payload (NanoCore)", "value": "f9d6450e171aad87dd46e2900bdca49915df9cc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676320, "uuid": "c46f159f-0211-4ab0-90b3-234f7430c8bc", "comment": "Malware payload (NanoCore)", "value": "24605d4e88d0bb5620b00091e3d706add5dbd2a0a8bc09e2fe5dc5e1ce4b2961572b1a0edbff820bac0c0bee1cf5207c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676320, "uuid": "763c04a9-0367-4468-a2f6-afaf3e5acd9f", "value": "T1BF03D4077E2B8975EA848B7BC5B792400370E75AB23BCB1D7851735AEE827C7CE21581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676320, "uuid": "4878dc41-8941-44c8-a60b-30670eeff439", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676320, "uuid": "491e87c9-d251-434a-9ec5-e0211c059f53", "value": "384:pzpAx8Annu0jR7l6HR10nIVIAb6qhMNLzZcfVTRZ5H1SsIcu4LPXptj0KFok3WnE:dpK8enuikR10LlyTjScuytYKee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676320, "uuid": "82f713ea-7501-4362-9ea2-407c7cd0e6d9", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676320, "uuid": "cb077a7f-8ebf-486f-81ba-da39e7b3ef1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676320, "uuid": "0167552d-e48b-48a8-ab1e-7a81a7ef8081", "value": "Payment receipt 27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963b7a6c-de02-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653686323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686323, "uuid": "3d0be04d-229c-4a57-880f-d3176a6f55ad", "comment": "Malware payload", "value": "296ce2463dd13e48761b201df13c1ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686323, "uuid": "be985d00-28b1-4c3c-aef2-637f5604cb79", "comment": "Malware payload", "value": "45734f6c2bf14e396031f665963c7f03e74c1b989a58111a1f5dcf2c05d1e5fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686323, "uuid": "6c6bf382-7b20-4304-a8d2-26a1d0892754", "comment": "Malware payload", "value": "5c8e5b7d7634a50d31e73a113f65738142c70405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653686323, "uuid": "4b9c1879-311a-48e8-ac23-68cbf3f0f3d6", "comment": "Malware payload", "value": "74b07bd278234c7ee1c244f518d577c5489f3444a21aca203a2ed14708b2806cc115de47633c30c795ab699a9774142c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686323, "uuid": "012776d3-e1f5-466f-b134-9d02193ad700", "value": "T12CF4F104B2FC1B22F6BA67F95978528003757E995920E38D1DC278DB3A71F524B81F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686323, "uuid": "2f23d389-81b9-47a4-aa46-eab69cd0f7c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686323, "uuid": "99b18197-0879-4cfa-a64e-10959e7f9b87", "value": "12288:fvFvS2z9bHoAU1vqVYiXjUcPe+9ObHqi9KQizMQm/fFZQM4Y:HFvTxbHo8oie1N5zFOM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653686323, "uuid": "afb6c5bc-6d69-49ed-87d7-b01723a3c80a", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653686323, "uuid": "1cc80313-8e36-4cc7-9776-a086c7482efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653686323, "uuid": "b44d00c3-4341-42c5-8bfd-c7ce0785b619", "value": "PO 2902481689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62af81d3-ddca-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1653662185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662185, "uuid": "595beead-1bc5-4c6d-8018-bb8e284c4175", "comment": "Malware payload (njrat)", "value": "a5b3dd8d83d63498c52d938f63eb61bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662185, "uuid": "56bbfbdf-2600-4585-9226-aa8f13208341", "comment": "Malware payload (njrat)", "value": "45bb2795caac14d2915644b8c6aed568a8681dd12cab779e5bb535cc03a95a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662185, "uuid": "83762b36-1b00-4571-b267-6c902f9d96c4", "comment": "Malware payload (njrat)", "value": "6a07038608774231386f436ba4ca7063abf28078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662185, "uuid": "10b1d979-16f1-40e8-895c-d6afd6b05630", "comment": "Malware payload (njrat)", "value": "2bbf71f77d907961c2df8535661f7515b686985f995867d55c2bc293af7491f3dcb16578ae0db4a9fc580115ab6772dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662185, "uuid": "7e9f3879-eb4e-4312-8d75-d91b81e8827e", "value": "T113033A4D7FE18168D5FD067B05B2D41307BAE04B6E23D90E8EE164AA37636C58B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662185, "uuid": "8eae191e-0b09-4e32-8065-99c27b4668a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662185, "uuid": "15830102-2305-45d6-b515-8d227a3e562e", "value": "384:rhmK3hUidksXR21cGMy8PIU5fHkFlacp1rAF+rMRTyN/0L+EcoinblneHQM3epzJ:NmK3bLGv8PIU58KcvrM+rMRa8Nu/ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662185, "uuid": "65eaa904-a535-40a3-b36d-fee5fc90202c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662185, "uuid": "ecb0c773-b95f-4a48-a394-12fd3b6c3512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662185, "uuid": "3b5e086b-b54d-4971-a1ca-cf91edfe19c7", "value": "a5b3dd8d83d63498c52d938f63eb61bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe48c42-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653665240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665240, "uuid": "03c36596-6bff-4c81-b8fd-2c16f5424441", "comment": "Malware payload (RemcosRAT)", "value": "25cd6164a3ce68303844203a43dc22d9", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665240, "uuid": "a0bfec31-23e2-4876-9c80-0ecdfec2bb05", "comment": "Malware payload (RemcosRAT)", "value": "4625d8be23bbcefd3d4c094c006a08b24faca8a704cbcf8992021d2a49ce0aae", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665240, "uuid": "13a170a5-580c-4953-b312-bddab3fdddfd", "comment": "Malware payload (RemcosRAT)", "value": "870bb1d0622c281e38afff28bfddce67991e9e35", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665240, "uuid": "39f91a73-88f2-4a7b-b89e-a0c95d1d51ce", "comment": "Malware payload (RemcosRAT)", "value": "bab8ac1e5f98089c4f7715a96ddc976dde265313c5caad67e818b607806bc86a62ae0f5476cfbdafe576c71176a51796", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665240, "uuid": "2b687b48-4d8a-43c1-bef6-10df720c6b4b", "value": "T16E0381A2B2D1D80AD995033A4CE7C7D63726FC519FA7834B3289F71E5F716C08903656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665240, "uuid": "7f4a0721-d36d-4b59-b647-f2466da32a40", "value": "768:oRmk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJAHoDDbIm8V:Jk3hOdsylKlgxopeiBNhZFGzE+cL2kdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665240, "uuid": "18d54549-cd1f-4233-8871-80aa0f6366b6", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665240, "uuid": "c9ad70ca-616f-4d07-99a8-ed9355b2161b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665240, "uuid": "e768f50c-42bd-4732-8dd6-8f0b36279ca4", "value": "ACH Payment Remittance.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309f1c1d-dda3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653645350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645350, "uuid": "88bdc78f-c430-418b-9085-27fe2f6e6567", "comment": "Malware payload", "value": "05917dd297edfa2ce0537c33c0270a4f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645350, "uuid": "ad9bc4cc-64e2-43ef-990a-9ed190fb17d3", "comment": "Malware payload", "value": "469648da328b80157ed58a11466051744128cbf0ed2e9463f3f41a25018872d7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645350, "uuid": "3fac6d33-0de8-4459-a2e6-ebb43e2f4602", "comment": "Malware payload", "value": "75bb7234e63de8db41b40cd804e83b4fdbd99038", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645350, "uuid": "ce312793-8296-49a2-8b1d-d1c107a0a2fc", "comment": "Malware payload", "value": "f7632838175ff1dcebe2a1cd35195df9b84efbc0259f1d91d44034e9fe62e94430278a4d0201e57b919629ccf1c3118e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645350, "uuid": "b108854d-9d4d-48aa-826c-124fc6a7844d", "value": "T16644BE619D70BF00EA55183C83906AAB110E2D9F4BE6920DBD5EDE0F7752C8B36DF894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645350, "uuid": "3bac3793-7e26-416c-9f15-17e59387494d", "value": "6144:qUJivx+4Om9/+TIgLLD7tBp69t+uVAjXVmqGrvFo7KPJdx:Kx+M9/+DnzpwtjVsxGrv/PDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645350, "uuid": "0bb2fa9f-822d-4f73-bc28-1d6d3d5ad333", "value": 276945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645350, "uuid": "d57d6582-1116-465e-a5b8-fa363643f498", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645350, "uuid": "4187b4ac-17e5-4cc5-b6c0-ae7826b9f8a3", "value": "Media Buyer Call Mailer.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518dc68b-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653664733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664733, "uuid": "003921ac-e9cc-478b-a1b0-07451ba3cb5d", "comment": "Malware payload (Heodo)", "value": "85f61e5eca5848305a9b644b305c5f5f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664733, "uuid": "90f4867a-12be-4198-a88d-f96ad41b88cd", "comment": "Malware payload (Heodo)", "value": "4833a7a268b87be6d5ccf3860b7468c7d80a6d4269f060b1c2a060265ac0da78", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664733, "uuid": "fafc4c30-fc48-446c-9b08-faba0511c943", "comment": "Malware payload (Heodo)", "value": "da16f259021cb0fd61fe08585206ead1b6a96846", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664733, "uuid": "cd6fbff6-7d28-4213-a384-1f3258d85931", "comment": "Malware payload (Heodo)", "value": "b4aa93f39be16670afe60aec72987a9f98ba020152b0d7ac2092bc6328c6ee513b7b1ec5ed23a6d71d536c823d61f41a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664733, "uuid": "3352467f-2428-48b0-a16c-78bcb4a7e353", "value": "T12594CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664733, "uuid": "19a6a468-7498-4c75-8538-fb3d53aa938c", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664733, "uuid": "5c2e64d1-1c6d-4512-9b5a-d83b06162f94", "value": "6144:I9wEpo6/4WaPgMIuxqqkAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqkAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664733, "uuid": "d9805c85-3dfb-422e-be64-ec2619811069", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664733, "uuid": "8a5fd3af-5ba9-41db-bf74-1ce54ef03e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664733, "uuid": "c755d19a-7d67-4b6a-a591-4bafda4f408b", "value": "85f61e5eca5848305a9b644b305c5f5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95445378-de04-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653687180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687180, "uuid": "79e231a2-f97c-46a1-86f5-0994b8751c4f", "comment": "Malware payload", "value": "b698950c30744de62c334c037866931e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687180, "uuid": "1d942a62-a3ca-4cfb-a5b2-bc002cc5b54d", "comment": "Malware payload", "value": "48bc7d857e4ba3e1945c01521208ae667a9bfd8d091efa22d25cfb853bc0001a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687180, "uuid": "7b30e113-b5a6-4dbf-9b89-3dc60b16fe84", "comment": "Malware payload", "value": "14f51a47f71c2dd7d3dd9377fa0a34b9097480a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687180, "uuid": "1e7e4f1e-3fa3-4aff-a06b-2df2d52aec35", "comment": "Malware payload", "value": "464f957be6e4529063cbdd0d1541680e646f82b862ab3e0263a5e9bdded664391985b17b1babf149fe3355f872e1fcbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687180, "uuid": "04a78e9d-9819-4321-8cf3-119b93335895", "value": "T10FB27215AF8C8E75EA263AF25B73F1400679AEC259558B5C64E030476EF2FF40E7E920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687180, "uuid": "bdd8feee-54fe-4663-b071-b29690b94c6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687180, "uuid": "9799a761-b641-4039-b48f-b6dea09ea324", "value": "192:maVGlII9fb06gnWzibhNgwzYUllllllllllllllllllllllllllllllllllllllG:maVGxBb/gnWzibhNgwmjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653687180, "uuid": "c2c2bab4-8b11-44f1-915c-494a6298d2c2", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653687180, "uuid": "472b7123-8e6b-46f4-9930-12ce31d9e382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687180, "uuid": "764dd302-7366-49af-9625-57f8e82cd2d6", "value": "SecuriteInfo.com.BackDoor.SiggenNET.35.25310.15647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dad92b-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1653665062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665062, "uuid": "06f684da-564f-4649-b14e-2ec10d6c072d", "comment": "Malware payload (OskiStealer)", "value": "cf65c6f1cb9b6847cf639bd57e8282d1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665062, "uuid": "064c6b08-9f02-41ee-9cec-835548c4eed7", "comment": "Malware payload (OskiStealer)", "value": "49c7f9c1a11758309f55b563b54a44b734b39f185d1d5d63436adea38e44a03d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665062, "uuid": "66229039-66fa-4fd4-914e-bbe17776b25b", "comment": "Malware payload (OskiStealer)", "value": "30e4a45690434c04643aa30456191fc78041caf4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665062, "uuid": "63f96a87-2137-425a-ba87-51ae694802b6", "comment": "Malware payload (OskiStealer)", "value": "2f3e5843762c4055204cb26f26a4ab2cd61f6b23178cd8c7e0135a3909ab27dfd196971f855aba43f2f1e6fc013c707a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665062, "uuid": "c83bd9bb-5074-4d38-8dd0-306e06474ae8", "value": "T100B2E76DE1850928DB6BFD31C772063035F91D88EA25ED1D48A77ED23E73BE50E22429", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665062, "uuid": "1f1bd0d2-dc14-4152-8323-ee902fa1e74e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665062, "uuid": "589a29f9-efe9-4974-a03c-f48f68282601", "value": "192:HqVAP8L16Jzu5bwVLu8CTYUklGtkwPCnSzH3geCNGxi6vGOLRvp:HqVA1KbwVLu8CTqxJnSj3ge0G7GkRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665062, "uuid": "42769e89-9748-46e0-b4a4-c43611123a8d", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665062, "uuid": "2df59197-b1f1-427f-ba7a-1e36df10d225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665062, "uuid": "3dab5ba1-6a51-4c75-b200-c6fdb21d458a", "value": "DHL PACKAGE DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7040f1c2-dde5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653673804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "0810b1fc-4874-4f8f-b2bb-e308b4ec34b9", "comment": "Malware payload (Mirai)", "value": "b8724cd89cae5c44cc8d2b90b85a4f11", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "d2cda20e-7b40-421e-b042-8ef137f69793", "comment": "Malware payload (Mirai)", "value": "4a6d9163d3d9725bf5ecb8bc126a740e246b921ee675007665c147178c8784f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "63abac01-72cc-4a39-95d1-6e4e62c2c0e0", "comment": "Malware payload (Mirai)", "value": "ef35fa64fc9dbcf8bd31fffa0a49ce194a945654", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "1e6bfe13-f29a-4d09-b9ed-32a0ccfe4e28", "comment": "Malware payload (Mirai)", "value": "5f2e1c2e7d7c2522b72daa2146052a3bfb3da2dd507da9c497f2353c39f926298f95bd3e5847389e6b4c0d38355417b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "a3d629b6-ac5f-46f4-bfc5-4745ff44924c", "value": "T1FCB30805D9905737C2D22BBEF79A82CE73221F98979733119A287BF41BE5B9D1D39020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "2066ad5a-c28b-44cb-93a7-3cb70bb709e5", "value": "3072:d6z1WqLgV4ZQGBcD3i/lMpaLhmVAQ/iwmjafI/UxglryYl3s+Z2nYJ2W:WJjafI/Uo3s+CYJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653673804, "uuid": "2502fb12-5414-44db-ba51-a2a0d9001da9", "value": 117425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653673804, "uuid": "58a28e5a-be3d-4856-82d1-6276301dbc82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "d4417775-055c-427f-a389-51b0dd03768e", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445fbf32-dd8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653635505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635505, "uuid": "d3615f2b-d227-4cf4-9a48-9c7d37ffb134", "comment": "Malware payload (AgentTesla)", "value": "44cada1f01959d74ee749caaaf87c1b2", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635505, "uuid": "a76179cb-9644-494e-9af1-5938c23d2d1b", "comment": "Malware payload (AgentTesla)", "value": "4a852f43766492a506be7f827115ac27f86c470ef523124b4ffefef3ef642f04", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635505, "uuid": "32730acf-6afe-429a-980a-5791df779644", "comment": "Malware payload (AgentTesla)", "value": "0d694c53a418855b3cbba694404b5b72a0388ea4", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635505, "uuid": "695c6084-7664-4cbb-9316-f05c221165d8", "comment": "Malware payload (AgentTesla)", "value": "6b0a7e85cef4a260d41572ce20424c5fb0440d14241da5a6a0834dae064d7073fdfd2f99c964e9296b0c25e4d531820f", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635505, "uuid": "3f31962c-51e2-4593-a2f2-5cc7c28e1426", "value": "T1B284234DDE521F9876DEA89B1EAF54B404F8C730E94FB602E0A3CDDD0FA5C19919422B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635505, "uuid": "966d8c3e-1177-461c-9cd2-31267ebf1a9f", "value": "6144:TMxZPjMPbr4/LlXBBgam8G9C9KuOVScimIVMix7PweYffBsBx2yX:T0QPXWLlX3gT9YOVScLIVMe4eoy3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653635505, "uuid": "e6918957-4539-4f7c-b27e-eca1a4435f1c", "value": 371678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653635505, "uuid": "d069efe5-5097-4412-9f74-582a93075901", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635505, "uuid": "5f15c55e-01e6-4144-8068-81520d329ef1", "value": "P2D00976543234560009.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8cc22a-ddab-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653648810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648810, "uuid": "a601a455-1648-4a72-abcd-d5b401eb9b15", "comment": "Malware payload", "value": "8f0cb7613421c4aa8523a190164a80a7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648810, "uuid": "42ca96f8-685d-4c0d-abbe-0d94201cfe63", "comment": "Malware payload", "value": "4de4f47b7f30ae31585636afd0d25416918d244fcc9dfe50967a47f68bb79ce1", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648810, "uuid": "3848a8ec-4893-4315-a831-f588bbfcc76a", "comment": "Malware payload", "value": "c41e5b1cad6c38c7aed504630a961e8c14bf4ba4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648810, "uuid": "27b7e76a-3e41-43d3-876e-95cabe9af89b", "comment": "Malware payload", "value": "e7789bce5dd9a1b90e5524ca99d9d540a4f8c07ec9cc6f7a05cd626ea6c2f465278389fc58a090e2f537339e2fd9a84b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648810, "uuid": "38302b77-b42c-492f-bcdd-3600564b1fb6", "value": "T1AF413ABD6C0B62432915DA4B70E311324753F1B67EA32AB918A2292A2C99CD741761C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648810, "uuid": "c40c40cf-edf9-4a70-834e-305149cb5ac8", "value": "48:X01IO1gNEJDETXhi4a5JA0/m5WpAgS/9KQKoAWV4kDmD3ySKdSxE:E1rQhi4mAZ5W29KQKMD3PcxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653648810, "uuid": "09e7f23d-3a3d-4ea5-ac45-3ed240c24b4f", "value": 2135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653648810, "uuid": "a3de2f5c-7d7b-466c-aa64-b53d97c00cc5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648810, "uuid": "732d1c5d-d074-444f-9b15-648a38ee3383", "value": "4de4f47b7f30ae31585636afd0d25416918d244fcc9dfe50967a47f68bb79ce1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972fcba8-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662702, "uuid": "736f2b37-f274-401f-a51b-84129bfdd14d", "comment": "Malware payload (SnakeKeylogger)", "value": "57d4b1172f663293fdba0c8118a06f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662702, "uuid": "164974a1-4070-437b-a561-1abbec66f975", "comment": "Malware payload (SnakeKeylogger)", "value": "4ea712488c2757c53f5aa514648aae9e4b1bee4027b3dd3e1339f564bf8e8cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662702, "uuid": "befced14-d8df-4f22-a166-6fccacaa3b0d", "comment": "Malware payload (SnakeKeylogger)", "value": "61d25abc08a914897b8c4241586ed2631984f81c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662702, "uuid": "39ccc34c-3bbc-49e6-92a0-9d41f720d40b", "comment": "Malware payload (SnakeKeylogger)", "value": "57db2fc0e5809a68af4171959264bd5a4f003c65eb1833c991943a481e8616e557970fc3a902c003e56c52693a281bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662702, "uuid": "3cba74a7-90d6-4ab6-af59-8b087aca2f9a", "value": "T1129360E2A1C8FFD3D5BB62346EE176100B235B08285586409BCC261F7726ADF7781B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662702, "uuid": "6028fd74-c9f9-43f2-9f8d-2fed8ce3ce4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662702, "uuid": "18e2b027-6ff7-473e-ba96-5b435c9abb06", "value": "1536:90DlAl8ljRWcplgMPocPoJ4TGEWx4/2J:90Dl4cwzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662702, "uuid": "775fd6bb-36ca-432c-bdb1-034f86344694", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662702, "uuid": "87374723-dbae-4607-bda4-69ff1f09012a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662702, "uuid": "17e7158b-1691-4865-9585-dbab2ec75d04", "value": "SecuriteInfo.com.W32.AIDetectNet.01.23932.28450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d530f5-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653665270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665270, "uuid": "987f6c26-ef73-4ecb-9065-c5285e5cac7b", "comment": "Malware payload (Heodo)", "value": "c0ad95b81901426c25cf093c0afb77a0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665270, "uuid": "4e0f592f-6360-480f-9082-1f4f97e9716a", "comment": "Malware payload (Heodo)", "value": "503ecf31eb0c5c8e7523b1b4ecd2373cce9c3acf77b9a821b4133b525aef2490", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665270, "uuid": "6e5ea14e-3535-47ea-9005-f7d2e1b4cfc5", "comment": "Malware payload (Heodo)", "value": "fe8f9cb556e17e8c0a747ce07a8a9eadefe9bcaa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665270, "uuid": "e6156bd1-7cbb-4410-893c-170a7d3a5544", "comment": "Malware payload (Heodo)", "value": "7000e712371a0f6ac6a8003497bb943ee62f5ec68f742a1e38bdcebe3f2abb3308ac69ea15d137bf6a42026f94deb2b1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665270, "uuid": "1ca100f6-69db-485f-b1ba-05f6bb1df3d2", "value": "T12594CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665270, "uuid": "a5b79baf-23ae-448a-8edb-1d2604bdc7d0", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665270, "uuid": "7bde26ec-3f09-4492-a849-900257ef76cc", "value": "6144:I9wEpo6/4WaPgMIuxqq4Au/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqq4AQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665270, "uuid": "b959d369-c234-439f-96c9-cca3b7ab10d9", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665270, "uuid": "a1c405ab-720a-42f2-9f47-9461b0cc8a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665270, "uuid": "7e849216-137d-443f-b452-96a4370658f4", "value": "c0ad95b81901426c25cf093c0afb77a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f52374f-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653665051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665051, "uuid": "4a5d2d31-e704-4be8-901c-32becc1acede", "comment": "Malware payload (Loki)", "value": "aa3d3d15a95657c1c1335f020fdb5795", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665051, "uuid": "feb82bfd-2831-44ff-a4fd-d077b95cd8ac", "comment": "Malware payload (Loki)", "value": "5282d85213c0913e46e1fca68ef35408ed568a4cc371cd637ecbeb79863756ce", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665051, "uuid": "dc106d85-fb38-4496-b52d-9e10ebf4087b", "comment": "Malware payload (Loki)", "value": "7441ff6931df0dae26dbcf7e5551469faf82ec6c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665051, "uuid": "4d608375-6a9a-4762-a2d6-8232d009d6b1", "comment": "Malware payload (Loki)", "value": "c0d37d8d9bb6ad6f5289fb73d41da4f4827246329bb0062d2cace31c1697e73deb9859ae20ea53bd4399713f67b453be", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665051, "uuid": "319d9510-179f-4e5d-93c9-f79275c3665c", "value": "T1E535232C72EC0F29E7BA4BB600B8105447BC674B6517D71F6E8274D93C93B8A4E31B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665051, "uuid": "76485f57-aa67-456d-a9a6-543c52006c83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665051, "uuid": "5e8d70fd-ad77-4463-85af-5917fcd4468a", "value": "24576:zMzW2AZbHou/qo49ksKQrPpvDgCaXeBMr:iApqWsdpbXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665051, "uuid": "b72beaaa-abd0-402d-885a-9534a708db71", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665051, "uuid": "d675387a-ce92-42d5-ad6a-841dd5397a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665051, "uuid": "2a22b959-fabc-43b7-9787-0673b6c62e54", "value": "DHLDOCUMENT26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25402f11-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662511, "uuid": "876217e1-5ad3-4cfa-bed1-f13779fe1c94", "comment": "Malware payload (SnakeKeylogger)", "value": "796144d991c7f15373f5f4001b4ac45d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662511, "uuid": "66571933-44ab-46a8-9128-49e090a136ea", "comment": "Malware payload (SnakeKeylogger)", "value": "529e7d2f8f8d6eeec05c813c3ed837d63afe5ced48fb5df740ae064c8b6de4fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662511, "uuid": "20699169-0197-4b36-ad16-74bca068b2e4", "comment": "Malware payload (SnakeKeylogger)", "value": "ac1b2b5a7b8e3575e56a7bba3a312c3ae6eff70b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662511, "uuid": "b3bfccd1-9ccb-47fe-be4b-ce64292010e7", "comment": "Malware payload (SnakeKeylogger)", "value": "30376b68c76467eeea52c18807b0eebc5d0461c04b812272b591bd4c671067870e4251fc9987e5a5c63a17ccbf4b68ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662511, "uuid": "d459a711-ad45-4eaa-87aa-c30d3b201d85", "value": "T193E4F004B6F82B26F6BA67F9A67411C007B27D995920E34E2CC278DB3671F518E41F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662511, "uuid": "eda85ad7-911c-4745-8b94-df0ee834e151", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662511, "uuid": "946c19a3-6826-4249-b858-55021bfddb6e", "value": "12288:mC12D9bHoAUavqV2lN2vZ857DT4cTjn2qtfEjdN0pmBn:lcBbHoE7DTj2qtcjdYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662511, "uuid": "3611033f-1324-4a25-b439-255549728f2f", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662511, "uuid": "4de3e9c6-5039-442b-94cc-536dbb5f346b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662511, "uuid": "762bd34c-f681-4f91-8ce8-e27b38999f90", "value": "Product Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef1609b-dda0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653644381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644381, "uuid": "0870ed99-4426-449f-8ce5-785d50ab10f1", "comment": "Malware payload (AgentTesla)", "value": "e71bd9175352605c85d063274326d011", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644381, "uuid": "3a6598ec-936e-484e-8349-d12ef8cee16a", "comment": "Malware payload (AgentTesla)", "value": "538b041e423816d1339df78971d4070b0559eaa398e588772219f5aaecef2ac7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644381, "uuid": "1f84e0fa-5050-4f09-b436-5549940b9e1f", "comment": "Malware payload (AgentTesla)", "value": "3ade98144638908bee7d446d589f4f0297efa433", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644381, "uuid": "6548f0a1-a2d2-470e-8724-016ee95d8e4e", "comment": "Malware payload (AgentTesla)", "value": "7c2054dbad4ae657c6338e06b6c81bfddeed9e58e83278d53112958e5b22b2e7d3b36fe3d8e9713cb35325f5711ce752", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644381, "uuid": "68035a5e-d272-43af-bd50-e27031366e78", "value": "T154C423889F415B39D63BA0D3FEA3593935ECF92170CF2074BC9518778A8216F2686C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644381, "uuid": "cc13cf5a-e35b-46e2-8ef3-34a2a2de9a82", "value": "12288:hmYtUchLj7WVBU2k01Y7tcZ91knQaUVlqu7h1:hmHcxj7uBs01YRcZXkQaUuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644381, "uuid": "227878d0-332a-4232-9502-3a12b27b85d9", "value": 591370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644381, "uuid": "ac621cce-cc0b-4e19-93fc-35ea68aafde2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644381, "uuid": "942ed3d6-6a9a-4e51-b04a-ea40289f83d6", "value": "document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303dd6f4-ddc8-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1653661241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661241, "uuid": "67fd9523-d197-4cc8-89d4-ee54f3aced4e", "comment": "Malware payload (IcedID)", "value": "0a4d581210dd1be3c9b81f809812374b", "object_relation": "md5", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661241, "uuid": "5b0d3780-87de-4d30-bdca-684b250404dd", "comment": "Malware payload (IcedID)", "value": "5489565de27542c38fe51eb89e917945b510d87656eec7430fab93811f628145", "object_relation": "sha256", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661241, "uuid": "b6f390a0-6645-4f2b-8ffe-7610901c3a2e", "comment": "Malware payload (IcedID)", "value": "bcac9100e37ab616220b6f6e7dfed2e0a3fc046b", "object_relation": "sha1", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661241, "uuid": "1d447a53-89fd-427b-b21a-ed1c2b05e6d2", "comment": "Malware payload (IcedID)", "value": "8b2990762c1484948b9d5d29865cbf3319348fd1a8e60ef9c518f8da819258478b5ee5f9c18e10af93c8a66adc3e34fe", "object_relation": "sha3-384", "Tag": [ { "name": "BokBot", "colour": "#318781", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "StolenImages", "colour": "#7FF60B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661241, "uuid": "a9defda3-7f53-4cec-be43-234bc0633827", "value": "T1E945AEB4F6142CE7D66E037BC9D7BDD923B327228E9BE48941A467D209B3371EE15804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661241, "uuid": "f66b13dc-468e-4049-ab14-7db08034087a", "value": "12288:n49cuWTcALiwCeWu2E5u0v1qR/B8r5g1h:n4gQtLuZ5x14w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653661241, "uuid": "0a278eb6-79bd-48d2-8bcf-2aa3fdd2c2fe", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653661241, "uuid": "c383b3df-aab4-4919-8283-5de36b942394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661241, "uuid": "9b0d10f0-41f6-49ca-b67e-89c285264802", "value": "B0800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41547928-dd6e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653622615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622615, "uuid": "01e89f94-4ee9-4f18-9f38-bb935540dc2c", "comment": "Malware payload", "value": "b7768cbe4508453eb639074347473b97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622615, "uuid": "5fd9622e-a9e9-4eb5-a52f-aec331470173", "comment": "Malware payload", "value": "550d5fccb570d97126c3c8030d3d581826a71916aac0194cfa9ede63da801e2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622615, "uuid": "01695f54-44bf-4f21-93b6-5978cbf63959", "comment": "Malware payload", "value": "50a5ed7da65361ddcef5fc78e9a90e5248dc6419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622615, "uuid": "e197bbb0-f0d4-4e1b-aae2-599264658297", "comment": "Malware payload", "value": "9bfd9183951c2003576fd88c5604bcbde33ae5270176a796008f2b38b9dcffa9a6a892f202773504ab1dbceacf8dba1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622615, "uuid": "378096ac-2800-4d04-8620-241b4861c162", "value": "T10DD3AE4031D281BFD8756AB158689A8096AFFE222D398F8B734C157E8C746E0477BF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622615, "uuid": "93fecbad-688b-41be-a77d-69157f55237d", "value": "bbb2f32f8d365f3ad9879bc589ae5fb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622615, "uuid": "442bf3bf-2247-4394-8097-e9ec21053478", "value": "1536:/fTOG+x8+YaGDARvmJVBqNvnlajcCOO0LdXU8JiA1OySuXgRxCnak8PnBOBYCX4C:ufbnR6BqNvncvhw4uCxCnQnkGCWHFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653622615, "uuid": "9822608a-4d14-48fd-ad21-abc3f7cdcc4f", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653622615, "uuid": "3de8db8a-19bc-418d-8f59-11a3fddcd949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622615, "uuid": "4a18b6e6-5c6a-49b0-81f3-9278b2e2e501", "value": "SecuriteInfo.com.Variant.Jaik.73412.25944.20157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16e768a-dda0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653644331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644331, "uuid": "27dd1030-02be-4f76-99a2-049ec5b85d6d", "comment": "Malware payload (AveMariaRAT)", "value": "556b1ad658491e3e72829addd71b81ea", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644331, "uuid": "4603a6a6-a159-4155-9df1-02d072022d18", "comment": "Malware payload (AveMariaRAT)", "value": "55a3e7c7cf98e429dccd0631ad6a801ea0924ceb8f802a827326422cda0b9ed2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644331, "uuid": "e820fbfb-cda9-40b1-81f7-22923120593b", "comment": "Malware payload (AveMariaRAT)", "value": "f1a961a3d029d3dc23cf8254a234457cee9ba339", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644331, "uuid": "f05d0cac-7cda-43f0-83e9-7d1339d4dd94", "comment": "Malware payload (AveMariaRAT)", "value": "7b2b5c9b1f97d3ee9512e7e8bc02991693a57506ec8e3240663d0043c902d40735ee02fa7a693b1bca34dd34839f7d6e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644331, "uuid": "2dfdd34c-22ea-4833-90d8-3193fd8cc89c", "value": "T1C32412A5BAC1E4F3D18500B55ABBE2ADD3B9B2042377EB5747086F3B48344D6D90A2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644331, "uuid": "8fdb02a5-7e08-4664-83cc-091dfb375cb7", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644331, "uuid": "ca6a3c03-02f4-475b-8c13-1dab0d47f35d", "value": "6144:B0YMfm4MZo4SXuVIzQFAaKGK4VG2j3aOXyG:cfVShSXuigRK21/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644331, "uuid": "2357accc-ae60-4c17-9a65-91d062266932", "value": 223212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644331, "uuid": "2c4e66ae-f829-4f55-9ee4-c09610e48269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644331, "uuid": "466a1787-461c-47b9-82ed-51831005e24f", "value": "KKLOU7906565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b0424d-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664661, "uuid": "ff3f6fa5-ad44-49c6-8a1f-871a77051ffd", "comment": "Malware payload", "value": "e4207f1f5d7ff3a8c32caaf610d92cb8", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664661, "uuid": "71298ebe-7dac-48ab-930d-7c9bd60cfafb", "comment": "Malware payload", "value": "565bb91df334f7ffda019e174fdd210ff29f08f3657cc90cedda0db73e02fc3c", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664661, "uuid": "f4461e6f-018f-4fc4-beaf-64753df9b7b5", "comment": "Malware payload", "value": "f7359d616e02751dab893eac56989fe6525f3df1", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664661, "uuid": "8ca4648e-29d6-4f28-947f-257e5a4d345b", "comment": "Malware payload", "value": "9b613de50b5f38a2dbafff88cbfbb9ca00f0461df7c90650bc5425366defb2c231eaf34e01d834644cd0b1e75ef096f1", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664661, "uuid": "5d0e1534-084c-4168-b525-0b93f3b63eac", "value": "T1A574BF305B8057B9A7DC4A07C07E1A2ED6F3132AD513B2CC6BA235072A7EF195B1AC57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664661, "uuid": "96163f28-4afe-49a9-9c04-14126af7b91a", "value": "6144:obSW/sxQQI5dGBXVAx34A6LkmzN/E4AMpUn8nPXk2eyd8iIyAqa7VbwZ5M:obSWkjXVAxoAU/zN/E4AMFns2Hd1aqYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664661, "uuid": "284c4002-e899-4fc6-b0ae-36a5f9961990", "value": 339100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664661, "uuid": "010f8a0a-0206-4174-8103-456811205d89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664661, "uuid": "f660d7fc-2f80-4ccb-af36-d4668f6aa4a9", "value": "FedEX Att22052518063.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3359b1-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653676540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676540, "uuid": "0c117156-0b87-441c-ba82-72414bd30596", "comment": "Malware payload", "value": "5f9c23c5ff7646b0b5edc27fd9f08c39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676540, "uuid": "9902d553-d918-42eb-9d88-145c6305eb44", "comment": "Malware payload", "value": "56ecdeec3433fbc41ab02d7f99970a603a4fd9286914f0980a6cb5abef7b1cc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676540, "uuid": "843d664d-33fc-40ee-936c-d5975607713f", "comment": "Malware payload", "value": "397099717fba724bf1e7d916442b2172b0809050", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676540, "uuid": "aac5e24f-8800-465e-b99a-9bd6213304ba", "comment": "Malware payload", "value": "9b92a225694aedfae50faa96045924accd51b1fc4a937ef76919999223ab3d186c773f6189dc446e8817983015b40d7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676540, "uuid": "20676c81-1f03-42b1-b5aa-17df52ec92e4", "value": "T19D85AC013FB1416BC81E36B28952DF967CBD6C98ED4D6D86F26B1427D72C361292BE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676540, "uuid": "2f12e9b2-ead3-4416-a3b9-b7643624cbb3", "value": "8066c16c838a608909d3b67f238a0b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676540, "uuid": "73ee3b10-ca58-4955-bda0-fc1e6a9e7e3a", "value": "24576:HfJT6is2BBM0FBfJXAENS+Z+uIrz/op0sDniaKYcNiHjrQ/9bt51hM4sTxCK1WOQ:42BPFBfJXAEjQ9zgKsDn/KLiOtixwOjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676540, "uuid": "d1f76075-0cf6-4118-b614-b30ce508f0a3", "value": 1738534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676540, "uuid": "c2c2cca8-dbf1-4627-bbad-16f4486172ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676540, "uuid": "b80de006-cdca-46b8-95cd-eb16a4f8d205", "value": "5f9c23c5ff7646b0b5edc27fd9f08c39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5ce2cb-ddae-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653650202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650202, "uuid": "4cc72fff-a6e4-413b-87e8-fdae34fcda7e", "comment": "Malware payload (Formbook)", "value": "237bf3f32d40fefc5a67bb40b0d4a90d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650202, "uuid": "8915d2a1-3e47-4400-a6cf-3db67302dbfa", "comment": "Malware payload (Formbook)", "value": "59513c88f8f80d7a7c871c8f31f7bdf3e96d9831ec74ee9563845c202957a9cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650202, "uuid": "7d831d78-b9ee-460f-ac36-c6b9f922e435", "comment": "Malware payload (Formbook)", "value": "dd62b8c971b610479ad5f04d3fb3d4f1f77a3ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650202, "uuid": "17817e90-9ed1-4997-9bb0-e983b5283e5f", "comment": "Malware payload (Formbook)", "value": "fc024198ecbefc8dcd8fcc98b2f92cc408070e4b223210c01a3c09f69f79c9148f98e0f68fee273db8a39b7be4d3e88c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650202, "uuid": "f14b46be-3263-4b25-ae23-4d2200576b4b", "value": "T15554125A72F2DCF3D223043555B7C32E92BFF2391367469F4B802F3A2A111E5899DA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650202, "uuid": "d3f6f4af-efef-49b4-b351-43028d2126b2", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650202, "uuid": "372f0644-c426-4a8e-b3eb-54dc0a9fd115", "value": "6144:B0YvGzporCdsbSIW3j5+qL09+HZFEg0RMQJt0WcM//39Abgb:/MorcsbSJ3j5+0HMVKS/mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653650202, "uuid": "0aa647b3-f2c6-4f21-a316-ab17299e4770", "value": 298980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653650202, "uuid": "d8d74945-1165-4838-91ad-2b00941f4702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650202, "uuid": "7bb1d28a-1fe5-4d1b-a795-e8c4d35f56d0", "value": "INV-233-25-05-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77188e4-ddca-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1653662380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662380, "uuid": "aed02040-1187-4309-9c43-5571bc66cde6", "comment": "Malware payload (AsyncRAT)", "value": "1fb889537ed29e457058e062eba50511", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ASyncRAT ISO", "colour": "#0AEC98", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662380, "uuid": "87bd2576-9097-429a-b86a-924651e27f9f", "comment": "Malware payload (AsyncRAT)", "value": "59a57a733a48f898f00ef1f73ccc6becb50137864f6cf557c9e81b75adfcb16d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ASyncRAT ISO", "colour": "#0AEC98", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662380, "uuid": "20c610d4-b07a-40e9-a9e2-96d9b8767828", "comment": "Malware payload (AsyncRAT)", "value": "1c1a702a8edec1732dc7801badf6f60f19219350", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ASyncRAT ISO", "colour": "#0AEC98", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662380, "uuid": "8932fd7e-1f1c-4a37-83fc-0fc5889e2552", "comment": "Malware payload (AsyncRAT)", "value": "2cb86426644f9a0f2b2709774b9c07a408d01314adef0ee9beb2e62cac5dd1e5edf599268e6a3ffe44471d788299738d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ASyncRAT ISO", "colour": "#0AEC98", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662380, "uuid": "218958ca-b30a-47ca-b45c-7af790fd663c", "value": "T1023353526A04862AC770333400F5F7A07117B28A1FFBD632309D856C9B531A48BDA7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662380, "uuid": "1b4bf37e-035f-4a64-a083-2dd8e3843392", "value": "24:57W42rCeBW42LJZnyEEMLM2EU0rg2wOeyW/cdNRZOMgJKeJeSW:57W4+CwW4OJZnymREUQ+H/ciMyKiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662380, "uuid": "77141ae2-1660-46bb-ac5d-908c2ec15fd5", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662380, "uuid": "11b92224-cfed-44e8-a124-015de0f61afa", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662380, "uuid": "0b64e60f-4c36-446a-871c-e317ad4f6cbd", "value": "IKMFFD877564.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffa69c8-dd5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653614694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614694, "uuid": "ca05afc4-1348-4da5-80be-ff1e3324bdcf", "comment": "Malware payload (Heodo)", "value": "c1059edb1f843245f758f435b1f77dc9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614694, "uuid": "83ad72ce-5d2b-4607-b640-c9d36b749d54", "comment": "Malware payload (Heodo)", "value": "5a50e63250b0d71712aade261aa6e07304c69b1b92729b803dda525eba98b6b6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614694, "uuid": "f1488aab-9998-4e1d-bf6d-5b8cfffe981a", "comment": "Malware payload (Heodo)", "value": "f4d0e4e9f82a0aeb79de467aa7db83a9f57c67f3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614694, "uuid": "2d34efc2-ad22-4ad3-b762-30240ddfcda3", "comment": "Malware payload (Heodo)", "value": "4fc73ed198502728cb5d860ea8ff305f832cce1c9154e2e8e720cd9a8ef9851b4adfd66cd6abeb4b4ea2607ce0e62846", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614694, "uuid": "23b761df-1322-46d1-804d-9ac432bc8e88", "value": "T123F46C26F2AC8976D0EA9539C553C696DB713C69476643CB2290FB3E3F332E05939360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614694, "uuid": "fc392012-6612-42da-8a7f-3c8ab407270a", "value": "3a54e861d3d9d8c5cf26fa2949d55f6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614694, "uuid": "12d60bb4-c967-491e-8636-54bc0fa0620b", "value": "12288:hJheLDF+GBXYT7Ose6FPmg3TCtG2lqfn3tBzqgf/lvusL+o:hJhGgGJIJe6FPmg3X2lqfn3POS/lmsLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653614694, "uuid": "2b7d0f52-741d-4e15-bac3-328610c2c430", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653614694, "uuid": "ee86c4f9-d158-4f11-bb20-4b1db7800fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614694, "uuid": "e49908bd-8a0b-4cd2-b7b3-671a61000a27", "value": "c1059edb1f843245f758f435b1f77dc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51284c3-dd98-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653640955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640955, "uuid": "2fb2e151-13dd-413a-b43b-f02186baa2f9", "comment": "Malware payload (Formbook)", "value": "57ba8f73725ba9eaa988eec85adcaf69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640955, "uuid": "b6b34dff-bb53-4893-9dd7-cb98adca4786", "comment": "Malware payload (Formbook)", "value": "5c8cdc3745711d1054704b8663828b005aa7a66535b0004c0364bc5cff832ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640955, "uuid": "f42824c9-9b69-4b63-8210-934ae5fd2cbc", "comment": "Malware payload (Formbook)", "value": "243a88cc0d31b588dd15ef583e08d569b80b1684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640955, "uuid": "dd5765e6-eaf9-4e80-a678-5278f2e106ae", "comment": "Malware payload (Formbook)", "value": "6acbe98eb9788481eb2e5883c44de890942f64c55945a7147ac292a6666ca7a266e97fc330181847b2bf268816df1f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640955, "uuid": "7172c202-3109-440a-a92a-19f2d5bdef2e", "value": "T1C5F40104B6F81B22E67993FE957461C007B1BE952520E34E1DC279DB36B1F928E81F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640955, "uuid": "95fe27fb-9789-43a3-95b4-d86382aad8c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640955, "uuid": "0063539b-6860-4382-950c-1eaab10b1b83", "value": "12288:kCcq2e9bHoAUbvqVCGr6x75H06LJKxAsUS6sRAq+ysONvzLz9JDGgP:foibHotGriH0q7sU1s+q+y3NvT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640955, "uuid": "eddf9172-3c8e-4f32-b3e3-958a55037e86", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640955, "uuid": "4384f2ae-e676-4388-bcc1-33c2e0122d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640955, "uuid": "7e739b75-0516-4519-83a9-f38fb8b25228", "value": "SecuriteInfo.com.W32.AIDetectNet.01.15987.17486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d4b2d1-dde6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1653674236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674236, "uuid": "e149a2e7-3bf9-44dd-8e91-8b98880cf528", "comment": "Malware payload (Gafgyt)", "value": "25ab753410b544516a7123fb09fc43b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674236, "uuid": "d551cb63-ccad-4e6a-bad0-eef1ec49bc43", "comment": "Malware payload (Gafgyt)", "value": "5d0403e3499697738cb5b243169ac4284a332c040a6f780a7d0dfae979cf2ee7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674236, "uuid": "af7810ca-6825-4ee8-95e8-a4f251ff539a", "comment": "Malware payload (Gafgyt)", "value": "d2d8f8ec8365e97942c143aaecfb004a8521b954", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674236, "uuid": "ce2f0796-efdc-4cac-be02-7c534fd26a98", "comment": "Malware payload (Gafgyt)", "value": "5b4d9c81cef3ab258ac1de0b7f18933197d686e471a1ca73f0d0ce11444b1df359666ca1a7356acd69df55962c540c24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674236, "uuid": "4a6fabf9-7df3-438a-b6e8-a6d8971e04f9", "value": "T1A9A3B43737270E63C0CA547101EB1331ABB9DE4438B94B97A9917DA83F36E9834593DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674236, "uuid": "e6ed9645-9152-449d-9d41-e8f1e5943edd", "value": "1536:ygZumh7ei2QEjo958vWtmftFLgfzEjzUI8:V7CjoPzquEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653674236, "uuid": "9359b3d6-3237-4f64-8949-832dee82d99c", "value": 102970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653674236, "uuid": "8fb2e661-986d-40c7-b9c9-a77f7aa1db13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674236, "uuid": "7ee97246-2113-4231-830f-b74d68bbb821", "value": "25ab753410b544516a7123fb09fc43b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f70400e-dda0-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653644221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644221, "uuid": "b9d214d8-802e-4948-ae7a-b0f10e1e525e", "comment": "Malware payload (SnakeKeylogger)", "value": "aa6732a1577aa8b7734d8398db4846fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644221, "uuid": "50ccc2ed-0b62-4b4e-b245-7efa87b6aa19", "comment": "Malware payload (SnakeKeylogger)", "value": "5d046f306d47e9fc839a87cbf9b63977069ba7fdbf941394e1e771a009fd359f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644221, "uuid": "7dd65d5f-a807-49d0-896d-e2742ae1f709", "comment": "Malware payload (SnakeKeylogger)", "value": "00addfadba921d4b30c0b2ed86330cf2ffe6c2d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644221, "uuid": "f282240a-57d0-4c9a-91b4-a2590d959f25", "comment": "Malware payload (SnakeKeylogger)", "value": "2cad4df9ad343c8db0980ae14f6c34c7be6c8b0b2781039717ef74e85dd8eea51333b9fbd3aace2d64024ea8475ecc14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644221, "uuid": "9019ab81-2853-4409-a841-c92ab30b4689", "value": "T1DAE4AE21778C7493CAE9CD762A15CC300BE2ACDDB516E5593AE73C9F34F5BA20360626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644221, "uuid": "32a53822-5e3c-4245-ab15-98b7d64db623", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644221, "uuid": "7a62a956-a531-49d8-a53c-5655449de7e2", "value": "12288:Nx6ZYgcKTFJmr+rFtQWlJxjAUvHm8nN3quMMMMMMMMMMMMMMMMMMMMMMMMMMMMM9:6ZYPK6r+htQWlJx7vH73fMMMMMMMMMMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644221, "uuid": "6323ec47-318a-4768-9af5-67a90c07c63b", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644221, "uuid": "1fb28f7e-4077-4531-8df3-4d3550726e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644221, "uuid": "fb83d58d-4e1d-4547-befb-ba119b7e3384", "value": "Bank Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b48f688-dd97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653640348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640348, "uuid": "4c4c1ce3-0666-42db-ba32-0eae84ccca38", "comment": "Malware payload (Formbook)", "value": "f7174a65ad4de72292ebd45bad53c014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640348, "uuid": "b79f0657-a376-4df1-897e-4939629d670d", "comment": "Malware payload (Formbook)", "value": "5d63cb62e9c2099fa70b843c45883c69237a557d5d7198499c37a95789f00bd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640348, "uuid": "1d5fb2b0-5a7e-410b-a9fd-40912809d7cb", "comment": "Malware payload (Formbook)", "value": "16848b5fe34886a7d5b24ba316381eb973d6d85c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640348, "uuid": "c5ec6d25-f67d-440e-a0f0-1da4e6c73f2d", "comment": "Malware payload (Formbook)", "value": "eb1271491cf7525c8e75f83f713fb2a5820b0692bae3407dd8265b85237f8679b9be44301ad06fc3d8f5746db0cf2804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640348, "uuid": "b6e0e8ff-1395-4dfb-96cd-c525188385f2", "value": "T1348402E2E2D085D6DD6A5B314E3F9C266963BE2CACB0680D0F657E785F330D3513944A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640348, "uuid": "71f62c47-729d-48cb-9907-a9afa9fe33dd", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640348, "uuid": "2c1d8cad-dd52-40de-a748-73123ce5043e", "value": "6144:w0Y7mAmizmrVw7F+R3nAdp95xPeQ924w+cm2B4jkQVEQKztkyh:fPr27hx0E2F+V2BoVv6tke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640348, "uuid": "b38e7c84-fb8d-4796-b09f-f1613a8f6cb6", "value": 394096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640348, "uuid": "129701a2-b1ee-4864-bf21-a2b0a8787ed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640348, "uuid": "c16d439b-a8a7-43b8-9b9a-0f9ae2242750", "value": "600000sqm_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275f4b78-dd97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653640181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640181, "uuid": "a8f063a6-6273-41fc-8286-47329f32fec1", "comment": "Malware payload (Heodo)", "value": "f9a6ead5bc9c328542a86afd865b32b3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640181, "uuid": "9176c042-f56d-4c2f-b58e-c754890031dd", "comment": "Malware payload (Heodo)", "value": "5ec84351028eb751fce8af173e4bce1cf143568b006ec4a41acc6a6e4578d4d5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640181, "uuid": "a0981813-4880-4c0f-b324-c60c1560c363", "comment": "Malware payload (Heodo)", "value": "361e94d0f574f54f6f41bb0c00f9f3e8b91ee832", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640181, "uuid": "f690de69-63f4-4560-9ed5-6ae7a2ddc810", "comment": "Malware payload (Heodo)", "value": "1cd7ec9b8000cc61e2dead63cc31a367458005b892e46a26693a35ef234296d4a9cd04844a830baf88a777c1e3356e18", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640181, "uuid": "9e34ef67-8574-4b1c-baab-52e602787d16", "value": "T1C294CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640181, "uuid": "a348f80b-bb01-40f3-9162-6b249e6a54ad", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640181, "uuid": "bbd60366-fc0d-48ca-8ce4-63fe1fe84dfe", "value": "6144:I9wEpo6/4WaPgMIuxqqEAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqEAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640181, "uuid": "6947958d-4f7f-4c82-8a68-2d644800c0f9", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640181, "uuid": "0199bbce-4d08-4440-94e7-c63946eea3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640181, "uuid": "f76bf1c9-dbd6-405c-8f15-8ab269f83d3b", "value": "f9a6ead5bc9c328542a86afd865b32b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428e08a0-dd6e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653622617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622617, "uuid": "ae0013b3-d4dd-4d37-8a9e-9782e8beb599", "comment": "Malware payload", "value": "0e6aaf7596c5a3c5321364d378c831e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622617, "uuid": "a18962ce-e65d-4af8-a92d-460fdfbc97ce", "comment": "Malware payload", "value": "5f213c92d4a5acff24d5a51d59352fb964536ac11212120e450a0172fe2ca254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622617, "uuid": "4164e7f1-d0aa-4e29-9a77-41dc1d24d6fe", "comment": "Malware payload", "value": "940a8e00b7a787edd81d0d9f4dc54efc19d73f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622617, "uuid": "6c93f2b1-bd2e-4c0a-83c3-22699409b2fb", "comment": "Malware payload", "value": "24be3a3e294b5c457fea59664eaea327114ff9334d0eedf63a9e5e2dc87704519a2397518c3fdb83c549c7eb0df5540c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622617, "uuid": "15705ed5-2dd3-4387-82d7-281555a7f606", "value": "T1E7D3AE4031D281BFD8656AB258688A8196AFFE322D398F8B734C157E8C745E0477BF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622617, "uuid": "6297363c-c396-48b9-b40f-69892e1d2685", "value": "bbb2f32f8d365f3ad9879bc589ae5fb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622617, "uuid": "cab8165d-386c-4356-bdf1-e66323a84858", "value": "1536:8HTOG+x8+YaGDARvmJVBqNvnlajcCOO0LdXU8JiA1OySuXgRqSnakMP1BOBYCH4g:jfbnR6BqNvncvhw4uCqSng1kGCUHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653622617, "uuid": "65de3e2c-c273-4bab-b530-55aa89ea1b3d", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653622617, "uuid": "7b4b3023-325e-4b8c-8098-248e4976b59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622617, "uuid": "7578d8e4-a4d3-46c3-84f1-5cfdeb9d3e67", "value": "SecuriteInfo.com.Variant.Jaik.73412.30720.21217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fffcbc1-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1653664623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664623, "uuid": "fc7f9f0d-6a0c-43c4-84a5-97770bfb7f29", "comment": "Malware payload (Vjw0rm)", "value": "e37b7d6994ebb97e40725c11fabf6a17", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664623, "uuid": "76bc7e23-3840-4cb4-bee4-a161371cb18e", "comment": "Malware payload (Vjw0rm)", "value": "61778f86041a9959d03e89812f74dc86efacbee6fcdf353935966c8dac4771b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664623, "uuid": "951efa2a-5936-4596-bf1d-5c7b72c21ee9", "comment": "Malware payload (Vjw0rm)", "value": "d859330f1258f6a4224a403327258f6c16a6b3ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664623, "uuid": "ddaf193e-2809-48bc-8e79-64b6eb70faf7", "comment": "Malware payload (Vjw0rm)", "value": "273607a813c1f50a4c8723bb6a4a0b300d05fae1bad7a586242d8697f80536005a92e162e29cf36ea5f26d3a902ff080", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664623, "uuid": "38023756-e12d-481f-a257-f19b4f94a606", "value": "T190C28DC00D615E7BDA6C5449ED7DDC1E8BB08D42A6C599CF3A6B76C44FA2243CF2A60C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664623, "uuid": "00e6cb3b-d0f0-4ae2-b705-64d9e8f337ff", "value": "768:RB0rmZ7BLi/gDx4hFJDGq5LQg1zy2Aq7hCPae3te:R+rmZ7BW/gDihFJDGq58g1zyXq7QP53w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664623, "uuid": "4184e05b-31ee-41d3-beaa-55e9caabfdac", "value": 25805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664623, "uuid": "096a2100-3f2b-4216-8676-a8eae7178eae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664623, "uuid": "c1b5129b-4bf6-487d-947a-c6676bc5116b", "value": "e-receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f522d32-ddce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653663816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663816, "uuid": "360a4b48-488d-4745-be30-a3c5c384ab3d", "comment": "Malware payload", "value": "5290493445c2288fe91408ce91166b5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663816, "uuid": "70212a29-151b-4711-9d82-3e506440b5d6", "comment": "Malware payload", "value": "625c898ad469f985a31d2205b6056f76f070f9945213c136392635cf93146fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663816, "uuid": "c02063bd-35cc-433e-9eff-6c0ae2767655", "comment": "Malware payload", "value": "0fa33a959ef8d66389f6abfceef9eef5ce666254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663816, "uuid": "b9ab79b3-410f-4523-8177-d807ee19f7c9", "comment": "Malware payload", "value": "258687d573be9557f06fbb4e6308600c46272ebc6f54bc7962c5ea56c87253912aa04af1a4c902eb199d8218421f853c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663816, "uuid": "30ca0d11-d343-463e-905f-64aa7298230e", "value": "T1ABC37D1175C1C872E572193149A4EAF59E3EF9310F606EEBB3C8463A0F742C19926DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663816, "uuid": "2d44094a-6dc9-4de1-8db9-bc01e36df1d0", "value": "b1e8695b9eed440cd1ef5f8703820ee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663816, "uuid": "f3286d32-848d-4e0b-b064-25e429778116", "value": "3072:Trn4CuDcpMkymV5x0RCVZeeUebHCDYp61FmHhe8pTAV02DnEb:Tr4Ndkf5xUCXUXDY8TDnEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663816, "uuid": "89cd3d15-7839-4f47-aa54-412c1d624815", "value": 126714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663816, "uuid": "6e384f49-fc32-4533-8159-cda424d4c88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663816, "uuid": "92926255-31c8-43ac-988b-4079953375f8", "value": "5290493445c2288fe91408ce91166b5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6495924-dd8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653635723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635723, "uuid": "b6221884-f354-4d1b-946f-ba6e0beffeb4", "comment": "Malware payload (RemcosRAT)", "value": "0baac522d6078cf09ef82b1b9971faf8", "object_relation": "md5", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635723, "uuid": "9719be6a-7cda-4060-bfda-582254b38b64", "comment": "Malware payload (RemcosRAT)", "value": "6270f0d194fc82d5d6fca5ccf26a7b175cacd2e5d62c12eeae9e349ed473a8b6", "object_relation": "sha256", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635723, "uuid": "0784cd8d-5340-4c6f-bf6c-2fc6ab7a106c", "comment": "Malware payload (RemcosRAT)", "value": "2a0c7a8f894c919d4679386e9ce6684cfe3b6129", "object_relation": "sha1", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635723, "uuid": "d50e22c2-6855-4bfc-9f7d-490a9b14864b", "comment": "Malware payload (RemcosRAT)", "value": "de81ec844438a3578fce496b0cdf5e1c23500cd4f8bab8467a632ab2204b23f3948c0481bfc04aca6aa5a0e5f688ceea", "object_relation": "sha3-384", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635723, "uuid": "97a00817-3d01-4fe8-bce1-baf528ceec2e", "value": "T17ED42356A2C407D13408B84D2A67A90F2266FEBE669C1EFC1F9F9C17051735B8F909BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635723, "uuid": "5676d4e5-14c5-401c-be17-6a41c1195cdc", "value": "12288:pZwUdn7/V5RRq6rzfObrNED85h9gYd6++79+fTfMPVTATuL88jnO/cT:LJbV5RRqECN3T7dtu4fMPKTcnIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653635723, "uuid": "bc1247e7-c0b6-4486-9d56-ce93ba9300a6", "value": 611836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653635723, "uuid": "61fcf86a-5720-4b4c-be5e-fcfe0db6f18b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635723, "uuid": "a3210378-7be0-4ce0-9f15-dc823ae12226", "value": "BL-SHIPPING ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99f65cb-ddce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664075, "uuid": "e5d4c615-80a4-4c50-b080-8b480916528f", "comment": "Malware payload", "value": "15ec8fda6c191434841c07b919e45ada", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664075, "uuid": "ec84339c-1b11-4c89-bed1-29c47266eba4", "comment": "Malware payload", "value": "650c3cef83cf637c6ae2288dc789b41033c348f53ccfa48d78568e3957404989", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664075, "uuid": "2bb703dc-96c3-4b12-af25-89e0ef5805e4", "comment": "Malware payload", "value": "f1a773a6cc8d4a8817b756c85dc75c79ff9bc879", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664075, "uuid": "94fcb134-73ca-453c-8261-d0d898b19ec1", "comment": "Malware payload", "value": "d19a8a85b33a95765d080063512119a0fc79ab5fe8c18581aa8a84335ebe97b966236b98dc4f3139bfc86693dcb7a773", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664075, "uuid": "80e0d666-9490-496a-8b85-5b68359e8a09", "value": "T1F623FE7DF28B09888F4693B8171B2F81154CB51CF39995B236BCEB3866C5D7B921293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664075, "uuid": "a8405107-9b0b-4d95-ab02-906ba2451512", "value": "1536:c++uIeyKVlxhzGog2C2bWm6tp/AOHVGjdw:P+upyKVlxhFlC2bP6/AOHgjdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664075, "uuid": "ab7491fb-0df9-4fda-a4f2-c82c8239138f", "value": 49814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664075, "uuid": "c23ca854-8bac-4a34-b4cb-a02d6c5b3dfe", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664075, "uuid": "17bc1994-9cc8-42e7-b4b1-192094c3d058", "value": "Order 60092111.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3c11a5-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Adwind)", "timestamp": 1653664590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664590, "uuid": "236135f4-b28e-4621-8ea0-60915a5500dc", "comment": "Malware payload (Adwind)", "value": "aff165534b3617ccac2f4e4bd39a829e", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664590, "uuid": "5afa9ce9-24f4-444c-80cb-6a392d960dec", "comment": "Malware payload (Adwind)", "value": "65e2a6afcfc594dd137a600d982c90089218aedc1f448c3927123b986f3612c4", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664590, "uuid": "96dac221-43e2-4fc2-89ad-10401bb2293f", "comment": "Malware payload (Adwind)", "value": "bb6fe4612458041249cd6a039491f993d93dfc78", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664590, "uuid": "a0832ca3-0201-4c64-80a1-d194abe267df", "comment": "Malware payload (Adwind)", "value": "1098a33e0fd294a8e01964c7cf2a7ea68a96f91636beb092f203726b5c888700e584b79aeb12c99392eae765014f138b", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664590, "uuid": "a761c59f-8f2e-40a8-8244-9ca4cd307f7b", "value": "T1C74533787829D8B8FBC8F8B443C81C63D85F298D5D69F1AF8D1C95DA463B3D9484A4C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664590, "uuid": "459c33c5-c8fd-4191-b5a3-e1517f43337e", "value": "24576:M6HlQYWiLPlgzddNonvjcybAFA/ur1OiE7dHgQRdkHl0:hHlQYRDlg5ov5bAxJ6dkF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664590, "uuid": "e555eb35-653b-4672-b447-fcaecbb9db2d", "value": 1175527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664590, "uuid": "0004fb42-54c7-4d39-90c3-ed77a94f5c55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664590, "uuid": "8c926526-c10a-4e2a-8097-041072fd457a", "value": "Incoming_wire002120.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5aa6c4b-ddd3-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1653666162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666162, "uuid": "43c8b4ee-3ec9-48a6-bc85-9ae1dd72abfa", "comment": "Malware payload (BumbleBee)", "value": "46adbc221e64616309874c3bb4a43750", "object_relation": "md5", "Tag": [ { "name": "7lg", "colour": "#B0EE42", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666162, "uuid": "9d41f653-902d-48c3-b62d-ec12542881b0", "comment": "Malware payload (BumbleBee)", "value": "666a129f068842ce954380a6de2aa0b5b508f7ed76033c9a8baa48916d193cb3", "object_relation": "sha256", "Tag": [ { "name": "7lg", "colour": "#B0EE42", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666162, "uuid": "58d39d1f-13d2-47ab-b5a8-ffdfaa60a071", "comment": "Malware payload (BumbleBee)", "value": "875e1e8d3500df2d1f5c289e1ed2246b92a78e30", "object_relation": "sha1", "Tag": [ { "name": "7lg", "colour": "#B0EE42", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666162, "uuid": "efdcd6b9-337a-404d-8ee9-5f59849b5b8f", "comment": "Malware payload (BumbleBee)", "value": "d50c457618943c9337b88fd7ff1fea7471eb8464b568dbd93db88d27aa0e508ff327ad34ec1a5d2be5807390e6cd2c71", "object_relation": "sha3-384", "Tag": [ { "name": "7lg", "colour": "#B0EE42", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666162, "uuid": "1bff19af-e618-4a94-a62c-ea1da0131275", "value": "T121C5E1163AE5C179C25216308A5F5BF1D1FA92640F2308C727D4CF2C1E76AD6DA3AE39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666162, "uuid": "beb145c6-b201-4ac0-b408-5c709c253027", "value": "24576:uKvyNhXCV4E8BXAfrnkcAqU0AauGuQqgLJ0gkzDa9uWN/VcRgK:uKv+hyz8grnkQfkoXkDA/Vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653666162, "uuid": "04551008-2351-4e6f-a6d6-3157eb34e01d", "value": 2686976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653666162, "uuid": "115344e2-1a04-4461-980b-c327ea11a668", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666162, "uuid": "9831e376-f09d-46de-ac74-86d52f15485f", "value": "docs-0522224.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79e26c3-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1653664448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664448, "uuid": "6b28de91-c9bc-4382-a175-2ec570529998", "comment": "Malware payload (IcedID)", "value": "a4672650fc39d75e831b064d2feb8718", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664448, "uuid": "de07aaba-06e9-4fb7-b3a5-ee0453fe9d7d", "comment": "Malware payload (IcedID)", "value": "666c92eb5fd83de4966fc5e87ccfad9069119afcf6952df024f909d5bec121c9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664448, "uuid": "e51f8545-f118-43e1-8b78-a736dbcb6630", "comment": "Malware payload (IcedID)", "value": "6e1ef6313ddcbdf804f5a7a6f734908e026e907d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664448, "uuid": "1845bff1-38db-4c15-994a-1e8839fe1617", "comment": "Malware payload (IcedID)", "value": "df58492263ad072f081c5f7f2656ae519e77242f7fcef391852dae8b0d0087d417e0df6c7672c7af39f6baedfee79d1b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664448, "uuid": "309a0cd8-f25a-4a47-bef0-45a8f0aa9fa0", "value": "T12771DC28CFF045FBE2BBCE7D55EA266D9FEFB90794184D4E1080038508B05C5E815B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664448, "uuid": "f5a6b2a6-cf3d-4c4d-80bc-4550e8250839", "value": "48:8nLe5o0m7PpJQtfVykYnG6snHzHha4yxZsW1WH/dJ9caeA:8LmoTbotykYnG6sHzBGZsWsrCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664448, "uuid": "f7e36690-a920-4324-bd81-a7ff91c2e5df", "value": 3485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664448, "uuid": "c7eadc68-838f-45c5-9805-d69356714250", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664448, "uuid": "f93e7857-7e67-47e4-b24a-4f5c4033d1cf", "value": "90-868-7656.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59917fc-ddcc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653663263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663263, "uuid": "b7fc1b21-9cbd-4616-944a-af22a34a22c5", "comment": "Malware payload (RedLineStealer)", "value": "522bb6bd6063c36394b87201c8eb53e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663263, "uuid": "7e298112-0d60-4852-99e4-a5af9f2c1ae9", "comment": "Malware payload (RedLineStealer)", "value": "66883e0b51e1f34b1fba6555dff3e50559b1116c353b2579f94314000f6742ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663263, "uuid": "24a8c62d-2309-4213-9017-4cbddedc85db", "comment": "Malware payload (RedLineStealer)", "value": "15c11e465f0492ca69416243e48b709111030c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663263, "uuid": "861b6c67-16c2-47dd-a050-52af1e0c6a92", "comment": "Malware payload (RedLineStealer)", "value": "7048a4a22577d9f0ea1deb4126b19ba453cc34db3f3b5d9168fbfd61ded3d73203e980d7759121c26e4ab6999a38f323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663263, "uuid": "3a4ee9ac-b850-4528-a56a-e0b0232fbec7", "value": "T1B494AD20BB90D035F1B712F44A7A9368B9FA7DA16B3450CB62D426EE1E356D8DC7130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663263, "uuid": "a536f845-0855-4144-8df1-4077199d4fbd", "value": "f7252dd48caccbbc5da09bec4657c48c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663263, "uuid": "1a397492-555a-4de5-8bcd-4491695294ff", "value": "12288:zDXIJeL8zXFxSkBAq7xDkNs+39ivpmfTqp3hPw3:vXzYFrB+Ns+tq4sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663263, "uuid": "a917a4e5-0084-4617-853d-40853ecf331f", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663263, "uuid": "e527c84e-c127-401c-8a29-19fa4ce7b64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663263, "uuid": "6aca6ba4-a677-4ca5-8b23-848c3df6e5d1", "value": "522bb6bd6063c36394b87201c8eb53e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543598ab-dd90-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653637249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637249, "uuid": "61561e8f-f44b-40da-856b-0c5e565c6e83", "comment": "Malware payload (Formbook)", "value": "cd7e54565ed721eb62210a426caca324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637249, "uuid": "8a17a48e-591c-44fc-883f-73e74cc01f5f", "comment": "Malware payload (Formbook)", "value": "669281f9aa118bef43b360b346e7954d6e1e9f04da0c8bff68387a2730c8e928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637249, "uuid": "775b963f-9ff0-48ab-9214-452b381a5d11", "comment": "Malware payload (Formbook)", "value": "96c423fcfd3c72ea24888889e03863936498f4d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637249, "uuid": "9a080519-a2ae-44a0-bd89-2a0df0c412dd", "comment": "Malware payload (Formbook)", "value": "b61b2c896d5db59e6b9b1da61ff5bcbc57856b7a71a4db59dd1f73030cf922ed80292f9d2b70b7314b338f84b7badb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637249, "uuid": "45ccf0da-cb84-4e51-93f1-8a71fe70fac2", "value": "T18BE4F110B2F81B21E6B967FAA970518407B57DA56930F34E1CC278DB3A71F918E41F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637249, "uuid": "0dc965a4-f01b-475b-a30d-f7a8dda76144", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637249, "uuid": "b640b091-8d5d-4440-bca1-71b5d3efb488", "value": "12288:0vFv82s9bHoAUJvqV5d6qyKhqRulNUGgK/KVUESMTTpD2t+JEGDz1i0:qFvtYbHomV2kfXXEJTT12t+CGv1i0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637249, "uuid": "9134e7a5-07e0-4092-bdf9-96f622de9bc1", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637249, "uuid": "c0f4baab-bdbb-4e61-8962-5537f295d304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637249, "uuid": "efd57efe-1f0f-4644-88fc-c7005a88424d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.15990.22942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f415f04e-ddca-11ec-8e58-42010a9c0032", "comment": "Malware payload (SystemBC)", "timestamp": 1653662428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662428, "uuid": "106f0d24-a450-4b4c-8724-57384292dff0", "comment": "Malware payload (SystemBC)", "value": "3755a807810b183f2e789b6c83bb8b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662428, "uuid": "7acdd7d4-eb54-40cb-a54d-31cebd92d49f", "comment": "Malware payload (SystemBC)", "value": "66b27059ba8fcb7e8fd04f8f53296dc317478e243ad29b2020600d7deb2aa94a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662428, "uuid": "7eecc64f-b7e8-4ade-bab3-c79f38dbff19", "comment": "Malware payload (SystemBC)", "value": "de9e9f0fcc038efeb89ed82d1b25bd429fdcab49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662428, "uuid": "5c52ca6e-5938-46c4-b5ea-16f43df131b1", "comment": "Malware payload (SystemBC)", "value": "0c0f384e71eab6d0b65b7266cb4c760369ba06302b6384dcdd9d34077b77dc0af2afeb090700a1000f8dbe4c3c4e34dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662428, "uuid": "98028937-c0b5-406f-b9bf-020e6defcf32", "value": "T1DC449D01B790D035F5B726F849BA83A8B93E7DA16B2051CB32D52AEE56346F4EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662428, "uuid": "d668100f-24da-483c-87a9-b6bf4caba796", "value": "8e9155e61240efc293b2b80077b26959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662428, "uuid": "f4764548-71db-4756-9af1-6c4029f9a1da", "value": "6144:mlTzHjhCIHwNO47E0lG0kHMWxAvT0RrlsZTgL3:wT5CIQNO47ERBsDTM5sZM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662428, "uuid": "ce8eaa77-fcf9-452d-b442-d7052553b68d", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662428, "uuid": "7240231c-3e1a-43d6-ae08-ed333a8773f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662428, "uuid": "51060e22-ac71-4bfb-911a-cfc21fbbaa15", "value": "3755a807810b183f2e789b6c83bb8b8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74138b0-dda0-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1653644368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644368, "uuid": "6aa2aa23-03f5-4a6e-b732-1daf7b1d3579", "comment": "Malware payload (SilentBuilder)", "value": "19b4bb88218e8f429aa3e1d0dbf3def2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644368, "uuid": "738a764b-3f94-4ec2-a268-642687f5ce26", "comment": "Malware payload (SilentBuilder)", "value": "671d3228293fc26c11e0e83b10f16b07185ad3c2d92d778beb16d8c12ff91374", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644368, "uuid": "f434c8d3-e24f-49d0-8c19-fa260dbf3845", "comment": "Malware payload (SilentBuilder)", "value": "90d4e0ece34079ff1ef9003a696f9c080d19fc03", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644368, "uuid": "0f1c8de2-87d3-4f60-a181-f5ffe6ad0df3", "comment": "Malware payload (SilentBuilder)", "value": "f4740a1f63b7e25a563ef17383a5cee3fda9c96b6f52576ce708afb44d5b6d45fdc04d90f22f805e8c753efed36ac3fd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644368, "uuid": "11183af0-91df-4736-bd60-a0a2159bc426", "value": "T14C634B59B769885EE9198B3048F747D66323FD308F5F0A433259F3926FB95A0670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644368, "uuid": "9e19e074-5bac-47d4-879f-4b6d15a55e7b", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+/+hDcnTLiQrRTZws8EbK:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644368, "uuid": "21b9ca2f-cc1d-42b6-b398-69ba8ac7d74a", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644368, "uuid": "3cf80558-af79-4233-aa1d-7640a420f1a1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644368, "uuid": "de8c8b2e-f095-45f3-a032-ef957b5570cc", "value": "pack_052896940369.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe90da96-ddcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653663735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663735, "uuid": "687693d0-98e4-4927-b4fc-15e48c873a12", "comment": "Malware payload (Formbook)", "value": "caa4c5d863a9324fa6b3a735ed446897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663735, "uuid": "849d2cc0-9933-4a94-a8e4-45689dfb835a", "comment": "Malware payload (Formbook)", "value": "6796f10e7f6140f26a49bf9446b2c75dfe0e6dc7d7d88cad5e09d9b608107851", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663735, "uuid": "68adbda2-7ee9-43a2-90f8-70d5bc83bd7e", "comment": "Malware payload (Formbook)", "value": "003348501064dc5646b19019592f8aefa4b44f5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663735, "uuid": "0f143143-4ca7-4aa9-bcab-d0e5ffff7d8e", "comment": "Malware payload (Formbook)", "value": "e150bc567818e053a92ee4e6e7a1466c86027b6f97ade00388bf84bd02d3d1ddcdc16c3e3244bd9ee8ccb36c026b3e5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663735, "uuid": "c6526a9a-86b9-459c-8127-869eaac4a7a1", "value": "T1F25413663DE060FFF64104B30A33CB2A93775E151521A51397723FEFAC2A0DAA5263D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663735, "uuid": "0d4e4447-3358-4a11-b12e-fe24f3687cde", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663735, "uuid": "38c3c106-cfd7-4493-9fa7-1332909d99af", "value": "6144:B0Ym483boybmrpR0iOITP23OHYx2tF7G2vd5EtPHuwQOEi:q3EybmrrpTUjxyF7XvrEtPHhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663735, "uuid": "d90cb2a9-5fda-435f-931a-4395ab106b22", "value": 299086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663735, "uuid": "f534ead6-0d22-4b80-8eb7-860aeb974fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663735, "uuid": "e50d4489-8c55-478a-b374-f8bd24f8eb19", "value": "caa4c5d863a9324fa6b3a735ed446897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534e7994-ddb8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1653654428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654428, "uuid": "cef34fdd-d396-4eed-b48a-6a882a3d2a30", "comment": "Malware payload (AsyncRAT)", "value": "e1aa44414f4b639d4ebceebc2a31d09f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654428, "uuid": "97ce7efe-d12c-4ed5-8df7-3c18d1453157", "comment": "Malware payload (AsyncRAT)", "value": "683012c8d5ce11683ac133daf739884f34c99f9b99a3a8e0a8c769ac90c64453", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654428, "uuid": "a53fdea6-d056-4af9-8b8a-ec527dac4cbb", "comment": "Malware payload (AsyncRAT)", "value": "093d3f98be31efa0c924f5cc1f961d491adddcc9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654428, "uuid": "fa014799-e7a2-4d53-b1bc-f7315a0ff44a", "comment": "Malware payload (AsyncRAT)", "value": "f0c3b0b9c6c06c370b6fbfaa8f40a25a217e211c500527c92e78533f5cc1044004a46998a53a638ffe245dd1342ea3fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654428, "uuid": "5e026260-8674-41ed-9972-7cfd9ac9be4b", "value": "T130840258F894664AEE8DCBF14E04A9BD063895A1120CB3E04337BD4B7713A797AF0F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654428, "uuid": "92d46333-14ae-4beb-a0dd-90c297323504", "value": "1536:JeosT9boksZseCDuC8Zj3jMBVVYtrov1c5vsbbPd22txYMkd1fYguGQ6tZMCc:XsT9vnKC8ZjiKoGIbPwVd1fYgxfMCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653654428, "uuid": "4280c3b1-d384-4867-b4c0-bd919605a88a", "value": 398511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653654428, "uuid": "a3920f10-6aa9-405b-b8f1-4b45c4607f34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654428, "uuid": "ceda5509-a214-4e3b-95bd-6a0a5dc1d39c", "value": "INVOICE-E609HJSAWRPOKA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71213da7-dde5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653673805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673805, "uuid": "32730bb5-f02e-49fc-a9f2-3cc9f7dc4293", "comment": "Malware payload (Mirai)", "value": "de4287d3d34ef4007b3324db376be7bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673805, "uuid": "58b7dc5c-8eeb-450a-97a2-c3f2b2bb5e8e", "comment": "Malware payload (Mirai)", "value": "68afe620877b71aa6b93ae6529f0b9bc52d5b28fb8c1c3487cfb9c3c94f05d52", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673805, "uuid": "80eba026-7794-42bb-860e-162e2a5d29c5", "comment": "Malware payload (Mirai)", "value": "28d24ea33e17190cdd8769960bc48b68a59df8b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673805, "uuid": "ddeabbdb-71da-4b93-bab7-d3f1aa07343a", "comment": "Malware payload (Mirai)", "value": "e065677fa5e5acb74607cdbaebf16523957a072ffdc082081678484c157b08c53f2fdca1b7fa421c09ee0e97d57af348", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673805, "uuid": "b7685a87-4f14-4fb4-b179-c1eb780d9da1", "value": "T151734B45A680D6F7D14306F1069BAFA8033AFD3A1ABBEE85F3587CF48B710847925719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673805, "uuid": "3eff1d75-e560-4ac7-9006-dc3469ac739d", "value": "1536:8/4Mws7y6stOSV9zyjeYwMcp5WLfuBs1T2T/O/sFw2U09RLZ5:8/l7x+R9zyjeYwMcmLfGSTu/vFw2d95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653673805, "uuid": "9e99731e-88d4-42aa-8f86-324bdd6adcf0", "value": 74492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653673805, "uuid": "de37100c-2f97-428f-8de5-2793bb6913a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673805, "uuid": "1e2e1401-a614-4181-9b9d-f6734abf41a5", "value": "ftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40e2086-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653676468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676468, "uuid": "8b79c9a1-01b6-4c14-a998-036652dd1f64", "comment": "Malware payload", "value": "5d43ee8b1589f21a8e883fe3670bf226", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676468, "uuid": "b7234cf7-fa19-4f2e-8529-78213d81882f", "comment": "Malware payload", "value": "695be1aadcdb760c8d7ac73563e4e5d41edc809ca60d9c4b57435a6971325469", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676468, "uuid": "8e9ce1dc-62f6-43ad-ab1d-170155d33129", "comment": "Malware payload", "value": "a3cb9316c93e79fff91b3d16ee886bdd9a54ee85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676468, "uuid": "776c91e2-c420-47f8-a60d-7237cf6391e0", "comment": "Malware payload", "value": "fb52b9e39cf52a87893f93e606c82ff0ecbecb8bab11dacd87bdf514eabf465415688f1a0723254412785c09e3be5615", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676468, "uuid": "6a33eae9-2c98-43ad-a0d7-2d6bdaf1232b", "value": "T1518502857ED48CBDE9A10435CB60665CD8ADFD63BF9A41CE6364882FE8F5083293716C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676468, "uuid": "180e5361-620e-49c5-8c55-5651294cfcdd", "value": "033fc3209214566af0e06e5863a94256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676468, "uuid": "318b1892-10c7-4c90-acac-fbd6878d485b", "value": "49152:/eZBYBfJXAE6k2/ll2w6PZABeaofAr9BbgzKaosSs0EQz:/eZBYBfKE6/P2PRkeaaA/qKeZQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676468, "uuid": "5ced1097-b045-4d89-a9eb-85d7fe9f42a8", "value": 1755098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676468, "uuid": "a88fc0ce-4236-47b3-8924-4f9cd2a04ef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676468, "uuid": "2df48f53-1140-4568-a3c9-8734c86598cc", "value": "5d43ee8b1589f21a8e883fe3670bf226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771dc161-ddc9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653661789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661789, "uuid": "0544dc92-0312-460a-9715-38dea14e2995", "comment": "Malware payload (Heodo)", "value": "c0d6c222c46b32475432a1711d20bfa9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661789, "uuid": "247828c9-e3dc-4e63-a085-8fc70d81c0f9", "comment": "Malware payload (Heodo)", "value": "6a019d9ea2048f251a840b1c81d5d45cd2d7913cfb643a3c59412f9b78756adb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661789, "uuid": "25c0063d-20cd-451f-a681-de0c03a64c2d", "comment": "Malware payload (Heodo)", "value": "32a904a6cad32907fe11743b3931d84a3fe55e6b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661789, "uuid": "16664a67-51ab-48f8-9020-ebdf276a6973", "comment": "Malware payload (Heodo)", "value": "8b0142649caf4343f888330cd23b8a220c89756dac97fb5eab63b46382523fdffdde4652dda94dc2e2d17062f236fdc2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661789, "uuid": "f8f54460-fae3-4d62-bf09-6c58ab6f60e8", "value": "T1A2E49D01F2AC80B2D06FD13989A34A4AE7B13C9497B593CB5251FB3A6F732E15D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661789, "uuid": "55d8a2d1-2d5c-451a-8c39-817556ef5e6e", "value": "b7b90674fa6c5f9a16bdab0725f21bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661789, "uuid": "b64c99ce-ea99-45af-b712-1c7babbc922f", "value": "12288:8nUIW4anSDGCH0fu1QJKw7be1gUK7wrnUfpE:kUITnGCH+u1QJKpCwrUfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653661789, "uuid": "600e5d71-6ae9-476d-8184-3e2dd45c05f8", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653661789, "uuid": "09437802-d361-4d92-8f9d-701b1824718f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661789, "uuid": "60cd0ad9-4a9d-4a8a-8330-142c70fcec6f", "value": "64bitemotet.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487a82ab-dd8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653635512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635512, "uuid": "0be2c3ab-81b9-4272-8321-d508e6c206af", "comment": "Malware payload (AgentTesla)", "value": "cfaaf6754ca0410551f5c0e2cd763a2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635512, "uuid": "b3a788a4-354b-4c1f-9880-9dbf5f228460", "comment": "Malware payload (AgentTesla)", "value": "6a17c1ef840f2bff50ad3300e452b4442a3762f6f772129b7eadece5731cbbe2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635512, "uuid": "23b07f94-48ee-477d-a493-9f9e73be65a7", "comment": "Malware payload (AgentTesla)", "value": "3c4b1c678af5dda27e15b2ec4be9b507676a276a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635512, "uuid": "f2cd56dd-2d67-4e20-8eac-dd8003dbb74a", "comment": "Malware payload (AgentTesla)", "value": "c490391daa96327a98c9b7639b0bdbc448c5bdeeed6b13d9cf54eec3fdb425e043ffff114f4e68a233cfd67250e68855", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635512, "uuid": "669e7948-14ce-43b7-ab88-f60432948ce2", "value": "T1EFB45A0858D1B4FFE95D5730BA7270C038A79D653824909E032FB9DB8A399FBA1B6017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635512, "uuid": "0a905182-9f08-40fa-9738-ab02095c96a4", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635512, "uuid": "22e26139-3097-4011-b3bd-c5f766886ced", "value": "6144:a0YjMHIPKmhjMnbT4/FlrBBgaS8G3C9KwOV6c+mIpMiPZPwmWffjuXx2hk:KMEQnXWFlr3gV3+OV6c/IpMC4mCa0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653635512, "uuid": "f103401a-1f93-4eaa-91ed-087935782aae", "value": 526363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653635512, "uuid": "e5f6fce3-7825-4f33-8e02-ecb9e4f0ed3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635512, "uuid": "1d73cbd3-0500-48d2-95da-b7be52b2ef41", "value": "P2D00976543234560009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f90976-dd9b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653642250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653642250, "uuid": "489f611c-e3f2-4023-9c62-c3a0433d5cc2", "comment": "Malware payload (Formbook)", "value": "bd929543f251601313e4792f143419bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653642250, "uuid": "c8d06361-aaf8-4136-9f4d-e0213dd52c60", "comment": "Malware payload (Formbook)", "value": "6a4dcd405fe4ec854fd0bfa69f852b2a53e4cfa8bed45c7affeb4f86e963cb08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653642250, "uuid": "18e73c0b-34dc-48da-87bf-b7f914874b4b", "comment": "Malware payload (Formbook)", "value": "4898a5c0ab8f310868c55e50a15e1e770c216ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653642250, "uuid": "271049c1-bc1b-42c2-81bd-128d355c0374", "comment": "Malware payload (Formbook)", "value": "9a3b09d66022d37121d82892f3e1516436bd6ace60974d8f9bd1ad352d8897988cc2e9c07b56c983f35c5249dcd9301d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653642250, "uuid": "f8a29a90-22b2-4ded-99f5-cf02fee23f38", "value": "T1D8949B362C739046FEFDC2387CD17390522879BE9CC91F86E644BAC971B72E6A270561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653642250, "uuid": "c0e79c5a-0e92-490d-96ea-9b65d3805396", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653642250, "uuid": "78914cd8-babe-4aa6-9fa1-c9d9a54c5040", "value": "6144:O0YAKBlKeOKBSDYCmhb/aQb6iQvBZfx01jOEnhIK:M75BSDWNdQvx0znz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653642250, "uuid": "52418d65-c978-4619-a5cc-a50825930571", "value": 428856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653642250, "uuid": "87a424f7-2387-495a-b026-24073700bcb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653642250, "uuid": "047a10a5-4695-4697-8917-cb1374a2104f", "value": "swift copy 6209143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e676578-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653664781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664781, "uuid": "c99f65d8-0e16-4c37-85ae-4cf45032b411", "comment": "Malware payload (RemcosRAT)", "value": "13e2911ee39aec09acabf5c4c6086830", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664781, "uuid": "1fb7f0c1-87f4-4ca5-bce9-dfa7fe6ad1dc", "comment": "Malware payload (RemcosRAT)", "value": "6a7131d594942655079dfe9d3fcc6f21b6296c19ac0e5e5d95090375a0f8f069", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664781, "uuid": "14dd55ac-26df-41b2-bc68-7083b2829619", "comment": "Malware payload (RemcosRAT)", "value": "1c6800d1ef96d43b4e7239a39586e811ec511ed4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664781, "uuid": "b8b612b4-77ea-482b-bf28-fb76caa9b519", "comment": "Malware payload (RemcosRAT)", "value": "6cc5a555e6afb8c124dc42da8cbadd17ac0071853b2ea5a9cbeb6f14441f09ef2d7bb0f246529bdab78fd1b6af130359", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664781, "uuid": "4bd9f159-3328-4f93-9c97-5272de1275e6", "value": "T1764112DE7507A420AD0208B2ED0B145E79B15303A27A95D0BF24DEC45C75879E347D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664781, "uuid": "0b47476d-8ca5-43d6-9374-2115a5f4fe33", "value": "48:Ly+zKcUNLwqrndRMDm93hM54gJT8kn8KidQ0dYK0qIe/IzLL:e+mDNVrndRMa93gJ4k8K90p0qIsIzLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664781, "uuid": "2cf52da0-ebea-435d-849e-cb5cb7594481", "value": 2304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664781, "uuid": "13bd3d0d-6214-449f-8fc6-afba707c3f81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664781, "uuid": "732ea483-ae59-4e01-b425-9e193c01da83", "value": "MV SHIP Cargo Documents.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983d2328-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653665281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665281, "uuid": "753d1711-62f2-4d85-a6cd-130692c8e8b3", "comment": "Malware payload (Heodo)", "value": "2e11a95599d747abb6da4a978e3b80ee", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665281, "uuid": "10d52b91-b8d8-40eb-a675-1d67b6c9c7e4", "comment": "Malware payload (Heodo)", "value": "6b259cb0fa87c6b05ac15326cce05149c7e9c44d5d04a9d05e110599fb82c60d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665281, "uuid": "694594c2-4326-429b-a078-702bd4119c45", "comment": "Malware payload (Heodo)", "value": "f444b754e147c213232540369c9086b8cea85caa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665281, "uuid": "9b6f516d-a979-4241-8ba7-7c6c6a4a7383", "comment": "Malware payload (Heodo)", "value": "1b8d5b7b053f27382dd3dd3a4e75e7172a88240d1abcb405ab73d6d172de08f0cded4903de708623b472c73ff42ff3b5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665281, "uuid": "a5e850a6-f00b-42fb-bce6-3e8d433ff471", "value": "T1C594CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665281, "uuid": "6e66345e-97c0-463b-8dd3-40bc6eb01046", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665281, "uuid": "fd62eab0-a983-42fc-b0b0-815c456f2dbc", "value": "6144:I9wEpo6/4WaPgMIuxqqJAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqJAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665281, "uuid": "e7d04095-0f2d-4f18-94c2-d92495073031", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665281, "uuid": "bc243702-3095-4cad-97b9-8f75bc2844f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665281, "uuid": "4dbdda99-9b20-4c63-8dc6-ae9dccea6973", "value": "2e11a95599d747abb6da4a978e3b80ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3682970-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653643959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643959, "uuid": "4dd799bd-813b-43a4-aec7-8cc8ea5f3e88", "comment": "Malware payload (Mirai)", "value": "376ad57cf2b182915c6406fc09268968", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643959, "uuid": "13870483-6a8a-40e7-8e3f-19de2f447dc9", "comment": "Malware payload (Mirai)", "value": "6c47ca46c555299c33e44f0db3a3efc886b2d2aaa9a8a865a236d3a80a36b8aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643959, "uuid": "2bb79c09-c934-4abf-8b65-b9f56d04fced", "comment": "Malware payload (Mirai)", "value": "21217f2f50c79b3dea0a6f0219644d21d3dfc557", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643959, "uuid": "4272e24b-3903-4bfa-9b91-ff0fc5cfda72", "comment": "Malware payload (Mirai)", "value": "06963f4de47bd340a6e16ccf84a4df04e31034c04c78af6c7761dcf9fd234079e6d00e573c61722ea34d2e0d76feb15e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643959, "uuid": "9cea53bf-732f-420d-b7f4-27c6b5dee01d", "value": "T1822302816BC394ACCF44D4BFC97D904DF73F95988EE9DD502438D7B0279202996E42E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643959, "uuid": "21619111-8344-4080-a4af-9e553e0e4837", "value": "1536:c9Afe4Si20ChlEsk0K4FdP9Y6zYm5ZGG1p:7feb7k0rf1NEm6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643959, "uuid": "89e48248-826f-4f02-b5af-2789b89dfcff", "value": 49584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643959, "uuid": "1d8cd257-b388-4079-8426-57c7d29383e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643959, "uuid": "05245d53-630a-4670-83f2-6e69f8639baf", "value": "376ad57cf2b182915c6406fc09268968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d04f89-ddbd-11ec-8e58-42010a9c0032", "comment": "Malware payload (GootLoader)", "timestamp": 1653656840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656840, "uuid": "2d42b21b-3cc7-43a5-bafc-0f20401d960a", "comment": "Malware payload (GootLoader)", "value": "4386ec889f6c515bc546df0ca408d1d0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656840, "uuid": "c278dc39-18fe-4a12-85ea-edcf62a5e31f", "comment": "Malware payload (GootLoader)", "value": "6c4bc6376afa8933e2556c688ec911642bcd86d44120cdd69240f0197fa08b9f", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656840, "uuid": "e59ab99d-6426-4d59-8bb5-74efb3187073", "comment": "Malware payload (GootLoader)", "value": "ddfb10ef616a2a18baa25a8c25ac4f3e2b4a54f0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656840, "uuid": "c62ac296-044d-4b06-839f-91aca6a4fadb", "comment": "Malware payload (GootLoader)", "value": "29960b84ad59a7bba2a8f214c8b83dfdbe286a2bdad5152c6f436169bd7c1bbc1fc233c1b45247f03642f6f2998dadd5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656840, "uuid": "98ecd4fb-e8d1-4550-8025-6894e7fc118f", "value": "T164B4E588A18CBE8EDD574F1CE26DB02F818D3A76CED0FA6586626713158D180DF1E53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656840, "uuid": "5b0eceab-2f47-4103-8ade-b5795949537d", "value": "6144:4mVpTlBp2sh4jXczJ49xNLNiGo67fl7MpHGXaOxcSBkJTf/zzz2zzzzZbPrYzLqz:FB6jXpIghwGK27CJfZLqveC1z9/cSCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653656840, "uuid": "57629361-63a2-4bdf-886a-a85a5a265837", "value": 518223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653656840, "uuid": "d6e14a01-8389-4337-a3bb-42d45c86c052", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656840, "uuid": "fca9afa9-53a6-4fcf-8588-8f30c59ba581", "value": "gootloader_stage2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcabf4b4-dd8f-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1653637049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637049, "uuid": "8e40daee-fba5-47b3-98c8-a5fc4f4be64b", "comment": "Malware payload (NanoCore)", "value": "54cc9f33b786a68c6c3a13f4503ab3d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637049, "uuid": "f42086ae-5374-4ec6-b863-1136a9da7931", "comment": "Malware payload (NanoCore)", "value": "6c69baf4325940c41443d804a3a6da3c29a96854d7d1e423abf7482143bbd100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637049, "uuid": "9ecdec58-4b6b-4173-af6c-1c30b37c8b8a", "comment": "Malware payload (NanoCore)", "value": "845c11a6c8f090c07dcabfab80ad0ce295411a00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637049, "uuid": "3dade081-ebe5-4ed9-aa2a-8d3915890be4", "comment": "Malware payload (NanoCore)", "value": "8e66412ddbb703c471bc89800178f4eb30228b1958680caeafb7be53e2adc369d99e177396250cd83cab07cfefcd79c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637049, "uuid": "3857395a-7f37-4651-9869-11f33baec9f2", "value": "T1C7B26215DF8C4E35DA2636F29B33F24102799EC259568B5C24E0305A9DF2FF40E7E564", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637049, "uuid": "00733fb0-e1de-4d02-bb48-3113f17549b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637049, "uuid": "dc7bf970-cd67-4f52-b6c1-68cfd0f0a1ad", "value": "192:EhtqVPIW9dIoG9VUP8h6gTJiwWswJllllllllllllllllllllllllllllllllllB:EhtqVPRd1GzUkh6gTJiw3qsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637049, "uuid": "4cf682b0-8089-4cda-9f3e-f040f84fab2a", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637049, "uuid": "60f449a2-545c-4ddb-bd6d-6896dc8d2773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637049, "uuid": "d9cc610b-b038-48fa-be85-054fa3d49711", "value": "bankslip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa3b195-ddf0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653678527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653678527, "uuid": "776fc313-0b1f-467d-9545-ef185c4b5f57", "comment": "Malware payload", "value": "4fca5bb9b6a0d0a9e2fc850667aed976", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653678527, "uuid": "cc22c6a1-780c-4549-bc4e-ae4685c18f43", "comment": "Malware payload", "value": "6db24413c4aeb3fa5b4ac1bb5abdb5723e1879f8f64878327f6c05de0f7bb01c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653678527, "uuid": "d35d77f0-d05d-4c59-a15a-b9d5a3d47aa2", "comment": "Malware payload", "value": "277239c4c0ccd5327d651d14503243c113f9d064", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653678527, "uuid": "b0eb5e1f-1fc7-4702-803b-207faca3f5b9", "comment": "Malware payload", "value": "5070e21e4172b4f4e0e14ef48338de28f9a0d2f093702f6b25ba9d9b4133f1246089638b10352a78e410c6dab9b4f72c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653678527, "uuid": "91e49074-9f74-4afe-b6cb-a288818a54ce", "value": "T12B849E147A90D035F3B712F4497983A9752EBEB16B2441CB62D63ADE6A353E0EC7031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653678527, "uuid": "04c1bf68-ea4d-492e-9451-6df67bc47041", "value": "57832fbf5050813adc73eaabe334c13c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653678527, "uuid": "278f94be-fe07-4d43-8b53-1cce0209b41c", "value": "6144:kMa+tJJEyXvhK0V8i5vlrhf4hYWrm2NdBr8UsnxhsrIbU63VwS+GmGZP2vu:kNaJEaZzVVvlrcVrm2Nd98UsxOUZ3z+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653678527, "uuid": "e24fd8e3-ab99-40da-881a-778892bef4a3", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653678527, "uuid": "451ddabd-9460-4fa8-9740-94a12cd18941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653678527, "uuid": "b3efc13c-4ab2-473e-a5fd-ed2509b3afe7", "value": "4fca5bb9b6a0d0a9e2fc850667aed976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7b1727-dda1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653644488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644488, "uuid": "e23b1399-88d1-4799-ad3e-53b68eb5b66a", "comment": "Malware payload (AgentTesla)", "value": "77ea38476ec21e3b7cb1e84ed67578b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644488, "uuid": "80c0f69e-e752-4643-a517-22969ad32d08", "comment": "Malware payload (AgentTesla)", "value": "6e2d35b073f3f17091cc5c4735cb29ffd4929ea960672da79aa10d1f6cfe3641", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644488, "uuid": "a46e11cf-b04a-47b0-8ee7-7a3e6840f9e6", "comment": "Malware payload (AgentTesla)", "value": "7d0fc914c3e3189a9a9c9e9f4852e0c86b89aefe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644488, "uuid": "deab4603-dd67-4f58-acbd-fbcb2367db6d", "comment": "Malware payload (AgentTesla)", "value": "fbb967dc2852a2cc2798da448893b6753e7c506083ed84c9e661bbb9664098ffb2c7e3835e882431af677cff73c90786", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644488, "uuid": "352750c1-3504-432e-8c37-b45603dcf82a", "value": "T12DE4C031765C6E01C93FCB7815A1D61C03F48C0EBE27EA0AADA7318E9571F959A33927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644488, "uuid": "17e812ed-dde5-4dcf-9269-c3588a4ebf18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644488, "uuid": "f977f7bb-4355-4efb-aff4-2da07eefe79d", "value": "12288:Z8bqvtLPxFln8QmiDKWUrl91L70guRgwyOg:sQBbln8ED9Urhsg0gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644488, "uuid": "64ca9874-d692-422c-adb8-25cfcc524b53", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644488, "uuid": "61ecc366-8382-4ae0-bf5e-6be35a7dc61b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644488, "uuid": "ed94b580-fc3b-4346-8bb2-ea5cb26ee195", "value": "Payment Transfer Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af05e32-ddee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653677580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653677580, "uuid": "216b6c91-1783-4b05-9078-2f1d65cc3785", "comment": "Malware payload", "value": "c07f6f97c1fa66b08bc7d599c872d0c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653677580, "uuid": "1de67940-ad0c-410f-942b-ca2d821d0ed7", "comment": "Malware payload", "value": "6e60f3dd9dac4be1fbeb15c9264c26c087c2af426fbfa00cbf663d178a2cacbc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653677580, "uuid": "537bda0a-dfac-4e0d-86c8-60a4f206e7c2", "comment": "Malware payload", "value": "e51fcd7666b73c081159f4b277dc024a35f77cfe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653677580, "uuid": "499630fc-775b-47f3-8676-214f2790fc43", "comment": "Malware payload", "value": "74185d7208749c9e8dd34ad8d79dc81e2474a231121119143ce36cd9fa176b9c509bd2440303f24f2510279f1fe94556", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653677580, "uuid": "cc726511-f602-438f-b221-3d63ea4e2876", "value": "T19CE62035F7E6F0D319D0125BD952F5DADFE3B898DA45B8069488B81A198F830FB784B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653677580, "uuid": "c853b4c5-ee42-49b1-a1cc-a29da7f44103", "value": "196608:3xze7ZzfdYXaexEipXL56QK+zuJ/fq/FG/e8CKu2wJZ34PhprTaVRTlP4IyLtsNz:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653677580, "uuid": "3973843a-0cb4-443c-9415-dca2daa7187e", "value": 14084165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653677580, "uuid": "018e1eb0-01b8-4887-8684-766e4065be65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653677580, "uuid": "64cfb169-c4ef-4ce8-97d9-641429ebacbb", "value": "05272022_26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5557fd13-dd90-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653637251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637251, "uuid": "19f91aa7-ebd9-4e4b-8ebc-d7ac209ea393", "comment": "Malware payload (AgentTesla)", "value": "bf892693a04d0426199459777290fdbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637251, "uuid": "c47c8a9c-341d-41fc-afac-0bb9be8e1a68", "comment": "Malware payload (AgentTesla)", "value": "6f82392779c3f02fd6dd5e633bc69b2c2706e2907f4045733c2df46bbb3353ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637251, "uuid": "c12b525d-0909-40e1-9451-d72446b05097", "comment": "Malware payload (AgentTesla)", "value": "ea5b762b8ff74a2cc579ca74b21661e4c8ca3fc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637251, "uuid": "2b728f70-39e4-4383-aa49-9333282035e0", "comment": "Malware payload (AgentTesla)", "value": "25340f2cdba30876b97a4c2cc86c82828fbba8cf95c1e94ddf0b060244e6fbbb5f558f0f45af7ec099ea21ac5e740470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637251, "uuid": "477a69c0-a8ab-4e11-b854-39c9d8871bc0", "value": "T12F15BFBC3190BDCEC457CD7989986CA4AA202C66570BD207A0173DDDAE7DF968F052E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637251, "uuid": "46222667-0075-45f7-b0da-38697b8144aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637251, "uuid": "4661df9e-3771-46c6-975a-12659976835d", "value": "12288:2WjeG8ex2h9bHoAUQvqVUy/7+9BC6XA+XlP64fvTQf9POUBmu7ytXPkjh4zfDVBv:2Wyex2PbHoey/CDC6XVpfzsxbLuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637251, "uuid": "cda8df3d-1880-4ff5-b8eb-53ea3138bf51", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637251, "uuid": "61dd3075-45c7-4e5e-b7a4-32491beac1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637251, "uuid": "0052ea70-d297-4f6a-b97d-50bf4db3c53e", "value": "SecuriteInfo.com.W32.AIDetectNet.01.26366.12217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3341439-ddc1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653658481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658481, "uuid": "ddc62c14-37a0-49b9-a985-dca47622df80", "comment": "Malware payload (AgentTesla)", "value": "8aca787528d9c89ddff93156f7693624", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658481, "uuid": "8139a304-8888-4868-be99-963af6d2be1c", "comment": "Malware payload (AgentTesla)", "value": "6feaf8cc8ec2916b3a7e9309536b1a5ee8ebff606f449d4a061ef8ca36ce3412", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658481, "uuid": "d562cff6-66b2-4ce0-a855-0c6caa2b9a9e", "comment": "Malware payload (AgentTesla)", "value": "583201fa4ec7c3723275ef3da769fe44eb1cfda4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658481, "uuid": "841ac810-8ca2-4d08-b9a3-a243d3d92c38", "comment": "Malware payload (AgentTesla)", "value": "579b40b7bf6cd5e8d5dc2dab754899920e6e0b2963be3f11f8db8d695f2eaef34b54be2cd5b83641a9c446468171563a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658481, "uuid": "c77cb1e5-3d71-4d83-8492-21f9460c001b", "value": "T16094239599C1278BF6A7DF160D343A4E5382B658C3D173EBE5B83960383835806126EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658481, "uuid": "69dfae7d-e084-436b-9f23-947cb313b137", "value": "6144:9dQ/97C4uTT4cyImWrEHtZSFkQT2Uy4yrtILVbOCQ8BL3Q06wP1aP8EBEI1D1Ejz:jW9T2MWmkcyTT2Vra51QQ7QA1a0Exk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653658481, "uuid": "e9f8246c-3c85-4d92-80ac-a0e69f7f489c", "value": 411763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653658481, "uuid": "b2cd73dd-0829-49c5-87bc-48a4e17a4320", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658481, "uuid": "4c463126-80b3-4406-ab23-30f401fe4cd2", "value": "PO Intm 9005697873 RELIANCE RETAIL LIMITED.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ab921b-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653676306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676306, "uuid": "b09f180b-940d-4557-9e06-4292f505bbd2", "comment": "Malware payload", "value": "e2e4196b84fdf8956baa7f99b11812af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676306, "uuid": "1562412c-06df-464f-b9b9-b1f8d6e34116", "comment": "Malware payload", "value": "7004d20bac532e4a93f138bae6da90223d850992fd1c88ba176bc9349b802c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676306, "uuid": "dd836e8b-126b-46cd-a5ad-48f67b978c76", "comment": "Malware payload", "value": "7af0382928364f2fc088d13f96394f4d83bd01ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676306, "uuid": "e6772313-2a2d-4440-abf6-8db7b17718d9", "comment": "Malware payload", "value": "6acdfcc78db63b5c55d6ba84ed708eaf182aadce6da48d61e68a1f5d8a1f9b817edf3dec02475894f498913227eaa4ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676306, "uuid": "4d728643-c841-4973-b40e-b1e35377d24a", "value": "T145E429B2A430868AD5E91EB25E4AB93091B22D7CDCE2110DA9F6370DD6F231145DFB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676306, "uuid": "9a901b9a-45cc-4168-8d3e-85d49ce7dc29", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676306, "uuid": "cbb0e281-3ecd-4ad9-8305-10546c8deccf", "value": "12288:0YgT387AbTc/v4b0h2gdYBXnQLGT/Fp0hZAvcG0ePzNSd01RHqtZCCNfn6THbMcQ:0Ygo7AbTc/v4b0h2gqBXnQLGT/Fp0hZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676306, "uuid": "c7329c6e-d7eb-4e3e-b7ee-a62c88b49c0a", "value": 657569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676306, "uuid": "50621864-5452-4fb7-9077-826aad0ca4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676306, "uuid": "35bc41c3-0c90-42a8-8573-88661c1e4e06", "value": "SecuriteInfo.com.UDS.Trojan-Downloader.Win32.GuLoader.gen.21079.10441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5890702c-dde1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653672046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672046, "uuid": "bd304f15-1824-4d74-89e1-bedc7bb28189", "comment": "Malware payload (RedLineStealer)", "value": "6ffb271dac5aea05d5a8feb1344ac144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672046, "uuid": "c4f70857-1e71-48db-ba45-3f38bb00c2ca", "comment": "Malware payload (RedLineStealer)", "value": "7107046a7edefa979e9d52e5af41029cc7c3cad45e78ab16ecbbfbb2b6349f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672046, "uuid": "78b77891-cf18-497e-85fa-903197df6c9b", "comment": "Malware payload (RedLineStealer)", "value": "20f253980f2d959583346e35b3d36e4aa23e5e70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672046, "uuid": "251cd76e-0707-45f8-bd47-c30741fec49b", "comment": "Malware payload (RedLineStealer)", "value": "4818405853a87590bdc0b155246ca6e0a41228e2576d6a0cf61b223c76d087242c0e328d1060b3df8ef999b5a94abab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672046, "uuid": "99e7cc35-0648-4a01-a5cf-e2a2d281f758", "value": "T1D8345C8932A471DEE463D1319EB40D60AB727CA6973B820B905B359D5EBE952CF103F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672046, "uuid": "17d6d301-5186-42f4-9e8e-f8502886520e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672046, "uuid": "d7065e8b-b33e-46e5-be91-0642318dedd5", "value": "6144:9gpbhUOMGQHyalJNTGF2kfPySQSAItnexya4y9+xBKKq:7pSalJ8PqSQSBtnexya4y9+xBKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653672046, "uuid": "0046248c-c332-46cc-b5d5-27e77631ed0b", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653672046, "uuid": "386f44d7-783c-48a7-a2b3-ed76ed07b4af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672046, "uuid": "636e9209-ba80-43f5-a432-83de4b059ec3", "value": "P90GT_Invoice_Related_Property_Tax_P800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1604ce80-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662485, "uuid": "a4aba37c-731e-422f-b11d-b6dc7a7d3740", "comment": "Malware payload (SnakeKeylogger)", "value": "dc3db34051e44bef31fdca7378450079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662485, "uuid": "a825f7ec-d624-405f-9382-a7818dc3c99a", "comment": "Malware payload (SnakeKeylogger)", "value": "72957c87bb61f8ec864a5ccd9c5039d31152c531a1d4d527bd48cb6e07f02d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662485, "uuid": "d0497e05-5e6f-4ff7-85f9-e991fda55be6", "comment": "Malware payload (SnakeKeylogger)", "value": "b92026c102c4a398de3bb56b2e3e766d19520c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662485, "uuid": "1b10f569-a00c-4483-93c2-ff8c796e50ab", "comment": "Malware payload (SnakeKeylogger)", "value": "57ac0cb807bf3c11e477cfd8d53a419bae443e19a95ced5e27e9570d872db5baa8d47e21d1adf9c0b381a3724727969b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662485, "uuid": "4c8ff0ed-3582-4184-8483-d848247f65db", "value": "T104E4BF30365E6993C5EDCA304BE5822004F25D7EB9F2D31E3EA7314F06F2791A62656E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662485, "uuid": "c4ee7339-39b4-4589-88d6-218c760546ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662485, "uuid": "bfe1dbc9-f3e4-4f75-b945-5fb6a9a93b51", "value": "12288:gZYnrwCr3sBH2s6tjNYjRzdQVYJUEKl75jQWmc:giwCr3CWs6thY92VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662485, "uuid": "89eeeec3-e35c-4dc7-9c37-62a6d96ff7da", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662485, "uuid": "88b9e292-25b9-4cff-ac3f-c96af68f1d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662485, "uuid": "7e3a4127-2c75-4140-8cab-82f8d20e01a2", "value": "purchase order T&B19-20PO128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2661829-de0f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653691954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691954, "uuid": "5a000e4b-5a1e-441b-a9f9-eb754c529102", "comment": "Malware payload (Mirai)", "value": "8fa8ca4af8d2f36fa2a4d1b26eddf65d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691954, "uuid": "355a34e2-d2b7-4fa1-a034-4e1448064773", "comment": "Malware payload (Mirai)", "value": "73d4644dc17e566ee390397a66976e11781d21dc27f5ddc2def24c7e3bff565d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691954, "uuid": "11721a5f-02ce-4a12-a9e1-a81af6635407", "comment": "Malware payload (Mirai)", "value": "93c390267e7fceb5eb49c009a4d7ebefbc03d0bd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691954, "uuid": "09c08254-f39a-42f3-bb6d-ec65d5582705", "comment": "Malware payload (Mirai)", "value": "1f3c0a6d73950db446f7ff439123e5988503534528cd7728f05ddad5946e0b044849d552876707aada8e76cd154d4e15", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691954, "uuid": "a6da2bd8-bbf6-4e72-befd-d18656ade096", "value": "T1B6E2E17EA0379FBDDDB66530511F42E4EB0A60431FA31A7F898661BD3C6BC992714C10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691954, "uuid": "e2a0a47d-fdeb-487c-8da6-e478eee0996b", "value": "768:UTCP5SEP98HGR1G2KtB3aKBd8NgtigTjnyQn0jBx0KF:UT85SEF4GrKtogMnQaPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653691954, "uuid": "e3656ea7-c304-4bfd-974e-e88c02ee21b9", "value": 31372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653691954, "uuid": "e4b2b1a8-906f-421f-b940-481be33806a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691954, "uuid": "bc676519-743c-41ba-8a16-f0b818746492", "value": "8fa8ca4af8d2f36fa2a4d1b26eddf65d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a10328-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653664235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664235, "uuid": "3851e78a-6488-4b82-9a3d-1854582dfef0", "comment": "Malware payload (Heodo)", "value": "1003ca05111cedc32d04bbed1540e974", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664235, "uuid": "9b8ce156-a778-48a8-b85c-7e6b210cb6b2", "comment": "Malware payload (Heodo)", "value": "74bb524a8a3b155a7153a1a81e9ad327f193d5c4aaf8c6aee615f48060e2a147", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664235, "uuid": "79a82331-83e8-44e9-9530-6326db3778ec", "comment": "Malware payload (Heodo)", "value": "0021d415919cc67cb069f885063519d99e24f269", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664235, "uuid": "9772468d-2c46-4ec5-ade2-74af2ab8d8dd", "comment": "Malware payload (Heodo)", "value": "0c116d1b181be9767e0a43a8a737397c1fc7e510c41676c75a0e0755768ba26d183b0c06aa95bce4a88603a05ff2c7a0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664235, "uuid": "b58c574e-dc48-439a-be76-60837b306fba", "value": "T1C194CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664235, "uuid": "595cabb9-a626-48eb-b082-b7d8ce7529b7", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664235, "uuid": "202b21d8-1a6b-4258-b01d-bda8e5c8e646", "value": "6144:I9wEpo6/4WaPgMIuxqqKAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqKAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664235, "uuid": "0a17b2d8-cc61-4652-9209-2c80ce36d315", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664235, "uuid": "497e50d3-4dbb-40d3-ac71-f8258b21cd94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664235, "uuid": "4d2cbb83-48c4-4a0c-bb41-cbe8f828a1c5", "value": "1003ca05111cedc32d04bbed1540e974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88474fe5-dda3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653645497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645497, "uuid": "fead1b08-132e-487e-b07b-7b8eb6a324e7", "comment": "Malware payload", "value": "83056a98c4061b5af097abc4d6452af9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645497, "uuid": "0b2390f6-94d9-46e4-9c7a-fc854792e558", "comment": "Malware payload", "value": "76e77c4fa4b5c4f0de462433835fade7f619a0d0c4d7dcfa6ea6a9942ba3cfad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645497, "uuid": "8ea20fa7-beff-40b6-a167-47ac4cfd26cb", "comment": "Malware payload", "value": "c2549a8e6ac2484e5089694ea88c862c5b5a4531", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645497, "uuid": "ef5fabd2-e64c-4185-8eaf-025eabd29cfc", "comment": "Malware payload", "value": "33adf37cb55f3fa7cbb40ff2b97b2f88ba674fbd0111fe72d1df7595a053ea6f9edb62db5dd270649f5d98bee705d96a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645497, "uuid": "36ede2db-e41d-437e-afa3-4a0a62295878", "value": "T17484114DC78B95A48F446333232B5E4102BDB22EF715A2B6752C977137E9D3E08A58BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645497, "uuid": "b6ad9151-c35a-4938-9efc-c64ed23c209e", "value": "768:kVrwbD6qGgQX9JUCpnxRdmNDgX9MtPLlCf:Ykv6qGg09JUCpnee9MtjlCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645497, "uuid": "ff360cd7-94e6-4fee-a456-6159900b5299", "value": 400169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645497, "uuid": "b17ccf41-5872-4878-8788-3e8124c4e736", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645497, "uuid": "61316a66-d377-4253-ac45-fe5345f711cb", "value": "2022lk0525.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d6dd53-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653643831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643831, "uuid": "9964c364-a63f-4c16-867e-9e87f9dfb86a", "comment": "Malware payload", "value": "cff91e647fced8043cd10b11def81457", "object_relation": "md5", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643831, "uuid": "9887a09b-98ad-4939-b357-546ad7f518b6", "comment": "Malware payload", "value": "780fbd29b8d2e4d51905608259d3876492a31cae80031755a4611a7c852ad326", "object_relation": "sha256", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643831, "uuid": "2ca17d62-daba-4f36-871b-7a40d6098297", "comment": "Malware payload", "value": "78f4681eae8141993a0ff7abdff3d4821905ee50", "object_relation": "sha1", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643831, "uuid": "edd60fd1-a664-4c42-925f-cab184e3ae6a", "comment": "Malware payload", "value": "affc3ee95f2d566b7354dd5d2255d96ab10114c4636f3d34ff95bae632d0a255be3597fa709a1e7450e254685e408045", "object_relation": "sha3-384", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643831, "uuid": "f7d7cd3a-f576-48c9-9c3b-f509624d0d03", "value": "T1E5B6B40074237A9AF70F837AD0998AB44027BD9C6D1897DAF7343BD506B02F61DA2D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643831, "uuid": "0650bbd3-147f-4091-96c3-5ad1f1e2f909", "value": "1536:XRGstjIJ1VGMXgVndh/wfkYwy+ZmRDs0DK7E:wIIeCvR+MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643831, "uuid": "96df7912-26ff-4f9c-8e65-a0bb1f4a2370", "value": 10948608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643831, "uuid": "cb35f9ed-8e17-42dc-8904-ed45eba40f82", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643831, "uuid": "3ab7bb42-ff25-4787-850c-0abd492df255", "value": "27d1053.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc598554-ddca-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662442, "uuid": "07109d0f-360a-4028-ac5e-8e46393e851b", "comment": "Malware payload (SnakeKeylogger)", "value": "116e86e066c4f0ed80f36eea733327e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662442, "uuid": "a7610d38-3c39-4da7-8164-8f98e11d0f8a", "comment": "Malware payload (SnakeKeylogger)", "value": "7867e2585b1ef9a4827449812451b82963c5123b14104cdea0836a768cc27aee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662442, "uuid": "ef1a1693-9e43-4505-94cc-05afb6b82217", "comment": "Malware payload (SnakeKeylogger)", "value": "61888c456510342b452deb5aa965dcfcfb01adb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662442, "uuid": "c056ff8b-b790-4b67-b10e-341394632f8f", "comment": "Malware payload (SnakeKeylogger)", "value": "a8540a31a8b799babdc70d791756d19a06625c8d1135e99c8238cbef357a56de595408e30e4503e2b7d3e2eeaa73ee2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662442, "uuid": "a6d0cd00-26a6-42fd-af8d-a66dca9491a9", "value": "T173B21811765C9A95CA91863E88DEC54807B0FEF5942BDE6F389C73C6F923743CA40B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662442, "uuid": "3b724594-d161-48ec-9218-fe3f3c943a3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662442, "uuid": "016f4dd0-7b7c-4800-9af6-042e7d187d33", "value": "384:AuaJ2jT+WbM/Mjna0/+868uLlZNAL2xOBvNcH03Q9LeE:AF85QMHv6lC2xODE034X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662442, "uuid": "daf8e1b4-d712-4849-a874-97fed1353624", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662442, "uuid": "ebfe187f-a912-4e46-89f0-ef3ea42d4b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662442, "uuid": "a235bf84-4446-440c-a471-3fbef73e5356", "value": "Znhawianj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de1f352-de0f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653691919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691919, "uuid": "36bde68b-651f-4554-9e97-879e4d8c0533", "comment": "Malware payload (Mirai)", "value": "dbc6cdcc8688f56f08731901d169574c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691919, "uuid": "c220a197-e9e0-4048-a17a-358d5f4cba2d", "comment": "Malware payload (Mirai)", "value": "7881d69bfeb0fbe0d319006349f13a817b52ed08b45077fd7fe5c4ca0edc9670", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691919, "uuid": "17dc5f50-2372-462d-8c25-76d3b81b6596", "comment": "Malware payload (Mirai)", "value": "3669bcbef80015356246f0472d5f0fbc2ea55d65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691919, "uuid": "791f4fb8-d7bd-4d34-bb02-6ee2a46bd067", "comment": "Malware payload (Mirai)", "value": "2028944883aafce391811a44aef933e5ed369a360404b676319a07bcf22d500629a095339d4f868e64b67cf30c223476", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691919, "uuid": "993387d5-31a0-4b36-839f-fbe969d4f60b", "value": "T1BB634C99B4019FBCF94BD9FA41210A0EF92162105F530F27BA27FEA33E62096CD57D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691919, "uuid": "0af66ecc-cb75-44d9-b48d-4214d680994c", "value": "1536:/goKXqcEmDqMvBM+QtfMFHl7Q1QLB3Xb18PvE:/jcESqMvX2MFF803r0vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653691919, "uuid": "b6a1c677-1fc9-454c-9cb7-3de60a20199d", "value": 72628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653691919, "uuid": "55b0434a-5268-4b98-a890-b0d5f013b2f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691919, "uuid": "56564a62-8ae9-48a2-bd31-f54cc1a721df", "value": "dbc6cdcc8688f56f08731901d169574c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc16937-ddc1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653658390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658390, "uuid": "7e0d19c9-617c-46e8-88db-6753fa84c679", "comment": "Malware payload (AgentTesla)", "value": "9c4dccd93ae4440b5dbc580a85f53b94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658390, "uuid": "a768661d-c5ce-4bc8-819f-1ff38abcb7f8", "comment": "Malware payload (AgentTesla)", "value": "78990521b8fd82b6f0eae446fc6d3f4763764bd85f8820dc7d0a3eeb50d8933b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658390, "uuid": "a2925f9b-d0c0-43f2-b1eb-6754656d7ad2", "comment": "Malware payload (AgentTesla)", "value": "c9caa8238fc581ce3504a8513a2e3ee4701e9274", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658390, "uuid": "55861317-cd24-40a5-85a9-28e4a0565e90", "comment": "Malware payload (AgentTesla)", "value": "8dd0e5436c2ff63ec8ba3d43e1589b055b9b54fbd3559a8fe5e12fd50101311a43cb2e1532b6f45bc29db0a5106b4414", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658390, "uuid": "81bdac45-804a-4337-b7b5-104262fa9224", "value": "T12164021457DD9A42C6FE087AC4D204B45732A43A7CABE75FADCC112D2B337C64922B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658390, "uuid": "7fec16a2-4eff-444a-8132-19fbc7165b75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658390, "uuid": "2ba2df6a-8ebc-4109-88ec-1c60fb114cb4", "value": "6144:0n5tMcEzK2WHKjlc+m5+n9X029Vx+7HIuEmQEBYOqgHwWg4bR2:0n5tMVu6W+m5EERQ1gQWLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653658390, "uuid": "faa65973-d3c6-4e10-9040-ebbe81b57c85", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653658390, "uuid": "f847e223-e8a4-4b78-b870-f02f8c0f2395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658390, "uuid": "d889e644-a77f-4025-81fa-f23719587d88", "value": "VAN NANG TECH-H\u00e0ng h\u00f3a y\u00eau c\u1ea7u_order RFQ 2209865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e5effa-dda4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653645862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645862, "uuid": "7cde4631-9ecb-4fcb-ad0c-7ca430590b82", "comment": "Malware payload (AgentTesla)", "value": "6072d02b2ef0354a8b11f2ac47524a74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645862, "uuid": "ed13e6dc-1d00-4e62-a8a7-d1e2e6eb9e7e", "comment": "Malware payload (AgentTesla)", "value": "7972e689c5fba210dd34ac7c884901a5297695d7494d072f7addcfe184e6d291", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645862, "uuid": "8135401f-3cd9-4ae9-9508-a707e44bd2ed", "comment": "Malware payload (AgentTesla)", "value": "ef61a9cdf6bf45b085062584ee9528fb91c921dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645862, "uuid": "a2758d21-248c-48f5-a5e8-a4b80938a756", "comment": "Malware payload (AgentTesla)", "value": "a394c0e83a9248f318e69f55feaa1b530babc8d3dfc3c638ec7bf151a9381c58bd93c9be711201db46b057361caaa6f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645862, "uuid": "7d75d878-0733-4ca5-851e-25ca4b4bdc5b", "value": "T1DAC42341A30AC558F9CAD78D2A9E50BAAB228D25C72F7FD01B4767BC40DB23F5742970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645862, "uuid": "a6f6e186-ada8-4014-8d76-1912d6881f43", "value": "12288:Yzlism3YGFocKGMTPjh6Vx4nntar2JEScSSVHvetY1gW4kv:OGIh3GMTPIGt+2pSzL4kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645862, "uuid": "74171cd5-6d25-4037-b8ea-8c3e8860757c", "value": 580209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645862, "uuid": "89a1035c-7d21-4b9d-b072-71071e986418", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645862, "uuid": "a377c8db-318b-4428-9bb3-64ad1c54cff9", "value": "Swift copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d08688-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653643856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643856, "uuid": "ed11acdb-6f41-4498-a6bc-a8738f17abcd", "comment": "Malware payload (RemcosRAT)", "value": "ef24da63fc85b5740fe7b3c97d07b820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643856, "uuid": "79070a5e-0aa0-4084-876b-8d00ac3f0460", "comment": "Malware payload (RemcosRAT)", "value": "7a099c2a919928941a4357553300018cd8847760df7b17c2e7bde1daef328305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643856, "uuid": "aaf376ff-9578-4273-abb9-3674da267fd3", "comment": "Malware payload (RemcosRAT)", "value": "2183daa057839b3f1eb72899f44d8d0ea4c3d2f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643856, "uuid": "a11d7b9d-13af-4c51-8c59-6e5ea91d04d5", "comment": "Malware payload (RemcosRAT)", "value": "ef0c31adaa0fdb25fcc57974df36fba1a0a45dc50fb5bc0a772447a399bf077443a051abf79f46779c69f24a71e7a221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643856, "uuid": "a8112710-93eb-4db4-b553-55a482a929d4", "value": "T149E4AD7197835CAAD78B4674284E62F04B6BEBD9570AE70E5110FAFC71DBA0107CB9C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643856, "uuid": "11edea61-855f-449e-869e-dc0e416b8d6b", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643856, "uuid": "4ea1deb1-357a-4cfa-814e-7316bf1b13ec", "value": "12288:Deo+fUVUK7iiYQA/RJG5J/0nYS7bgHTDuRSsE5Spf9VlV9CzPU:aogUKK7TNA/RE5J05cTCRZv9Oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643856, "uuid": "17677af5-c96c-49ae-8a35-346a1b38349f", "value": 686253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643856, "uuid": "fb7550fd-2814-4b37-9353-1bd1d8341d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643856, "uuid": "280d369c-a4ac-4d44-9fa8-548e5c381e5e", "value": "ORDV_007376756376678748783-ISO-293836899254_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf35731-dd5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653615147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615147, "uuid": "c92f3fc7-9a7c-42f8-8360-e3d971d16eb8", "comment": "Malware payload (Heodo)", "value": "ec8ee845e126c99b1296301a1533c271", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615147, "uuid": "10326ae0-e6a7-424b-b53b-27a9129f619f", "comment": "Malware payload (Heodo)", "value": "7a8ca0c271b5316d60b3487e953d59c4b6bd194308c21f836e422a04a3df9f1d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615147, "uuid": "df2730bd-1bf9-4d83-b641-35b73e83d8df", "comment": "Malware payload (Heodo)", "value": "f272f07993924b0e2e8a7f75d346ca5bf3c7f51e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615147, "uuid": "1dd1730b-1e29-4b81-8022-b0f0bd1545b7", "comment": "Malware payload (Heodo)", "value": "c1f15b52563748760f15faf83960f31c5d07d84474184d210423aba460fd6eb086fd058fe2a78fe9948bee1c85695f8d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615147, "uuid": "120a9c3c-55f8-4801-a774-02ed3264669b", "value": "T13DE49D01F2AC80B2D06FD13989A34A4AE7B13C9497B593CB5251FB3A6F732E15D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615147, "uuid": "57f1d891-2e52-4125-86d4-3aacac3518dc", "value": "b7b90674fa6c5f9a16bdab0725f21bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615147, "uuid": "bbee290f-e814-4eb0-b23c-7e0eb4110a29", "value": "12288:8nUIW4anSDGCH0fu1QJKwWbe1gUK7wrnUfpE:kUITnGCH+u1QJK2CwrUfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653615147, "uuid": "617fa06a-32cb-4cd7-8073-8b2b9b4497ae", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653615147, "uuid": "086dfec5-126c-49e0-b7ca-0cce86cda9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615147, "uuid": "eb0f08e5-3229-430a-9b31-e2f83f74b56b", "value": "ec8ee845e126c99b1296301a1533c271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc1df98-dd86-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653633103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633103, "uuid": "370973a3-1371-4041-9e8e-0645c139bb68", "comment": "Malware payload (AgentTesla)", "value": "f2a4b15f4d3307873205f79e0ce338f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633103, "uuid": "97d78b21-ba4f-47b9-9f9f-59fa090257db", "comment": "Malware payload (AgentTesla)", "value": "7ba7dc3452d0f0ad12899766ace20257a638e69e1f985476002e8a9af9a2957a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633103, "uuid": "bcecf9b6-961b-4353-89eb-3f076f497a69", "comment": "Malware payload (AgentTesla)", "value": "117bda88b95374ce8eea0ba9fd876cae12a6ee64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633103, "uuid": "efde43aa-abd1-4ef6-9c87-6873d39b3450", "comment": "Malware payload (AgentTesla)", "value": "c44253054b33e7a2ce195d1aa3e480841d916c3f3a3aa6b17bbf1fe1e76622b4457ba1bd9b3c98f25fdcb84d25fdcf2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633103, "uuid": "f2f52e5f-d0c1-4aee-9d3c-8c1553c416fe", "value": "T1D0F4F140B2F81B22F6B967FA9AB4508407727D952920E34E6CD17CDB3A71F614E81F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633103, "uuid": "7e9772f0-df4e-4982-bf90-733de371f712", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633103, "uuid": "5620f717-3274-4823-894b-2261f7c9fb60", "value": "12288:xCp2s9bHoAUtvqVKOx5jAsTM/lqvbsr7nHJaiIQ1uc/174TLU75gRr7/F0:4IYbHo/OYZ/l7HJioR4kVyrjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653633103, "uuid": "9086643d-ffa5-4f1f-b174-03a9ee98cfa6", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653633103, "uuid": "0c4f1bc4-9e8d-4593-96ab-5c740766cb73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633103, "uuid": "e80b87e2-7066-4865-bf07-9f69ef8e2747", "value": "SecuriteInfo.com.W32.AIDetectNet.01.24645.24973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d737a608-ddce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664098, "uuid": "ce0550ed-806c-4231-be41-8c6bbc794ddd", "comment": "Malware payload", "value": "4a5aa959296361691a90ee0cc11a8cc7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664098, "uuid": "3f838f5a-9882-4c86-b808-c0b36a9a48c2", "comment": "Malware payload", "value": "7c55d375deb9bd8dcdccb5a690c12331316548a801e21a71a430ea4ed56ee860", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664098, "uuid": "1997cd76-1dfb-4547-95c9-61319cdc7610", "comment": "Malware payload", "value": "b64c0307f1765ded120d5cb9fa4d5a43da60b6c1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664098, "uuid": "51cde6f4-2bef-4d2c-bca1-3319b33730f3", "comment": "Malware payload", "value": "d72a2f85b3b7617fbda060a3e9b989d55cb7fd08de9f5fa43f06b55aeb28a3a92f59d2bc37481284a6fa668ab8750af6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664098, "uuid": "e22654da-a6fe-484c-8f18-cb3bf958f194", "value": "T1EB367C12B688A13ED46B1E3A4937E358993F7E722A128C5F1FF4098C4F359407A3E657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664098, "uuid": "d23db201-3340-4086-a0c0-2896faead8ec", "value": "98304:ZS0fXnz9AwLyXfr8YKGNlJIs7G5wmQ11ZtyEYAA:ZjnzOHQYpDIs7G5wJRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664098, "uuid": "813ad9f4-ed4f-44be-8497-f542664dad47", "value": 5209600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664098, "uuid": "6b1475a1-acf2-420e-8a0b-043ca02ce438", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664098, "uuid": "b1baab0f-9108-4606-ae17-b7b308a4dd55", "value": "FactEndesadigitalnow.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b4dc8f-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1653662706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662706, "uuid": "f12d43de-96fc-4ebd-9c64-72be982e549c", "comment": "Malware payload (GuLoader)", "value": "dd43bd8cdc55dd9c8a168f7d5e67db30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662706, "uuid": "60ad3ced-f6f2-453e-a881-b7d72690783c", "comment": "Malware payload (GuLoader)", "value": "7dc00d4ca525d39db7c57bcbcf2a17720f3e1d2eaecfc714f5e28f0e2a09633b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662706, "uuid": "d73e229d-f78c-43c4-82e0-039444859d0f", "comment": "Malware payload (GuLoader)", "value": "b7b49d8b277b6cb3d3006e912ad78558872119fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662706, "uuid": "b678cc51-b966-4072-bf64-f4b11dfc6a50", "comment": "Malware payload (GuLoader)", "value": "b496e5aa093a516639ce9422310c29ff874aff9cb708c16aac061082e994a193d47ab79d6de75bd15d52a0611da20659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662706, "uuid": "b066df04-64cb-4d8c-b739-e5fcc4e0c08e", "value": "T166E418B2A130868AD5E91EF25E5AB93091B22C7CDCE2110DA9F6370DD6F231145DEB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662706, "uuid": "b2c505fa-999a-4f0a-b5a2-8741da2d43b9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662706, "uuid": "65f23b44-b2a9-4c1d-81d1-6899bc4e96df", "value": "12288:0YgT387AbTc/v4b0h2gdYBXnQLGT/Fp0hZAvcG0ePzNSd01RHqtZCCNfn6THbMcR:0Ygo7AbTc/v4b0h2gqBXnQLGT/Fp0hZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662706, "uuid": "0fb95b1e-c73c-484e-811d-5c142b27af09", "value": 658225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662706, "uuid": "64087bd4-0ca2-4976-b821-451d48c5ce34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662706, "uuid": "14e2a56b-4c00-41eb-a9cf-8dc661d4e02d", "value": "SecuriteInfo.com.Trojan.Inject.11626.30754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1577e932-dde0-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1653671504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653671504, "uuid": "3eeae920-cec8-4d51-b63d-963cfcc73f1f", "comment": "Malware payload (njrat)", "value": "acd2b03a0eacf8f7ccd2e6b367fd4f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653671504, "uuid": "e28f3b0e-23bc-449c-8e39-dbafa54b1e30", "comment": "Malware payload (njrat)", "value": "7e670075c495412da5bef2f982bbbcae2ecc4e5ac175e8c19cdec8af04d2a05a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653671504, "uuid": "5a1d1a58-6a7c-42d3-86b1-14d05f333cd9", "comment": "Malware payload (njrat)", "value": "bbbf0f606c7516f895a45a727bae69ab5b90a883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653671504, "uuid": "9da5f6be-c7e6-41a7-9b5f-030fc089a826", "comment": "Malware payload (njrat)", "value": "a4cde904417062d23fe1164929705933b625a4793d445e2bf99fd431bdc146c6d47993ba5bfaaa1e06dc5f8285d109ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653671504, "uuid": "47ff8869-ba0a-4718-b937-02a510c11bc7", "value": "T1F6F34A5AB7494B15E57D0C30D0FF5A3003F1AAC3A633E3863E85659D8E412D69E0EBDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653671504, "uuid": "12d82fec-d5e6-4961-838a-fbf893133417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653671504, "uuid": "9ab64dd3-781c-4460-9e83-ab5bef1ac8b2", "value": "3072:K4CLm/Txvdj2tWv+DGZa/TckCEjoMIPtb/ty4VJwD:LC5Wv+qZS/j9IVbFlwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653671504, "uuid": "b4d7c11f-f247-4575-af08-72328ed39910", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653671504, "uuid": "6149545e-cbc3-4023-ae23-b622292b8d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653671504, "uuid": "cbffb2ef-c5e1-462a-b32e-06cceffae334", "value": "acd2b03a0eacf8f7ccd2e6b367fd4f6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee88b61-dd52-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653610585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653610585, "uuid": "f63b0242-8c33-4f99-ae37-76fb8f9e058a", "comment": "Malware payload (RedLineStealer)", "value": "6df4fb521437d26ccc2e7e27a4deb63d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653610585, "uuid": "663fd636-4650-403f-a927-3520ece9781a", "comment": "Malware payload (RedLineStealer)", "value": "8099e91cfcf1eb921031e44347ae3d46d04f9406599e9856fa86e71f987a110d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653610585, "uuid": "76046f1d-5cf5-4003-b142-00aa79009960", "comment": "Malware payload (RedLineStealer)", "value": "703d9f223f91d0cd5ce1ab6455548b0af0e7d24b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653610585, "uuid": "eecc7dab-4d64-497b-b260-1b892d7f071f", "comment": "Malware payload (RedLineStealer)", "value": "e4b7c41eb93d8d3ea70898ee6809aef4573bf43ce9b33a4816bc2e93ea9b9624ed416e805701739e6ec53af6182e86b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653610585, "uuid": "1209f21c-8b3c-4a48-9d7c-b41810c3247d", "value": "T10B648D94B1C544CAD8130BB15CC5F668DD1C1CBA2A998E0F3EB9366FA2B21D0247EF5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653610585, "uuid": "e6d2d90d-ee1e-41e7-81a3-6eb51dab1146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653610585, "uuid": "167dcb0e-567d-402d-91c6-57a3365f0338", "value": "6144:Gy3hsI2Gji7nfjccLE9MNNNNNiNNNNNQNJszE1DtT:tT2h77bFNNNNNiNNNNNQNJsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653610585, "uuid": "955a11b9-89ad-4678-8cd3-307086c6cdf7", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653610585, "uuid": "b4920eee-dae9-4a39-b900-347f5e89386c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653610585, "uuid": "b5573815-6391-41b8-9aff-12bdfedc7c39", "value": "8099E91CFCF1EB921031E44347AE3D46D04F9406599E9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feeca00f-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662876, "uuid": "688739a1-0d0b-43e3-88aa-d8e71d453100", "comment": "Malware payload (SnakeKeylogger)", "value": "316ab93cf223709f79efae25de8ebc20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662876, "uuid": "6eab8696-705c-4dbc-9f6f-397da376a6f1", "comment": "Malware payload (SnakeKeylogger)", "value": "80e3270817ca5c2db36a621f2f8f35b755fbc6b9bb974f25cbbdb786be0b6acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662876, "uuid": "998fcbca-64bb-40e5-a37d-5f9e16e3a307", "comment": "Malware payload (SnakeKeylogger)", "value": "124215aa840d871d54187f70177490a8c536ea13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662876, "uuid": "6e15abaf-6dad-4b62-a25f-8081b2b69032", "comment": "Malware payload (SnakeKeylogger)", "value": "1f7b02608d57e1c3babd6887bdf995668e63fd3907ef3ae54fa40e93b6eb53bfd5b70774a7c38a05a2f1aee8dcab6b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662876, "uuid": "9e64420f-e91b-47be-8073-cd10ae641caf", "value": "T109D5C0F9A6F73530EC65ECF82D608FA89936F1258E11EEF450ED1E52F825B6005A16CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662876, "uuid": "16157546-c1dc-4e6a-bca8-1245d0f8f1ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662876, "uuid": "254ed0f1-6bf5-47ad-9f24-700a8c19356a", "value": "49152:QywulffxSchbwiFAde7TTDusir29FSGKsMeKrwMYqKiyHDvzbS0dWU7U4/kh6:IwffIchxjVrMBE7vsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662876, "uuid": "e56dd003-c766-47f0-82aa-4b74c3a03996", "value": 2845696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662876, "uuid": "a9a7823b-20ce-4d61-b47f-42d9e808a14d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662876, "uuid": "e760d969-dffd-40cc-adc0-260be40d296a", "value": "Halkbank_Ekstre_20220525_103511_102798 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072946fc-ddc8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653661172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661172, "uuid": "515baaf2-cbfe-45c1-9a4a-d97c488103f0", "comment": "Malware payload (AgentTesla)", "value": "fe5cab253ef5708d03dd6970e105b6c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661172, "uuid": "094bb167-4d75-4b0f-8f30-42998e536061", "comment": "Malware payload (AgentTesla)", "value": "80f5923e2037f3596f2bebec849a1a55221c37c714d14eca6bdd35e12351ec7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661172, "uuid": "ffdfdfce-0d24-4aaa-8f39-225fb361939e", "comment": "Malware payload (AgentTesla)", "value": "d7d0ba487169c56e33e92064b482c2d56d5dba5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653661172, "uuid": "dc4198e1-92c3-438e-b443-d06d99b07af7", "comment": "Malware payload (AgentTesla)", "value": "97c87576d2e942600818baef6d3fa44b5fe94f7b6b67b35e6030255cbfeb292ff006c5a4806740b5ee63daeeea820e2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661172, "uuid": "fa6879d8-4e04-4eec-aeb6-0e9be3b8d1d9", "value": "T190B4DF013BAC7A12E66BDB3550A1804453F2844FBA33E51E3EDF2CDF16A6B149760B79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661172, "uuid": "187f2187-d914-46f0-8f51-b09104e591e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661172, "uuid": "326f0c5a-fe2e-4f69-aacb-0f70a7d4a593", "value": "12288:VYEEIBxW7R0OfmlLBhek6U02K+olrtM5Jj:VxEMxW7WUmxHBH0lrtM5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653661172, "uuid": "1fc16369-036b-4984-81d3-13842a16ff30", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653661172, "uuid": "70f435ec-9a89-40a1-bd2e-0cc938084829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653661172, "uuid": "7633922c-0fdc-4e35-b2b8-1fa6d37e4649", "value": "INV00987890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237f57ee-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1653664656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664656, "uuid": "700068c4-c2af-4fcc-9c48-57802fdba202", "comment": "Malware payload (Vjw0rm)", "value": "eb430ba81f36e80bb1a0b27a686ea1a9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664656, "uuid": "5178f8f5-70c3-40a8-8daf-f6a131c21b0f", "comment": "Malware payload (Vjw0rm)", "value": "813f90ecb1ef908f765c987d20937654d2071da8d86ed60352f554786c11afb9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664656, "uuid": "7e687f33-a13b-4cbb-b847-9f5f1dbfb466", "comment": "Malware payload (Vjw0rm)", "value": "df9efb1dff452353f5ea481ecf721901107907ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664656, "uuid": "86df5831-5d50-4c94-8f6a-53419fd51cb3", "comment": "Malware payload (Vjw0rm)", "value": "de460083bd77d332c000704474b4cf9267afabc093b18ef2021a6dee5d076c4daa18773c02ba5c9a87697545c87c19f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664656, "uuid": "6c6d9969-fbdf-4c47-97e5-389a8364ace5", "value": "T11064B03187845F699BD44D0BD0BD1E1F56F3136AD433F2CCA7A3390B6AAEE4D0616886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664656, "uuid": "8ba9392a-6bbb-4283-ad2b-b9313a318566", "value": "6144:1TJxXlc+fqoobhET5snEwmohvzpJWaFdSB6L+UDwJDJKvwErvXlzBTq5esR2M3:1TJx1f5yIsnbVvzpsaFO6zDgDJOrdzlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664656, "uuid": "01fe8796-b6c7-4d48-97e2-c3435de011e3", "value": 334586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664656, "uuid": "0106e7ae-39c2-4203-ab31-4e419ffd1f43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664656, "uuid": "8e6e3d36-e692-428f-879c-dc8f2ad9ee24", "value": "CIQ-PO116266.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c306c72a-dd5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653614672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614672, "uuid": "03e115ae-416f-4011-96f0-595223df3e99", "comment": "Malware payload (Heodo)", "value": "f58b99434154f678198294071c24b3fc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614672, "uuid": "8e73fae8-466e-43dd-8245-60dee740bacc", "comment": "Malware payload (Heodo)", "value": "81c47d18cc39f6871f288af30c0154f469faa213b477e7876b3e993286177fb5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614672, "uuid": "b0c7894b-4f2c-4104-b268-95f7da3cca1c", "comment": "Malware payload (Heodo)", "value": "d2e35f6498fe3e8dd726c403d52f6ccdc32c991e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614672, "uuid": "6f11569f-f8e7-49fd-b36e-18959c2bda23", "comment": "Malware payload (Heodo)", "value": "fbd9aba539a8b6a0357fd803af6998b37e061ab1d0c296ebf73b300161cb57194de6a929ed04b1c1578ef86e8250f69d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614672, "uuid": "73dbaef0-556e-4aa9-a504-254ecfcae654", "value": "T144F46C26F2AC8976D0EA9539C553C696DB713C69476643CB2290FB3E3F332E05939360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614672, "uuid": "145d3e04-255e-4032-acee-bcc0cdb74951", "value": "3a54e861d3d9d8c5cf26fa2949d55f6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614672, "uuid": "7fcffda1-d105-48bc-82cb-ee89319e11f3", "value": "12288:hJheLDF+GBXYT7Ose6FPmg3TCtG2lqfn3tBzqgf/lvusL+o:hJhGgGJIJe6FPmg3P2lqfn3POS/lmsLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653614672, "uuid": "926af4e8-31f7-476e-a4ac-61b4c48e170c", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653614672, "uuid": "aad46ce1-ee43-4d41-b801-45b09ae413bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614672, "uuid": "60ead18b-7b0c-4538-a4e2-b064b9922760", "value": "f58b99434154f678198294071c24b3fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8bb8f6-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662797, "uuid": "8411dc6a-0829-4fff-9422-fad384dfb838", "comment": "Malware payload (SnakeKeylogger)", "value": "1a8bc1b43f4794dfde22a90941fb91a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662797, "uuid": "162f03ca-6c35-4781-b66a-318dac8e7b86", "comment": "Malware payload (SnakeKeylogger)", "value": "8234019c7e45f6c377c33d10183754802ec9fd3f9c74f70b4d0d37d7d8073e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662797, "uuid": "67be5afd-faf2-4584-9861-f31317e97ba9", "comment": "Malware payload (SnakeKeylogger)", "value": "a8f03b6f0db19560c2e780129e8c43960cf91c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662797, "uuid": "2082b0d9-8cfc-4e75-bbb3-de2a27f98a98", "comment": "Malware payload (SnakeKeylogger)", "value": "3908460219b16f408c2688d9ee7c7ae67261f45cff29f3e9344ea38923b4d60730e5b8dab02a1adcfe35cea1176cff99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662797, "uuid": "b95ff53e-24a5-41af-bbbf-45842882ec31", "value": "T133F4D09C3680719FC967CE37CDA81C10AA31B56B5717C20BA047229DAD4EAAFCF115F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662797, "uuid": "44eb2b45-6e95-484f-927c-e637da0bdb79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662797, "uuid": "1fc9024d-eb94-4ca3-bbae-42049232ec8d", "value": "12288:g/FWq9ZXZbHoVzPbbZLSt6cVIajiDf4xMRbA0GJ8Tt7EEtb4Xr8iNeBf39+lZL60:CIq9FZbHoVzPbbZuuqiDweR8zJU8Xr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662797, "uuid": "b05419be-0e9c-4708-8007-4b28867069e6", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662797, "uuid": "4af320fd-ba15-4a52-ab06-6d2d432f6136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662797, "uuid": "ccdcbf13-d096-44f9-bc91-7c57230d659e", "value": "SKMBT_22122012816310TD01_20220128_163956 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb1bf4e-ddb8-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1653654603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654603, "uuid": "08e2e7a9-695e-4be9-a1fd-d6ad33c72a1b", "comment": "Malware payload (GuLoader)", "value": "0d6d5bef9fc4a8d2e0fc32bb4d524aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654603, "uuid": "dae497ff-a5ed-4631-9757-70d64a0fe3f3", "comment": "Malware payload (GuLoader)", "value": "824a49f83e2e0d1be82a9aee6ac76add4d9ff7ac3dc633e754e5dad1977a9cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654603, "uuid": "cd1ac681-cc3e-47ce-83f2-7be8e1770109", "comment": "Malware payload (GuLoader)", "value": "78ba54ad4ff986e5d96a35cd441de47517455ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654603, "uuid": "5f77d795-7c1d-4455-9668-c75f0d4e3838", "comment": "Malware payload (GuLoader)", "value": "f37d57cd67794484ea3a1f168226dde24267732f5baa5eefacefa1692b5c19eeb1ff51e36294b5abb214da989ce6f344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654603, "uuid": "2011c7d4-88b1-49be-bb03-b1273e2243a9", "value": "T172E429B2A570868AD5E91EF25E4AB93091B22C7CDCE2110DA9F6330DD6F231145DEB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654603, "uuid": "b632eec1-a397-4998-bce5-d46a818998c9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654603, "uuid": "da1e5c5f-97c9-4051-b73c-6c2c8e332aba", "value": "12288:0YgT387AbTc/v4b0h2gdYBXnQLGT/Fp0hZAvcG0ePzNSd01RHqtZCCNfn6THbMcy:0Ygo7AbTc/v4b0h2gqBXnQLGT/Fp0hZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653654603, "uuid": "8497cf4f-9947-4eea-9288-f2d2f69ef72e", "value": 658027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653654603, "uuid": "6f8d3749-d3b2-4ef0-a985-b2944e3231b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654603, "uuid": "5f80d862-c3ca-45e0-a533-068c2fc98a0f", "value": "SecuriteInfo.com.Trojan.Inject.3564.15599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3feb6b1f-ddcd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653663415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663415, "uuid": "b297c76f-9099-41e9-b57f-a75b9ea11c10", "comment": "Malware payload", "value": "9242f83d4564324529df9e579e012199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663415, "uuid": "58f6c9d4-7839-4547-b6dd-29f553352195", "comment": "Malware payload", "value": "834cf29eea05769d2fe29fc732dba45379824a65e8534c64d6944d2701d8d283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663415, "uuid": "d1bc8fd7-1d76-477f-b41e-8dad18700886", "comment": "Malware payload", "value": "361ce79e2f71c7b9e0ce7182c8aaf81f2f11a0f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663415, "uuid": "3950b579-2a9b-4b4d-a0c4-4183bf4634d6", "comment": "Malware payload", "value": "0dc298399d1b599b2fee1f9bc2f77743ea9908b6773997076bc79707b76f0f95e4971a0063ce15cda5a5da77c8a854dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663415, "uuid": "836ca2de-b978-46ac-a54a-d77b9622daf9", "value": "T17D16334D817D4CF4F0E78675DEE032998C79E3B686A52312166E711BFCA80360B697B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663415, "uuid": "7b509c92-9313-438e-babd-181498db03a9", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663415, "uuid": "1cd695d7-5d45-475c-a772-9783b247ee87", "value": "98304:iqPaYZNllsDLop5FBOykhV+bmMBp6wA6ZXnUDgXSaO6183CM89HC:iQa2ZQ8p5Kyk63kDI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663415, "uuid": "12ff2b91-b335-4ce9-9cc0-61378595e4fb", "value": 4222464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663415, "uuid": "e999fe5b-d66d-49fb-ae3a-a5c6f44f88a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663415, "uuid": "30c4f93d-cd4e-4a97-ba8f-d645b0563aaf", "value": "9242f83d4564324529df9e579e012199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d07642-dde6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653674409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674409, "uuid": "2e6787cb-ac53-4b40-a695-ffeae0c5f365", "comment": "Malware payload (Mirai)", "value": "a056dd8e6aa9f63fd69dcf8453c9ce7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674409, "uuid": "9e5a623c-c4c6-4d5a-ab41-3102f3051d79", "comment": "Malware payload (Mirai)", "value": "83d9248950b5f0af6bd2f694e8453239876345fc66f6873894b533dd43f68cf9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674409, "uuid": "19578c40-32f1-4456-8e92-d72d7c44f7ff", "comment": "Malware payload (Mirai)", "value": "e9510d546bb5a8cc72a8c44bc4b52f96096afeda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674409, "uuid": "b6f64afd-a842-46a3-b6ae-b96ea450805a", "comment": "Malware payload (Mirai)", "value": "a4d88d95dfc534026243ba4f015cc1bca597bff569e0f8451fbf74ce48fe781644054fee9022f5f4c8e72241938041f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674409, "uuid": "b6ca0cc0-918b-48b7-a932-c235b75e547d", "value": "T11F03E1A645550CA3C410EC77D9EF43C622178BF2C2EB26333310A17DB9936569A712DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674409, "uuid": "79b38de7-3b99-4357-b46d-d5093b1439fe", "value": "768:ZfEo4o0Xk9NrvN8w8nd9+BB0lclFl0gAw6qtpIwi3as3Uoz3:eo4o0XkHv8d9sB0lcI+p23Xz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653674409, "uuid": "f78dabcf-2eb1-4a37-b39d-d2306edd5b6c", "value": 39972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653674409, "uuid": "613854cd-ac57-4dc0-9dbc-b26c52cff5c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674409, "uuid": "abbfb89b-3454-4208-b6c7-b72e60b5bb99", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854845b0-ddde-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653670833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653670833, "uuid": "5c95c285-6011-4b9d-b3fb-27b95c0782e9", "comment": "Malware payload (Amadey)", "value": "ab40cf80b4bb9580f54188a7a46da601", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653670833, "uuid": "67cea8c5-52b9-4f8c-8292-659400776547", "comment": "Malware payload (Amadey)", "value": "84302e591874e2413c366bb5d62e431f529fdcaf276089aa92ab745e20b7a820", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653670833, "uuid": "7d111bba-ded8-41c4-80df-249cbc603bcf", "comment": "Malware payload (Amadey)", "value": "7ad26703fd3eb79394b9b3cc457bb7adbb63a113", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653670833, "uuid": "ab4918e2-421a-4f87-adbd-9463035b569f", "comment": "Malware payload (Amadey)", "value": "e55896a54d3b097c8fc19a16640096cba64f193c553217619a5e5cdd9a4ed281de79c26d7680fcf58b458c42ebea8048", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653670833, "uuid": "c80cb025-024a-4f6b-a968-f33428cd8913", "value": "T17B75124B36848888CF6E75F77242811427A7DDFFC90CD70A6BC52753DDE2A922816B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653670833, "uuid": "d003aee6-9fb1-40ba-ad5c-6ee42f78d849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653670833, "uuid": "2c72979f-449a-422f-8e7a-791835b2c164", "value": "24576:6WDCtb7X0Jl8pdEA5bhOeqZUiUKLYi/Fq6nnjqKoe:B2tb7X0dgtOTUyYWjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653670833, "uuid": "b46ede93-42fa-454c-9435-5f9dae9e2cc3", "value": 1632256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653670833, "uuid": "14ee9efb-39e3-4dea-a1c7-aa19e21e93e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653670833, "uuid": "877011b6-ae1c-4e9f-b04c-5d56be9e037b", "value": "ab40cf80b4bb9580f54188a7a46da601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496af722-ddc4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653659565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653659565, "uuid": "f5b7c19d-8195-47dd-a114-93e118f8cc6d", "comment": "Malware payload (Formbook)", "value": "b1fcf52deb6f04ef0f898c9938f26920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653659565, "uuid": "d0e814af-2b6c-41bc-b5a7-204f27561093", "comment": "Malware payload (Formbook)", "value": "8535282c1740725ecf68a65e9ce582a5fe28db4ffcfcd07e6b1516d62cc9dc60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653659565, "uuid": "3dd4cb83-22b2-48d1-834d-3971daa23bed", "comment": "Malware payload (Formbook)", "value": "42d8b684ff7b293c0d8ad5de6f67d14d17c0b353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653659565, "uuid": "8906a402-2f13-4c15-88e1-9672f084cb65", "comment": "Malware payload (Formbook)", "value": "c834e344d405563ed30970cd5d87cbc402b1465425a5e1dcae60059201ccec0f3b68fdf4ed0a4451d9f8723e8b99e3ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653659565, "uuid": "e6fe1b89-b8ae-4ba7-a3fa-4ddc67bf6060", "value": "T1544413003DC642BAEA9B183017EBB3EA29756320962763771B845F3EFD217DB9D050C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653659565, "uuid": "e6f28c26-e9ec-4420-80a8-4ffe0b81bee5", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653659565, "uuid": "084a28fc-478c-4ab4-aaaf-fe802f34aff9", "value": "6144:B0Y1JrmXdnF2ThJWmbKKCaSZ+VhO3BmIVKi/oM:lJrmXBF2ThEKKKpSoO3Q2z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653659565, "uuid": "d9c5b6e9-c97c-4618-b2ff-d93b4558295e", "value": 278417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653659565, "uuid": "11903dc3-5d68-4dde-b9cd-b3a2ec334ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653659565, "uuid": "55b2311b-aa05-418f-affe-7dcbecc1f5b4", "value": "lamsddre43321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b748435f-ddb8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653654596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654596, "uuid": "d94b743d-629c-4fca-b22e-ec97ccb1a252", "comment": "Malware payload", "value": "420f226de2598c3a2de1c56c9607055f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654596, "uuid": "e1a43331-713f-4a2f-b17c-8c9aec9e8b71", "comment": "Malware payload", "value": "85b26d2c71b2d64678749f5f1c338ac41d383f9cace83471aa946d56add9eca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654596, "uuid": "9a34dc7f-d6b5-4bab-b196-57de9dbfeb82", "comment": "Malware payload", "value": "2328b1afcbd3823cbd499a1508fd9506e85e3664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654596, "uuid": "a0750095-744e-4ee1-aaac-68ba769ebe37", "comment": "Malware payload", "value": "190e0b5d4e089437f4d6ce11eff9f352e03e51a17a452156aea8f92d45f379e3a6828200dc9d37f57ad2f3ed087123de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654596, "uuid": "5d97cd27-41c4-4ded-a9e3-2e2eb37caebd", "value": "T1E5D39D4131D281BFD865967199A88E81869FFE2129398F8B734D143F8C786E0477BF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654596, "uuid": "fd584b11-b3e7-4381-acb4-636294a2acce", "value": "568ce418a9b723ee7b6fd7d341d02902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654596, "uuid": "bc6144fb-fe64-4025-b638-25d5e29e795c", "value": "1536:NFTOG+x8+YaGDARvmJVBqNvnlajcCOO0LdXU8JiA1OynPl6zqjzswa+98qSIJnXR:efbnR6BqNvncvhwdYz2swteq4iG5sFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653654596, "uuid": "bc1aad7a-b313-4448-b201-7af42e90faaa", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653654596, "uuid": "73fb1445-2791-48a2-a0ce-816a70c0ec6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654596, "uuid": "a5c512a4-fd61-4124-8674-68ac62b4dacb", "value": "SecuriteInfo.com.Variant.Jaik.73412.21876.13745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2188ab8-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653662801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662801, "uuid": "69415e3d-6213-4814-9c28-aac73d884805", "comment": "Malware payload (AgentTesla)", "value": "a9819b4b8ca61d132faa30c59482c10f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662801, "uuid": "df41fc55-1bae-4108-a7b9-8ac89d4bacbd", "comment": "Malware payload (AgentTesla)", "value": "86a8ba97bde5b049538c73c0e8fc0484a0883422944eb5b988eec2233d004837", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662801, "uuid": "42cf383c-1da6-4eb9-b362-54354bc33f49", "comment": "Malware payload (AgentTesla)", "value": "226725a9f34ade061c288e6a6faddd944fec8868", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662801, "uuid": "a6e0b998-e6df-4cb5-ba82-e4f8e2c65437", "comment": "Malware payload (AgentTesla)", "value": "2d474245ef9176dc5e4034c77c4b5e044636965c137924afc2da68ee9c46ce3da300acb2a04597db88405088c1e0784f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662801, "uuid": "2eb1ae45-3145-4937-8126-e2b3a2eba6ac", "value": "T18EE40119F771A9E6E45C03BE3071183A2F64CB33E5BEE65D68A8711328742C6055BECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662801, "uuid": "5f1a000b-2d8d-496a-bb34-f90c1b345dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662801, "uuid": "859c7ca7-3dcc-4dce-977a-35a4a529c044", "value": "12288:m5lbHo6UHQKywl4DsE84eys2wSO4h0VR81ZnUv3/rWXMnM3jNbazUatGG:qbHoSY+X59O4mVRaVA6XIMz4zUmGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662801, "uuid": "41d15588-23f1-4ad5-beec-c1540df56c0f", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662801, "uuid": "82b70f06-afd6-439e-953a-30149c8dbcd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662801, "uuid": "a6e3d409-535b-4c07-b257-a3fab251d417", "value": "6R24hlXGVS56Z6Y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704448ac-dde5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653673804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "574d27ad-9872-482f-89b6-9c99860d39ac", "comment": "Malware payload", "value": "e4a6305453071029694a1f941133261a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "d2165158-2a92-4bf9-933b-b0e3d6a9b1f3", "comment": "Malware payload", "value": "87f9284961cbd6155b2dd0ce1c241b54f186a036e97ead7d091353c44afeb0ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "f2059371-65d8-467b-8915-d112c2459bf6", "comment": "Malware payload", "value": "da4be5db609d644f7468756f20996c8fe7a17d6e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "aa829627-57da-40ba-9abf-a21102ccfb3f", "comment": "Malware payload", "value": "7ae142ef05a1d736614a88aa20aa539814abe43314c10f0e33db40c38eeec0619856010a9d1d8f41d634fd15bb9a2ebf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "5195435f-a5f1-443e-9426-64dd7668f93a", "value": "T125C3945A6761CEB7E85ECE3B069A450110CD9D4A02DD6F2F72B0F61CE3AB88E45D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "ba506077-0ece-46db-95eb-4f71e45d1ac8", "value": "1536:C6SoeTAPh5Dae/NfexupyzbZ3UH1y6wo7IP84Xz+vg8:C0hffexup4bbqa84D8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653673804, "uuid": "03e34851-5082-4ee6-89ce-4116c70f7fe6", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653673804, "uuid": "1c3f2e82-8f5a-4d94-8825-7cd3338f2adb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "132268fa-c07f-4fcf-8ad8-373470609116", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95ce951-ddd6-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653667457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667457, "uuid": "03b57956-b77f-4c9f-bf9d-32bf7268891b", "comment": "Malware payload (SnakeKeylogger)", "value": "758f73b256a22282884a09408619b656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667457, "uuid": "c626b4fc-9069-456c-bed4-e907a71bdfb2", "comment": "Malware payload (SnakeKeylogger)", "value": "89549721ee4ccafc0d3dc13f7087dc16cb9287d1554b852123f636a0fa222e7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667457, "uuid": "505799a1-6c54-4cbb-89a9-d246dc7b1873", "comment": "Malware payload (SnakeKeylogger)", "value": "b077a8d7f03ceb2d01463f772fab34db6553f120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667457, "uuid": "1d9dc8e3-23e3-43c0-a47d-b3010c655d35", "comment": "Malware payload (SnakeKeylogger)", "value": "d8a9ad8d11227eb846c9ad133649608ddaa33fddee77e75129a853ec5ed38b9e4a4ae937df51f6e1f0edb47cb3b5c404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667457, "uuid": "c2333dae-102e-4a17-b798-42c4b484ec77", "value": "T1B0935CE2A5C8FFC7D5BB6234AEE176100B675B48281582409BCC261F37226DF7781B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667457, "uuid": "45b4712a-e57e-45c1-b955-44d302adfbc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667457, "uuid": "9d5c3b00-7976-4f3b-b977-c0ef3073a4f0", "value": "1536:uXtqyANul8ljRWcplgMPocPoJ4TGEWx4/2o:g8Gcwz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653667457, "uuid": "fcea5501-037c-41bd-adf2-20c5bd6698fa", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653667457, "uuid": "a4b82891-ad35-4cdd-9450-d51db2a823b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667457, "uuid": "cd248f94-11c5-4fff-b0d2-eb869a146131", "value": "Rrgbu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67020772-ddc2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653658756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658756, "uuid": "17105ad3-1189-408d-8c75-fbca9c65e932", "comment": "Malware payload", "value": "fbfac95d8df44f87609f0933f3643125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658756, "uuid": "b9577e03-48a6-444c-9cb4-93e11c335bd4", "comment": "Malware payload", "value": "89680c11045900705506af617e3152e000c96f45df1cb95d31dbd24e6ce3fc47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658756, "uuid": "996f335b-62c2-4a18-9a1e-ef58064df4ec", "comment": "Malware payload", "value": "9ca7910d1f1450e810db8bf840edd0cf608e2bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658756, "uuid": "141d75be-45e7-428b-a6d2-71057b04550f", "comment": "Malware payload", "value": "83a54e3ed5b1ab0dbfcbf916b055124ad6bcb17025f22fe19a26fa0a1395ca4b261ca4f2b0c3e8f6c23f0e3a5860bbe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658756, "uuid": "3185c244-0954-43af-b034-492f644ea65f", "value": "T1A2D39D4131D281BFD865967199A88E81869FFE2129398F8B734D143F8C786E0477BF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658756, "uuid": "f0380cd3-4196-4b77-a2b5-1d36ec5390ab", "value": "568ce418a9b723ee7b6fd7d341d02902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658756, "uuid": "4dd19388-70d0-42b1-bc06-1561c52794d2", "value": "1536:tBTOG+x8+YaGDARvmJVBqNvnlajcCOO0LdXU8JiA1Oy9f6zqjzswa+98qSIJnXSd:SfbnR6BqNvncvhwiz2swteq4iG5szq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653658756, "uuid": "31a22c91-03c9-4d6b-a3b7-94a1942df3b6", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653658756, "uuid": "f110aedf-b664-4b70-a9c3-accfca2457b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658756, "uuid": "56c813e9-6bde-4f79-8c68-98ba7a8445b1", "value": "SecuriteInfo.com.Variant.Jaik.73412.9777.23930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9a86c5-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653676482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676482, "uuid": "50ddf3c0-9e9c-416e-a674-a6e75f7600fa", "comment": "Malware payload (RedLineStealer)", "value": "567fc1c1b36202b6ebc105d918508731", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676482, "uuid": "4cbc1351-1506-4a42-ba0f-91bf2b3ae6f2", "comment": "Malware payload (RedLineStealer)", "value": "8a0241fb0a7b532549280c4e8e3b0a41b10ed54130c3210669ae0319b37f1547", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676482, "uuid": "acdaf195-0d56-4997-8de0-206b2ada6f36", "comment": "Malware payload (RedLineStealer)", "value": "53542147aaab16b5a7215130b22f067db06835d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676482, "uuid": "617657bd-d908-49a0-acc2-d8f3b9891b25", "comment": "Malware payload (RedLineStealer)", "value": "f21ed35eef8c53f42dbd703cb97e61cb9c6a289f663cbe3efb6898f882f92f07d8aa2336a391a78b517f41128a75e5cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676482, "uuid": "724b7081-523e-4223-aedc-68409bc93754", "value": "T18494E13072F19831E4556D304869C6B1173BBD326E34A907F784AB2F1EB3392ABB1756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676482, "uuid": "30902161-7f4b-490e-8581-7029441e42c3", "value": "936051dc8adff508935df6441a5fb70e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676482, "uuid": "9510524b-ee89-4a3a-8815-7cb1010674ec", "value": "6144:wZTUYXHGudMqHJe9B2h+acSPbFDAmBxRIp0mrAO5BV0gVcHigavwVf:w1Cud5HJw2fVb3Y0mrAO5M7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676482, "uuid": "03621613-ebc7-4601-8fc3-672e07731045", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676482, "uuid": "5ee0549b-d729-492c-9355-cc1d82c6d05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676482, "uuid": "69674b20-9f5c-4fae-bdc2-3d256746d3bf", "value": "567fc1c1b36202b6ebc105d918508731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a386395d-ddb4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653652844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653652844, "uuid": "bbd4721e-9a9b-48b9-b2ea-3caa5c023249", "comment": "Malware payload (Formbook)", "value": "8453fd3c2299b4c12ae7f2b024fe014b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653652844, "uuid": "56d40e43-fbb4-40d6-a93e-69280106253b", "comment": "Malware payload (Formbook)", "value": "8dca7773c881a5f13083046667a97227e4d2ff0b833300ae8b9ae731847dc7ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653652844, "uuid": "4ba66198-1368-4104-b03f-d7af8a2f6f00", "comment": "Malware payload (Formbook)", "value": "f80473a6c85cbd017e2084a825b7f5fb841e908d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653652844, "uuid": "5155b904-193d-43e5-9610-8727c5d3798c", "comment": "Malware payload (Formbook)", "value": "b78e609d3134d8fbb9ffefca551472c169bcb8a1fcc9c0acb094dbb824a4b2f9575841d600d64b5dc5465891f173948a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653652844, "uuid": "e9bec317-9da5-49d2-893b-cbf754fb14f0", "value": "T1414423F433D09EBBEA421A3256779B95C679F3016011030F13108FEB6D2685CDEAAEC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653652844, "uuid": "be4904b6-98ae-442c-a77f-7a1f5cc9abee", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653652844, "uuid": "3f742147-d751-4824-8777-59673badae2b", "value": "6144:B0YXcERD92TFZd5rSUgGSEvV9c+9FdWQEWMh3eoCztxLd2cm:cEr2XrOWLc+9fWP6rQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653652844, "uuid": "d931eab8-cd74-48ae-b9bc-6364160ccec9", "value": 278429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653652844, "uuid": "94d4cacc-b158-4e6e-98e6-7a4cf801cffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653652844, "uuid": "b51dd0cd-d50c-47e7-af60-71c4aec83920", "value": "Kredi Karti Hesap Ozeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b840543f-ddaa-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653648584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648584, "uuid": "890c5d0d-8026-4e6a-95e5-849d21f1a61e", "comment": "Malware payload (AgentTesla)", "value": "21c2f8cc3f1d71ffb036ca3788a346b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648584, "uuid": "874f575a-3590-477a-bf4d-5b89d843c5fd", "comment": "Malware payload (AgentTesla)", "value": "8e68ac628396cbb8619a54ffce8aedae2a20ca23e514813b70c99987175f735d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648584, "uuid": "99c214a7-93b7-4339-92b2-95d0630485ad", "comment": "Malware payload (AgentTesla)", "value": "b1f681eb0c5b406bad2414829d003568ab44982c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648584, "uuid": "35f332ad-e048-4e34-a567-e130f9fdcf2a", "comment": "Malware payload (AgentTesla)", "value": "44a8c947145b0a769d6f02807fd8edf30769e6537b01d9922b4733d5bbdb1dbf87addbf076d236f4958193505742295e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648584, "uuid": "e07536dc-130e-4a26-9fed-6a23d62e0cfb", "value": "T175F4CF20F71FB8D1D66EC6740BB686221EA14D7EFCF9921E5597314B0A31392601BCAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648584, "uuid": "10c0fd15-7596-4c68-9d59-3111935ce023", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648584, "uuid": "50f02353-43e6-4b51-b4fd-6c59c94e8573", "value": "12288:/52iNKUwVRh6UkRKstKDBi3x0Z5S2EetsSJhjsudQVYJUEKl75jQWmc:x18Ph6UkgstKFkYS270u2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653648584, "uuid": "ac5a6aad-b469-4e5f-9e89-b05b7b15473c", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653648584, "uuid": "1c68664f-0d32-4927-8f69-b373ae589a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648584, "uuid": "0963e4fd-8d29-424d-8acd-b7d42f09138e", "value": "Overdue invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ba7abc-dd98-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653640896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640896, "uuid": "0a3fdaa1-5099-4f01-87e1-db63b54f108c", "comment": "Malware payload (AgentTesla)", "value": "a2d2a8f69a956b2eea59b72d0eb37e51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640896, "uuid": "60670ea6-4a29-472f-83c0-2e35bce3ce0c", "comment": "Malware payload (AgentTesla)", "value": "8ed13e4fb92eef7aee7b0a64e9a77c702327206d71ea5cb0806d987f1b14ea9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640896, "uuid": "db671567-f39c-486d-9aa4-d4a8482e5a9a", "comment": "Malware payload (AgentTesla)", "value": "beddcf1be9bf664e69e98619ec602c02331cef7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640896, "uuid": "ef99489b-19a3-4a2d-ab34-8a312127aaa1", "comment": "Malware payload (AgentTesla)", "value": "4285a6e39a99b1628b3f0ea24ee0b645b5d46f1693dba5b9e118231f194423535e8ba7d6ebf863edc7aa61a5b399c6f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640896, "uuid": "c70eda37-ad00-4813-bf38-d7e064dbdd3a", "value": "T1ECD40208E726EAD4F55D43BE3078686A3F228F22D6BEDA5C65A532670D353830547CCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640896, "uuid": "c5c8f47d-b5ab-481e-9a40-a5d08f0a7edf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640896, "uuid": "b7c788e7-63e5-4a39-a198-feab8d3cb307", "value": "12288:w6bHo6UrkA/YGnGwKmMTPtL6Vx4ntta98J4SKQwVHvelG1gW4kZV:w6bHoDwNzmMTPEGfa8jwfL4kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640896, "uuid": "a5247d47-e50e-4ad3-929d-c2f453d64b51", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640896, "uuid": "a4f1ae2e-6486-4526-b6c5-0e0976a6d52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640896, "uuid": "1de6668e-20e1-4847-a3b2-116ff8c60eab", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9048678-dd90-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653637526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637526, "uuid": "121e3344-9c28-4798-b570-9c327a7677e9", "comment": "Malware payload (AgentTesla)", "value": "65af9385f975922b2345fd3ad87f25ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637526, "uuid": "9e226029-3b52-4606-9c5f-40dbf6e2cbca", "comment": "Malware payload (AgentTesla)", "value": "90dc5647df90ecdefb419df0effd8a627178d6e53738a3e1d415bc214b41e7bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637526, "uuid": "926716cb-6c55-43c6-9a6c-374a80ebd451", "comment": "Malware payload (AgentTesla)", "value": "e181a2df62077ab9c6a159ff5f22aa9d89a8c8fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637526, "uuid": "5c44ca5f-1645-4e83-beb0-31081476ebb7", "comment": "Malware payload (AgentTesla)", "value": "998c5141776f6dbd9255d97082ae862f06a8c09ed3f5892af9f707370e1964179a1011214446a9d48d6ff17f2bf35927", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637526, "uuid": "81a027a8-2a69-42c0-a349-c33b8f9410ed", "value": "T1DCF4234D1DA46AB2484993941C704BE50D0CFF73C93E2BC1AE9B58AC57A1F4F1EE9E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637526, "uuid": "27d25f5c-97bd-4f0f-977f-9be4fff0523e", "value": "12288:kDI7Fy7WSJAmqXGrIK8ahzXMxF+i++M2k4+6o1dLj/pOrBL04FzFW3:0IhyLgCoxFc+vj+R1d//0Zzo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637526, "uuid": "154d464e-2c7b-46d9-ad8e-350e5eb87f7a", "value": 751735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637526, "uuid": "6676271d-ff0a-43c4-bdc5-c1164968fa19", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637526, "uuid": "61e01138-b3a4-4445-91c7-230bf84ad9ad", "value": "OrDer confirmation may#05.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8a94b6-dd91-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653637591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637591, "uuid": "54db8be3-97ef-43a6-baa2-1407b4b06837", "comment": "Malware payload (AgentTesla)", "value": "0f56e2caabaf43e38abbd8549d1778ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637591, "uuid": "63c18fbc-11ee-4ded-946c-2f56aadc11f9", "comment": "Malware payload (AgentTesla)", "value": "910045367d6c147ed5460c2b0759ee15daca23f8ccdafc19fd63ab91944e27cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637591, "uuid": "59352e90-948b-4a52-867c-62c08671e866", "comment": "Malware payload (AgentTesla)", "value": "cd5e3334f7c04484d73c82c0f788f6638013460a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637591, "uuid": "2336e706-05aa-425d-9d5f-984054874db4", "comment": "Malware payload (AgentTesla)", "value": "8251b4070b82f24eac35bd5e202a57b6197b5801c99b4b4ac3611566f1b46a1279dc09b2aef3f80d9f15407cf595e681", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637591, "uuid": "960fcf21-c23b-4df8-9161-710da6bdbb55", "value": "T16FE43395CC88E305BA2C67914FD9076776E53B7CB2BA6022D85D93F7FF20526350E019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637591, "uuid": "65393ff6-ca2f-474a-9ffc-aae674103a22", "value": "12288:5qQg+d7PuME1njYGd4fPS0VF8bm84rp2IR3f4vrYXDpRChUW0rRhEdmrd9:5t9r862oPShbm8492NTYzpRyT0rfE2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637591, "uuid": "fb33691b-4ee2-4589-935a-78ac3b917144", "value": 671186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637591, "uuid": "f7705e70-09f4-454c-8715-d23c4707b3e1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637591, "uuid": "fad87655-52fe-4af3-8b46-cac693a379d2", "value": "TRANSFER\ufffdNCIA BANC\ufffdRIA 1517796961.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b60d28c-de0d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653690814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690814, "uuid": "86fe6a57-bb40-4432-a2f7-f65e811e6ad6", "comment": "Malware payload", "value": "04858f157cbc75691cf99d31d54738c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690814, "uuid": "24d2c960-0c9f-447e-8ce7-ae194ecb3f4c", "comment": "Malware payload", "value": "911e91e3f8cd094d3895c756b2ff736796203d0bac1134b8e79868b033a35a7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690814, "uuid": "85cdce45-0c15-41d2-a584-18288f925cfc", "comment": "Malware payload", "value": "613c6958b2bd2aa4bb3628dd8d1eef10e6046437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690814, "uuid": "35d5afca-be0d-467b-a8ab-7cbc2003a049", "comment": "Malware payload", "value": "82a1dd7f671eb55f5103d5173b330609ab82c75bdfc6f1e3fff3d3426779ba6d3f3192b2dd49dbd06ca24856c4b3accb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690814, "uuid": "8556cab9-9f93-4af7-99e5-3b5205303b40", "value": "T1DB75D0A1ED497FF5C19148F279382592F02C2BDE8640E4F983360AA77B1A950EDF31D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690814, "uuid": "00d1031d-2f01-49fc-b409-6a7b4853a36f", "value": "8066c16c838a608909d3b67f238a0b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690814, "uuid": "7d03f2d3-63d4-4079-930c-74e50bcdb433", "value": "49152:8VORjZhBfJXAE9o0uh9hOmrCoj5yJuzRAW:cORjZhBfKEFuhbOmrr9sQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653690814, "uuid": "eac5bc0b-780f-47a0-97c6-3aa98beb8023", "value": 1694818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653690814, "uuid": "e89a6d69-f20b-4cee-b8b0-f925f6672613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690814, "uuid": "8f87ee28-359a-4957-8c2f-07d6a85db0c2", "value": "SecuriteInfo.com.Trojan.Uztuby.4.7690.27181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c06b76-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664946, "uuid": "2cf5aec5-7b16-4423-82b2-e39ef3cde149", "comment": "Malware payload", "value": "a894dcb45acd54f179e75dd37cbfdfa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664946, "uuid": "8ffe32a5-b819-49a8-a387-454a8997b6c7", "comment": "Malware payload", "value": "914fd9667b3c7ecd0447a93c29543cf111d049be1fd6e4bcb88c9a69287582d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664946, "uuid": "dab15329-93b8-42e1-895d-9de824146623", "comment": "Malware payload", "value": "42cb8a809cb6c799bbc39069407df6156a75575e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664946, "uuid": "e8d078e0-60e8-46aa-84de-09250c4e0759", "comment": "Malware payload", "value": "db64e8bfca63a5f8a65daf616d4562ed840652f9e4f0e0e0437921e45bc7103780aa851b1ffa865a4ca646c8e30b31b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664946, "uuid": "686f4a89-1fb3-4f44-8da4-7462ad8522b8", "value": "T155D4C0AC329071AEC567CD37CDA81C10AB71B5AB5707D60BA05721ACAD0EA9BCF115F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664946, "uuid": "4d5e6596-1dd3-40bb-9e78-b7bd5560979a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664946, "uuid": "81902cd2-ce0e-4faa-b50b-c8060423514c", "value": "12288:4ERbJeRWMEZbHof775Uo/473UlojZ5khOTXBPr3yuqXXT0qa:r8Y/ZbHoTGo5lo9+hOTXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664946, "uuid": "ab61e0ea-c377-4a0d-b849-73455be8279c", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664946, "uuid": "a03037b0-2e11-4d26-a283-0f14a99ebdd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664946, "uuid": "40cff61c-0bc9-479e-8e66-5a1acca0b997", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1f0abf-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653664747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664747, "uuid": "9f13d73f-cc34-44c5-9ede-f918a4144c67", "comment": "Malware payload (Heodo)", "value": "f50dcec77c9a81bc3669899a4beec555", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664747, "uuid": "64a4a7cf-3f58-457f-8d71-0ef25c5998fe", "comment": "Malware payload (Heodo)", "value": "916ab265a68da288d1046dee95aca6c9b471b404a52a03c6e35bc2365521f2f2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664747, "uuid": "c48efc7e-e726-4eab-b416-68ed005da03d", "comment": "Malware payload (Heodo)", "value": "a610d036836d2a783ed0368fe8a84b3f1cc5be98", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664747, "uuid": "07254ce5-4352-4a0e-bc3e-02da5d665dad", "comment": "Malware payload (Heodo)", "value": "b7e4af861cb7539730bf06ec57eaf5b7f5c9e92382ce9b9143ecb69ce630d9bd8c7c340871cef7c1e7af322e725bd99d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664747, "uuid": "5d8e8588-7a2c-488a-89d3-c40d91eb91db", "value": "T17194CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664747, "uuid": "cce9c66c-e4f3-4b7a-a86f-2664e18555b6", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664747, "uuid": "7d2acee4-9f09-4c5e-b9c8-26e45ab58e9c", "value": "6144:I9wEpo6/4WaPgMIuxqqKAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqKAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664747, "uuid": "7d8e2cd1-3e1f-4639-bd66-4041dd5eec4c", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664747, "uuid": "249ae1b8-c2ab-457b-88d2-2cd2b7a885ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664747, "uuid": "84bfea31-081d-47ab-b6c4-58b3a4e5decb", "value": "f50dcec77c9a81bc3669899a4beec555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cd1f4c-ddfb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653683391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653683391, "uuid": "11d17527-fdb4-4e15-a92b-accb5d3fce8e", "comment": "Malware payload (Heodo)", "value": "cda1ddb3f94c25b4b787fd4bbb9641e8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653683391, "uuid": "fa5001f3-0dbe-4607-b716-08217caa74f5", "comment": "Malware payload (Heodo)", "value": "91777d1c3a88f8c324d1dc16007113aa070c718f234e9dec05c5c2930fd39edf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653683391, "uuid": "ef958e34-27a5-49c0-af01-b570bc6cbca7", "comment": "Malware payload (Heodo)", "value": "dd03a53ad84d258af9112eeb52b17a91d5a5a74f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653683391, "uuid": "b7485f4a-0732-4875-9fe0-92c09241567c", "comment": "Malware payload (Heodo)", "value": "3f25e0bfe0146f2423e8a9ad400cbeb3a34163793566ae55775ed567fd8611f5fb893d1574604052f68000f84fa3eb1e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653683391, "uuid": "6c76d3d4-9466-46d8-b91b-eabb6fc355a9", "value": "T1C6634B59B76A885EE9198B3048F747D62323FD308F6F0A433259F3926FB9590670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653683391, "uuid": "95233d0d-dbd0-40c9-a250-42b7efd26419", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+4+hDcnTLiQrRTZws8EV:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653683391, "uuid": "97f0c065-fb1a-487e-a7d8-dc0cb65ead27", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653683391, "uuid": "ad3a8377-26d0-4dbf-89b6-33999c363d1a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653683391, "uuid": "c7b8e22b-2902-4ce4-874b-843e701f94f2", "value": "SecuriteInfo.com.Exploit.Siggen3.32798.28880.12294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b370b8-de10-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653692496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692496, "uuid": "d8898bd8-e43a-455f-8178-8fe51527e8c7", "comment": "Malware payload", "value": "e04ece9daf6fabc84e7454581ea95d34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692496, "uuid": "75dc8b7c-df0e-4e40-817d-d2250a4255cf", "comment": "Malware payload", "value": "936f909c7a19debba079ab7b812bc3e5360c163cd6b3c576c6d56b5600e12040", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692496, "uuid": "2f0b9126-9039-4a95-8d8c-e2b26192ffab", "comment": "Malware payload", "value": "37073b690c1973fe5540041022c35a290fa473cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692496, "uuid": "b9f1df10-6432-4b2a-8faa-eae2392b56dd", "comment": "Malware payload", "value": "cd23ffe1004036c48b93504586c439008d42fe710e0ff43671d0e19f7e4d6fb5651384896c6d3b2c3f6f48b1f5e11c6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692496, "uuid": "67649fc9-8289-4f8f-8202-f4a29ba63dd1", "value": "T108E2E16E37A44C16D4BB81349BE10BEB2CA193B011434C0A58B8E5869FB3B983813FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692496, "uuid": "bb31cc1f-0e29-4a8a-80b9-71b00ab66da9", "value": "768:z9sTBzZku0X1UgjyUagk53DQJgGlzDpbuR1Jt:G1ZdGNpaH5kVJub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653692496, "uuid": "27fee71b-ac53-480f-a020-3e9a6e531b63", "value": 32052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653692496, "uuid": "ef7b557a-b0a7-4811-84c6-aaa7a31cca78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692496, "uuid": "d20c7b0e-b2a2-4206-9daf-d47dd7aee23b", "value": "e04ece9daf6fabc84e7454581ea95d34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12a8e7b-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653665001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665001, "uuid": "764e9719-7ede-4112-bdaa-442f7f4a6a55", "comment": "Malware payload (Loki)", "value": "482fab891603b92d40aa76882630effc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665001, "uuid": "2abacb8f-5ad3-4e8d-b548-0caf1e16546c", "comment": "Malware payload (Loki)", "value": "9379205d31d2dc52230c2a39571a363856b53a609d5f79bea0e2f3f4ade473c4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665001, "uuid": "9be33bfe-f6b5-46e1-88a9-79f3bf937a8e", "comment": "Malware payload (Loki)", "value": "5cdf4b41d10f0fff97290852b458debbcf5b88bf", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665001, "uuid": "ce1bcd83-6a34-4c11-a599-55b27845ea46", "comment": "Malware payload (Loki)", "value": "d82c588f93a05ce2921e47881696caa4558c696c374ffc5ea8a7db59076fbc55dfa47f9df8021e9e7b15b02d0875244b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665001, "uuid": "63806e99-a03d-4031-a34a-3c7e8043cb10", "value": "T16835020072F85B22F2BA67FE6571618407B57D996920E34D1CC178DB3B72F428A91F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665001, "uuid": "7d401c49-6345-4bce-9589-2c2a88d51f7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665001, "uuid": "dd0d01e3-0308-4202-ba68-be9abc3141ed", "value": "24576:XXtCbHoDfNPOSoUaXXR0QhrAAW0GRBgSCT9KlctwqvXXT:XXtBfNPMjAAaBgzmcq2Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665001, "uuid": "2019f470-9ffe-4f52-96bc-4c7711a89742", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665001, "uuid": "4d08ee95-09d4-4cfb-b4ef-0bde756f208f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665001, "uuid": "9e3bab44-18dd-4506-b06d-b05d5c8a9f4d", "value": "DHL EXPRESS DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12789957-dd9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653641434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641434, "uuid": "c943071c-a120-4ecc-92f4-4aa148eb6a58", "comment": "Malware payload (Loki)", "value": "c613b6ef47832023fbeab2764ebefa3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641434, "uuid": "467830b4-67f5-4f24-ad20-acdc356fc7b6", "comment": "Malware payload (Loki)", "value": "93a317a5f290db61efb5033014e0933a944781482826d4972d0ced23779c8580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641434, "uuid": "111b38c8-1321-418d-9d53-2f1ec0f13c72", "comment": "Malware payload (Loki)", "value": "f5e5454348c77d13121da05e7359574e6659eb09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641434, "uuid": "5603bb05-5c74-4e37-8c84-0c2e6699a581", "comment": "Malware payload (Loki)", "value": "ef2bda56112347afc60af9471687ac6647e8131ae381178d8b236d3b62183199d8d7d9bfd655aafd32953813f73780d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641434, "uuid": "876cdf45-4109-48fc-ac2e-14fdb41df422", "value": "T1CED4E00072F81F22E6B667FA9574518007B6BD986520F39D1DC1B8DB36B1F928E81F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641434, "uuid": "b7d45b94-af59-4a2b-8d1b-9114934f4021", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641434, "uuid": "7f29f095-d80b-44c1-834c-bcb57d8bda98", "value": "12288:mC8ZF229bHoAUdvqVl5CjeCs4GGpybiRG/rdF3OhjYV0GM0lD:L8CqbHo+5CCCskIiRGZF3OxGM0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653641434, "uuid": "d18fc3d1-f5f7-4d39-a61c-9c5390a3cbac", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653641434, "uuid": "23317d3b-d452-4b78-b3a7-408c8e8de65e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641434, "uuid": "019d8787-ba7e-4f63-a720-b50f93474f9c", "value": "Deposit copy_pdf_________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39026ca1-ddad-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653649659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653649659, "uuid": "2981be3a-636e-4d22-9182-b9936d531ae1", "comment": "Malware payload (AgentTesla)", "value": "ac1ab437659894ec6c4e1d8fd5220d9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653649659, "uuid": "b47ef4cc-26b4-4efa-988f-6c4ce438f49d", "comment": "Malware payload (AgentTesla)", "value": "9403f699ee5317f4708ee2ff6d0e5419950499c33dc61ab8b0fb51e8976761c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653649659, "uuid": "beec46c2-0dda-4961-ad8c-46c1bdbb49ca", "comment": "Malware payload (AgentTesla)", "value": "8d548bebf27967108dc6ffddb4b24b16d29e5da3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653649659, "uuid": "a31d92e7-6106-462b-ad9f-87b22a9e958a", "comment": "Malware payload (AgentTesla)", "value": "098f3e76d64763ee7937613284f06bfe6101a610e807ebfc50776634ceb10007227b84951201e7a3dc17babe6f69927f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653649659, "uuid": "b3596368-e279-4ee7-88b8-3512c2bcfb8d", "value": "T13005E19C3294B5DFC5A7CE36C9681C10AA31B9AB570BD60B6447229C9D0EB9BCF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653649659, "uuid": "0f535cf6-62e6-4db1-a97f-caf28e7cf2a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653649659, "uuid": "77fdcf0d-e193-43cb-bb9f-05ba51e1efef", "value": "24576:gcI3ttZbHoQXMWPYGDer8PpviG7DKDtZJ:E9tZXJQ/CpviG7WDtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653649659, "uuid": "f05c0601-1d1a-4230-9165-bbf6a27dd3f0", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653649659, "uuid": "0d3c04be-6c89-44eb-a7a0-4e8dcb32e23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653649659, "uuid": "4a5997ce-a9b9-497e-9934-9b03b672790a", "value": "document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4aa7a1-dd8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653635488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635488, "uuid": "6531f373-74d5-4e24-a1d6-7dc4356a218f", "comment": "Malware payload (AgentTesla)", "value": "d65224a1eab8e62f3b12e5c2b196119d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635488, "uuid": "0f4705c5-2202-4db8-a77f-12b0622240ec", "comment": "Malware payload (AgentTesla)", "value": "94705c6aa3721b25a2944e6b0e06ca27fe7e9c74bb8ed1e30f51a8e8e7e13f6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635488, "uuid": "0bedf1bd-25de-49d1-9930-dd80ca3bac5b", "comment": "Malware payload (AgentTesla)", "value": "cfe9f49e3fff0f722db0aba264425c8a122befb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635488, "uuid": "ee423890-9cfc-4cc5-9ed8-3b9b97387fa5", "comment": "Malware payload (AgentTesla)", "value": "a276254ccfcd038de3e32bc55e2f1e7c434b444ae570670039779533a74142973c27bb9aaff0299e7e7a2456d19e228d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635488, "uuid": "a550065e-e42c-42db-9839-9be92bf1db9e", "value": "T16BB4E0B17FD266A7C2028934E411A5B489577E26E6C0399792D0FF3E33346C3918EF69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635488, "uuid": "982c39b4-3028-4ec4-bb50-a68e686ca316", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635488, "uuid": "dc8733a8-5e3f-49d5-b34c-919e4aa19420", "value": "12288:Mr8PX8q1L9gHkppK4vBhrTeCm9TVp0U8lX2xMOyV:MoPX8q15RRBopp0pp2iOyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653635488, "uuid": "fdd57bbb-84a5-46c2-b41b-4d0a2ad5f4fe", "value": 530940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653635488, "uuid": "e950e5d8-816a-4f3a-8dc1-08cb50be922a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635488, "uuid": "f695d0ed-6346-4cf2-a8db-e71e9f4e32d1", "value": "MHD009765432345600098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf3756f-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662794, "uuid": "6eff9a1f-c71f-456e-b0f7-6656448c2c1e", "comment": "Malware payload (SnakeKeylogger)", "value": "e79a08124edca9beeb1149f1cf990a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662794, "uuid": "0b2ea591-2617-4977-96c8-b7069805153a", "comment": "Malware payload (SnakeKeylogger)", "value": "9499f943a7a565c8d70540a2ff6bede1d0aa705d3829c9ec95b9bcdcd540dacd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662794, "uuid": "f018badc-223e-4d01-8a7a-c2ccc44f7fe1", "comment": "Malware payload (SnakeKeylogger)", "value": "0b721d375782019f8b17cfd1c4b27c3eff5ff595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662794, "uuid": "c73478f5-8df3-40ca-a49a-e25b634ed25e", "comment": "Malware payload (SnakeKeylogger)", "value": "a53892b31abdd5cdd826a02757d600884f4019c30dda4d8ebb02bc3637891b17d356ec84fc2bf42ac42664915aaa166e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662794, "uuid": "1bd8ebe2-3159-4306-bd14-047d56db89ae", "value": "T11AF4CF9C3650759FC997CD36C9682C20EA30B4B7570BC247A05726DDAE0EA9BCF251F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662794, "uuid": "8a90c7bd-b807-48a6-8b3d-18fc0010614c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662794, "uuid": "5609c7c8-d251-422f-98b3-f3289b213ecc", "value": "12288:LnrKl2PIl3h5rZbHoMpHrdOEDFq5qPwkYfQKpLhIsrnstdVyedEVfI8XBItdHEh/:Kl2PAJZbHoSLdpD4Z/tsMecc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662794, "uuid": "ace9b9d7-7568-410d-93b7-ed73ddf1f74e", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662794, "uuid": "29b3d263-9e5b-4537-a2fd-9204cea701aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662794, "uuid": "5034fa37-9ea7-4801-8dfd-2351b2a5f4fc", "value": "Swift.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cdf865-dda5-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1653646290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646290, "uuid": "79ea7064-0c30-4e17-9aee-cd9f200e39ce", "comment": "Malware payload (NanoCore)", "value": "7b9392669d33cd537e9bea9fc87e89fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646290, "uuid": "15be0113-1208-4568-af70-8d0047901092", "comment": "Malware payload (NanoCore)", "value": "95e3fdfeebdec138b182bb78cb8fde463f7cb47348bb182872dd271cc742c2bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646290, "uuid": "7b68177f-a307-4d85-8a05-368769fe7868", "comment": "Malware payload (NanoCore)", "value": "b3a55dd24565a0ae0f61949ce794887c3335d8b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646290, "uuid": "841ec9b9-56ef-4f0d-ad39-9bda09dd350d", "comment": "Malware payload (NanoCore)", "value": "9f9bd86949d5bd5b235566e0db9ef8168375343d29566927285fd6df3a13be95f3eb6aec8dbf99c5b978c0be5f605d5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646290, "uuid": "828de291-69f2-4312-8f11-36169fd58e62", "value": "T133A44E2E7B351A72FF0F81BC49510A24FBA62F533240A9D757EB15CA8B5F0671D0AC89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646290, "uuid": "906dafa5-54bb-4932-b263-9d4ce5cfa733", "value": "6144:3vcbgSCxgBYipBkXCy1kjNQEg5/JnveaRreeZ4NJxmiVfVt00bf4bHM+:7SsgbCXCy1k3gdpeaVoxFxVt6bs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653646290, "uuid": "f6ed5e7b-c200-40c0-ba11-f5ee0ad66a25", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653646290, "uuid": "99a2d6b5-7122-4e6b-9424-bad307edcfa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646290, "uuid": "b0e729ec-ea16-45bb-acef-518921bbff7b", "value": "from-isoCORPOR~0.EXE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43a7ce6-ddd2-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653665784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665784, "uuid": "3f3a3d4c-5f89-4c16-b4b3-1a37c80f5579", "comment": "Malware payload (RedLineStealer)", "value": "a8fae49a7ab484664af2bdeba6d1ee3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665784, "uuid": "b097ac97-6e00-4449-8044-c2065df16f7e", "comment": "Malware payload (RedLineStealer)", "value": "969f33bb41806f2bf8ec1720a87c3b7ec8822b98d3b6b9ae64b455d808dc659a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665784, "uuid": "545dfe80-de90-4ebb-978a-bccbc3c00bc0", "comment": "Malware payload (RedLineStealer)", "value": "250bbcd7793a579490b8498a80269119a7493560", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665784, "uuid": "9db61053-c25a-4247-b8bc-b5bdf0c2722f", "comment": "Malware payload (RedLineStealer)", "value": "0ab8048e97e33b7462494e49bb7f5151e5cf13c528597bcfd6b8255886df7a85b98de8370ebad3a8b3666653f8088802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665784, "uuid": "0cd65a63-01d7-4740-a447-1e5fd54db6e4", "value": "T118355AA3C342961FE3537834C19CAA71A50623722A1F78A3A7085EFDD73B1D15A79B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665784, "uuid": "6f419b1e-7135-4b61-8333-2864618033b9", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665784, "uuid": "bccddfe8-ab4b-48db-9631-7d91b7d050f0", "value": "24576:wwHQfzLSwL9Hukav+RcOkhekwxby5gkXdUrJRQLSSrAB64z+KmmpnMWg3FKzDcu:JQfzLSwL9HuVvx7gbQLPrABV+KmmpnMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665784, "uuid": "fea82757-e429-4d03-ab48-bc91f30353ac", "value": 1116640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665784, "uuid": "a263a73e-65f0-4fd8-9573-53f6bc87acad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665784, "uuid": "76a35830-6fa4-4e62-9821-6e53bae0d7d6", "value": "a8fae49a7ab484664af2bdeba6d1ee3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ae3460-ddcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653663527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663527, "uuid": "81614518-9b83-425b-97e7-0b68fac92520", "comment": "Malware payload (Amadey)", "value": "0bc087a91f55a067650c6751852c42f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663527, "uuid": "e948f74c-a19a-49d4-b627-994b9d67b844", "comment": "Malware payload (Amadey)", "value": "96ae1267c59482bfde38c68a655c0b5094ceab52d83ccf7ffd185bc1891fd818", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663527, "uuid": "dee3536c-47a6-4656-b703-52fbc23f29f8", "comment": "Malware payload (Amadey)", "value": "d44bfec4c2fabf84d83d97fbdba63c6a5358e0d3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663527, "uuid": "fcf2e135-33e9-4cee-8272-2ace7ecfd14f", "comment": "Malware payload (Amadey)", "value": "e20b71d080098711dd350242e3d540a64e14f90c9c2c424c60418e24edad9aa8e0a8c2ead1f63b5c08b86a96bff2c452", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663527, "uuid": "fc67cada-4f3c-48ad-b35d-52757a65736f", "value": "T1B6C35C73F1D08872D0B10E7C9D5AE6D86A3EFD202C35165BB6E94E4C693B2C2295D2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663527, "uuid": "331ce58e-5429-4bff-a013-2459a2014a36", "value": "557f0c64436e04f97f66ceeb0911cbf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663527, "uuid": "be0a5918-0445-4796-8084-e191fd640e61", "value": "3072:zx7p5EJTJ3SGrsnULXtoGSwGZ0FwVoSJikAQe9:zx7813SGaULBqVoci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663527, "uuid": "b5156c23-08ef-4b12-ad98-fd6bedd5fa3e", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663527, "uuid": "7c3e0ffc-acb5-4e86-9d53-ded134460d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663527, "uuid": "baa0179d-4c92-4309-bad7-72f3083212ac", "value": "0bc087a91f55a067650c6751852c42f3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c77dd8-ddc6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653660638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660638, "uuid": "6741de00-a249-4ae2-816d-68e520aa37d4", "comment": "Malware payload (AgentTesla)", "value": "a95183abde70960bccc37b897ccd0699", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660638, "uuid": "da111214-5582-4335-a32a-d69fe35eb2b9", "comment": "Malware payload (AgentTesla)", "value": "981affe9133f68da268a562ad4c6f16464b7d00e4a596bae4516e984bfd04cff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660638, "uuid": "263fc03b-7bcc-44a0-882d-2235ca3c3cb2", "comment": "Malware payload (AgentTesla)", "value": "21765fad9cec8831ef6e7361076abd779f4bf68c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653660638, "uuid": "7cd9c23a-c2d9-4294-b507-e88f6b10459b", "comment": "Malware payload (AgentTesla)", "value": "1e42a7d9cc157fedaba34f8687c3ec722f3fc0cd02643d8787ea8530f52343dc8c09d5dedfa79c00c436db654995e546", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660638, "uuid": "3dd9bdd4-7905-4d74-b090-c27218c67b98", "value": "T16315BFBC31907DDFC817CE7985985C649A202CA6470BE203A01B3DDDAA7DF968F156E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660638, "uuid": "08df390b-ff5a-464a-8731-2f23d29b2b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660638, "uuid": "76ddec2d-07e0-42f5-9085-ad193a667fff", "value": "24576:732dT2XreSkbHo2xS6OVby2+eIjErm4KUGhwGG:DbuxObtI4rShwGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653660638, "uuid": "a137fda7-da2f-4145-af7f-4233005baffd", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653660638, "uuid": "0b006476-70ab-4a7a-b81a-d1630e1dd764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653660638, "uuid": "728fe139-db54-47f1-927b-f3e287c53d82", "value": "DrYFu0WLwMjz5fY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1596b7a-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653643902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643902, "uuid": "776d0e5c-e753-4da0-8d30-ccc699476f2d", "comment": "Malware payload (AgentTesla)", "value": "26d9bb398ce580caaf8f7b5bad1bb5ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643902, "uuid": "ed6028cc-eece-48ba-98c3-63e4e0a2dc5b", "comment": "Malware payload (AgentTesla)", "value": "982db0853d9868dcb6a32ae83fca87e54a9ddbbb00990c75e9add025803d94cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643902, "uuid": "14e54f28-4471-4171-8048-2562066c8d03", "comment": "Malware payload (AgentTesla)", "value": "ebe425d08f2e036b05562a7fa12ccdd71d02e966", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643902, "uuid": "14b04e49-819a-4067-9b15-e9bb2d93f34c", "comment": "Malware payload (AgentTesla)", "value": "b7bdc8ed49c3b4f691d55b4f572373537c0268dbc21aa193be5d17e565b58583f60d73f8fc7aab44c2a782455b07bf8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643902, "uuid": "df2602d5-cc5d-4081-95bc-05c793399239", "value": "T1FB059E48BE0EF9CFD14BC43595749D68DA2062AF7F2B8113A43715DEA52CB439E128F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643902, "uuid": "432bc9ac-2694-4345-bdf4-456dc63ee13a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643902, "uuid": "585c85f6-3b39-4838-a4e9-fc200b4655fb", "value": "12288:x22iNKUjHE8IHv4Bqn0EwcF4Nv9LlY/AYsaG8X7l/79iK4w5Fu/f/jetj10fY:E1/HEFP4BEb2fxuMq0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643902, "uuid": "1f6aa286-75ec-41ca-b55d-51a50e104883", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643902, "uuid": "c1a36cff-6623-4e26-ab13-4406921feb31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643902, "uuid": "a448ee99-5dc2-4047-a449-25fd188d7600", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf11b8f6-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653676513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676513, "uuid": "3522ac80-54cd-4b6c-8c18-f91109fbb80b", "comment": "Malware payload (RedLineStealer)", "value": "40ff0abc42c57f7812f3805ede7bd545", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676513, "uuid": "9e7f22d3-7ac1-4fcc-9aff-edaa4fdbf4f8", "comment": "Malware payload (RedLineStealer)", "value": "9965fcde1505056f460b5a9a8b2088df03eaf81ae152defc89496986bfd2dc7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676513, "uuid": "dd2338de-e0fe-494a-b762-780b6b1a14d7", "comment": "Malware payload (RedLineStealer)", "value": "a39f1cd889bc381a26c4730be2e094e5bb69c899", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676513, "uuid": "34862941-cdfc-4df2-a31b-cf14a5fdace0", "comment": "Malware payload (RedLineStealer)", "value": "81f3a90df6c61c0485037cb711e3c8043317dbf8eacdc976f67fd91d7e014a16f122cc6cefc11c050cc1a6847240ebe2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676513, "uuid": "fcbc1895-7b20-45ef-8d20-99772644a3c0", "value": "T18A94E1217290DC31D4527E30887386BD6B3BB862E230544FF794B71E6EB2781AA62757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676513, "uuid": "c1197acf-6868-4ae6-97d1-78518b251bd4", "value": "936051dc8adff508935df6441a5fb70e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676513, "uuid": "6809f1d9-b678-4308-9217-5f7603f7e845", "value": "6144:5j00OVDL5ukCUhrK27B4x5BOhld7AyKdAMSnqpJ0Dlt25wqigavwVf:5cDL5+UhrK2105BAGdAMSqQDjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676513, "uuid": "00225050-ed95-40ad-8294-d4e8037dcf0f", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676513, "uuid": "653c7a8f-5fc8-40ed-a6b1-25927b1ee437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676513, "uuid": "5509ddb8-b08f-4278-83f6-b07b8f2ffac9", "value": "40ff0abc42c57f7812f3805ede7bd545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65625d8b-dd92-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653638137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653638137, "uuid": "897764d7-c53c-435f-af5b-16ba994747e4", "comment": "Malware payload (AgentTesla)", "value": "0d639e33ca63407ec181f62ad44f3c6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653638137, "uuid": "ac44c32a-5a35-4758-95ce-d5b905ec1b28", "comment": "Malware payload (AgentTesla)", "value": "99b26b8abc710c2b1144b565781c6fa1d163a58311ebd0b51f3bb4a0388c0a01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653638137, "uuid": "8c43bda8-f5c7-4107-8d96-ff37dbb3141c", "comment": "Malware payload (AgentTesla)", "value": "fedd9e044e84bcaa2827990f2c7d7bbbe8cdc151", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653638137, "uuid": "330ffac0-7e89-4476-bf4a-b3ef3678bd04", "comment": "Malware payload (AgentTesla)", "value": "09d665239812dc28295804484199ce72d0253c53f2622f2f2339e0faca013d43a52184482cede8d5ffedb6384cbed51b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653638137, "uuid": "a84af79c-3a15-4263-9d38-05c236ef892a", "value": "T11CC4DF3537AC2903D6FADA7950E1804001F1998E7E63F91E3EA365EF24E1B819771A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653638137, "uuid": "6db98311-ad64-4970-af4c-3785715330a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653638137, "uuid": "23973e08-a1c1-468a-a537-688e0bbc9a82", "value": "12288:7G6RhfkZnFR6SXlNbQFLANOqIsvgFOh9k:jRG5b5DQiNXFvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653638137, "uuid": "58fbe09c-a09f-4782-b1f1-e1664930cc49", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653638137, "uuid": "27876952-88ea-4d60-8646-500d5111f11a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653638137, "uuid": "4293b18f-c1f6-4ae5-8cf9-cfacd794a0f8", "value": "Statement of Account (SOA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb7d9bc-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653664995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664995, "uuid": "fb831fa0-a1e0-454c-afe4-b9d28d633711", "comment": "Malware payload (Loki)", "value": "e06cb10904822e59ce32cd47a711f942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664995, "uuid": "b3c04812-7030-4b55-a95e-76b1536a16e0", "comment": "Malware payload (Loki)", "value": "99f53e1ac0b679e18c434063300c506c88ea9702a7e77c342cf10b03341e7641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664995, "uuid": "35bbd99d-292e-4104-b8e4-84669a999d96", "comment": "Malware payload (Loki)", "value": "f2baaa92a539fc615868aa0bdd9717786a8fa783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664995, "uuid": "25c07d7a-e35b-4311-bc24-f117e54762d6", "comment": "Malware payload (Loki)", "value": "3ae24bf097dec0161ee55d3f79e163207bf17178c906375e859f79406771790f96bd786ddfd4465a89790c2db0b46295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664995, "uuid": "45757045-9602-41d9-8c63-a013cc696077", "value": "T1FCD4027856EC0618E7BF5B7A50B8910047BAE68F6113D70E9FC930992C93F858F12B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664995, "uuid": "ec9ea1b9-5c63-4c92-9836-bf023c0b4d7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664995, "uuid": "f8fd8542-d1db-4168-a7fe-04c4051512ee", "value": "12288:fMoivdv9EDwZbHokyZGjhzbvuKKEFo2/Rlt7aRnTLvNrciN/mC2z0Blac3P0:fMoiv48ZbHoSjhzbLo2/Tt7atv/N/mCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664995, "uuid": "68a3172a-2f51-4e07-9e47-5f93499af547", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664995, "uuid": "62160977-df0c-49df-b991-406e1f44b9d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664995, "uuid": "09927c9f-ca7c-41c6-a215-f5d330a33019", "value": "FedEx Receipt_#AWB5305323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9c5f4b-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653664990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664990, "uuid": "fc8b22d7-d678-45f9-b26b-c79d6d103cac", "comment": "Malware payload (AgentTesla)", "value": "91b701f0faa2e791ceab8875d57b8701", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664990, "uuid": "a4e182bf-102e-460d-a1c8-3161a9c5e295", "comment": "Malware payload (AgentTesla)", "value": "9e0ff5207d60d3a7717e906eabff7fe2143f63c820e670d6fd98f0a40a393aec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664990, "uuid": "19ae78cf-be9c-4541-b2dc-9bbfd8335ad0", "comment": "Malware payload (AgentTesla)", "value": "61f6fc240b0632720f161a5eb1cdc427a3ebc170", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664990, "uuid": "3d41b71f-5f90-4cef-92e0-39659e38f3c2", "comment": "Malware payload (AgentTesla)", "value": "2f5934fe289f653a453a6340a278532d5c8d3e82d051afaa3ade6e3d7837434cf15224348afad30742dcc0b1187b487b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664990, "uuid": "1332f7c3-25d6-450b-9e29-667492f16dfd", "value": "T1D774024863DCAD47D29D0FFB88D142682361D839AB8BE70F6E94921D04343DF9A52B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664990, "uuid": "4cd864a2-d43c-42bb-a2c8-1db6009f0d2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664990, "uuid": "7a250a95-e6a9-4330-a751-ebaea59f6637", "value": "6144:y3i3XmJhC2i9+gFkc/aTJteJ8TQqHtg7RHtulU3Q/s9VBCNCTzS2N:y3i3XwC2i9iEBqHkoYQk9Xc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664990, "uuid": "affe721f-7cb3-4936-b4b2-8473546cd502", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664990, "uuid": "ac2116cc-8ffb-48f3-96f9-44fbc69f626b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664990, "uuid": "fc99e115-2fb8-440a-8b8b-b2ff9d1ed920", "value": "Halkbank_Ekstre_20220525_103511_102798 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7b2a50-dd91-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653637560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637560, "uuid": "8658b1bf-e92a-4bd4-b740-1b217dd1c012", "comment": "Malware payload (SnakeKeylogger)", "value": "7ce3d264a11557a913a4bb762a1a2935", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637560, "uuid": "575f0d8c-5398-45b3-a624-70b21f1c8be0", "comment": "Malware payload (SnakeKeylogger)", "value": "9e2aadfc61e08372a3d67cb3d7f87bd4deb3b8bd673ec83b1656bc6a5554e201", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637560, "uuid": "dbcb8485-b2d5-4850-bff6-ee6702c0a932", "comment": "Malware payload (SnakeKeylogger)", "value": "4efe5685a79eda543dba55dc3d17e8cbe2d4f3f9", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637560, "uuid": "3895c369-49d0-4e68-80d6-e79094036718", "comment": "Malware payload (SnakeKeylogger)", "value": "2dc8dcb2474b2f0a86d40ef6b83b6fe2712b3577c322af1cedf30cb9ccc0e5662ef4f6278c87b2eac5c799e044fad211", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637560, "uuid": "3202dd06-d809-44b7-818f-ff7dc0411fda", "value": "T14AB312C10E7812153CC7DE6BB452394F4A68CECEC4E13EDCAFEA1156258173C99B91EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637560, "uuid": "06a91082-3ba0-4cc0-9824-04acc04ba941", "value": "3072:roN6514egmvM8PZr7M6VWiISqEcggdbiiL8u2T816+S:sE4egmEkr7M6VWiHzBgdbiXhY4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637560, "uuid": "ba079ae9-8bc6-484c-9c31-532e153070bc", "value": 115603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637560, "uuid": "ef921ab7-4e76-4da6-b84a-fb45c325bf00", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637560, "uuid": "e8a2a96c-6632-49a5-8ae6-b25d8be1d173", "value": "MV DAYANG.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f817a642-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653643967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643967, "uuid": "4b1ba533-8525-4fbb-b91b-204ddab618dc", "comment": "Malware payload (Mirai)", "value": "038da709550f5fa2fb58077767bce04b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643967, "uuid": "7fcb53d2-fe66-42fc-9af3-65bfe4834410", "comment": "Malware payload (Mirai)", "value": "9e35c0b5c812027d6698b662bb771ada7c1d40cf04050f450feebcbbdbff6b9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643967, "uuid": "bdfb5ef2-113d-4e83-b3ec-8a0c49e01475", "comment": "Malware payload (Mirai)", "value": "62c70c834e0a65db09099aa1d2b465244222816f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643967, "uuid": "b1bf4770-69b6-48c4-9d9b-9a97756d6a48", "comment": "Malware payload (Mirai)", "value": "2e23190d6db70cabe344ef39fc9dcb9b23b2f95598abe07f8f12cc948e8cd6b1081255218f91fefe33e821ab85072008", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643967, "uuid": "65381f28-fd83-48e7-8277-359f9bc03f00", "value": "T1A623F1E9100838C6CE87FDBE62E453961B3D19F2666BDD497846EF89DC060A13B83DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643967, "uuid": "11e8f173-97be-4a78-9498-5c97d2a5acb5", "value": "768:fQI83S0syxxgtCD66K6qOOONkpm1xRrBeuLJgGlzDpbuR1JruR+bDGnLFTLBw:fD8v9wtsK6qOOONkpm1xZVJuEAnQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643967, "uuid": "0e73e9f6-6a4c-4fa8-b5a4-f424488ce496", "value": 49692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643967, "uuid": "2324f3ac-7df4-4497-9ad1-7739687fa118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643967, "uuid": "f58bdafd-f734-4f53-a952-7d10d9a4bff9", "value": "038da709550f5fa2fb58077767bce04b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7053b542-dde5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653673804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "3a08acde-e535-4349-a552-9345f01dc36a", "comment": "Malware payload", "value": "bc8137a7fddaa5ae9b9e38ac8fa4a92d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "b0678905-3aa5-4f32-8e03-a88f7e906fae", "comment": "Malware payload", "value": "9e512c9f31a19bb2efc1e772d210602b3f383d55cb758bdffc408e80801256f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "c4f6605d-82f9-48f1-b758-9f85f2bb8152", "comment": "Malware payload", "value": "d2133f4ed241159bf1d9ce02a702a9b61f424680", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "7884270f-15a3-4d58-ae85-58e47ccd1b4f", "comment": "Malware payload", "value": "c7f48755ce635aae9ae7e5f8a86223914983cc0e69b4f64976ddda9f2b8bd11eeabf7757822310f1793ae42f15024d2a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "34873430-dfb0-42fa-8cf0-f5d49c63c79e", "value": "T17EC3766A3E61BBBEE5A8873107F35F70C395299226A1D781E26CFA185F7128C1C5F350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "def4cb56-0d9d-415b-a9af-a09df4b2ffad", "value": "1536:/VNy7KEv/VdKnJVIsER/NdhkFGXYQ7/2rKoPFnXoOIeEeFlBEDvA075e+vg8:q3yiz4XoOIe7BMnI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653673804, "uuid": "7e8f5a28-231d-479c-9f2f-50b1790c8c81", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653673804, "uuid": "381d9c87-0429-4fb4-bddb-499b46a5e35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "3e23687a-71d9-4904-8336-0b13dfb29890", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d61100d-ddd3-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1653666041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666041, "uuid": "a6e53e80-21a2-428b-805d-1126b0e9111e", "comment": "Malware payload (IcedID)", "value": "a965f62b6d168d628010a9d9797ad61a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666041, "uuid": "61c78dd4-b64e-482d-919b-95ecdf82479d", "comment": "Malware payload (IcedID)", "value": "9eea56f945cc00c5216b3250326f8b79d3d2cac5165b250b606729e72bd2647c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666041, "uuid": "d5fc08f1-f672-455b-9f18-7f354d0b753b", "comment": "Malware payload (IcedID)", "value": "c288d79aa43401e00c26a335f881ebaabadef4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666041, "uuid": "78e8a34c-d66e-43c7-97d7-fd84cfbe0058", "comment": "Malware payload (IcedID)", "value": "eeb7fc7bc425133c7cd86b846dab410ff49989fb25e81437426bb4f75a1b212a24785084ffdb5c74751fa87955d4a076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666041, "uuid": "ee632b45-4417-4dd7-86d3-75da6406f6b3", "value": "T14484BFB8B6142CE6E67E067BD9D67CE913B637628D8BB8CD4064B7C30563371EE06805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666041, "uuid": "144dfd42-6f3f-4aa6-a2a9-fdff27bddb13", "value": "12288:n49cZXWTcALiwCeWu2E5u0v1qR/B8r5g1h:n4EGQtLuZ5x14w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653666041, "uuid": "25291a97-8179-4b0d-9b6c-ce9fd3da182e", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653666041, "uuid": "ae02a078-3fcc-418e-8170-3d5e75ce4824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666041, "uuid": "9163eea4-3547-4c37-933f-6276ecd4ed35", "value": "textins.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b4f219-dda2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653644933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644933, "uuid": "7054ab68-5096-4956-b8cd-a8c065d6490a", "comment": "Malware payload (Formbook)", "value": "5d4e98f42dc389a7a4b3d7ebb9aba83c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644933, "uuid": "c02fd895-c3f8-451c-b9d2-f38186a79cd8", "comment": "Malware payload (Formbook)", "value": "9f3d95b9160149fcdfd2d59114d87917abd2a8b903e1e3f5ccbdae11b1c28d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644933, "uuid": "4f6f5b9a-40bd-41fb-b130-581b6fcd35e6", "comment": "Malware payload (Formbook)", "value": "44984db3396741017132afabf47a44d42030bcbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644933, "uuid": "45787289-d8d4-4629-84b6-7304ea6d8328", "comment": "Malware payload (Formbook)", "value": "16e84014428744b309b56afd0d6aac9ccee93ce8ebd890c7494a3e2d4120f11a42405b60112d8f217fbb747090df77cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644933, "uuid": "aaa47620-a266-4195-842c-240bcef75f5d", "value": "T13925BFD0B580A19EDD574FB289385C1051733EBE9656D20E30A73A2E7EBB3C34912DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644933, "uuid": "ad42840a-97a6-499e-af60-24c2f03cf882", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644933, "uuid": "35b26e7e-d71e-40b7-a596-f9616c5808c2", "value": "12288:brR/trBZbHoc0mnojT1O/WYIEcsi91Uhu4/x/LhboOBfPqo8EjAmuQuKX5ai5ZdF:vtZbHoc0FTQkEpi9qu4/tVdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644933, "uuid": "fde28a4c-7f85-4e4f-a7d6-957a53ba0261", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644933, "uuid": "a0f6b179-fa56-4a9a-adb2-b7703c0b867c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644933, "uuid": "ca023a1e-435c-4106-b4cf-35b5de4ad3fc", "value": "SecuriteInfo.com.W32.AIDetectNet.01.1582.8170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0004d319-dd7e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653629377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653629377, "uuid": "3b0f6ab6-37cc-4117-be19-04354b0098c6", "comment": "Malware payload (AgentTesla)", "value": "29a0332a7aed4916bdd67ff8ff385262", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653629377, "uuid": "73704729-0cbb-46f1-a999-8bb85f275789", "comment": "Malware payload (AgentTesla)", "value": "9f66fe14e5071fe347524255cac03feedc3dc63157d074097b40d4b40601b333", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653629377, "uuid": "a1f983ec-6992-432b-b359-b340bce4942c", "comment": "Malware payload (AgentTesla)", "value": "1a84bc72ace924ea322037c410d404c235dada23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653629377, "uuid": "8121cd6c-d606-4c18-b90a-ab47439d8b40", "comment": "Malware payload (AgentTesla)", "value": "b406f0ef6b38742c4b477f2d6d70c8701122b52a186133580d94b2d207a8ba4218dddb4d82b753e4ba017e31a3c6311e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653629377, "uuid": "c2746293-c17b-4f6e-a4b4-a4a4cca61b5d", "value": "T1ABF4F104B2F81F22E6B957FE6574528407B27DA42920E39E5DC178DB3A70F818B85F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653629377, "uuid": "b8fa9345-7100-44a0-a49c-062b503d752b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653629377, "uuid": "0c7506ce-633b-40c9-a792-485b2953ab5f", "value": "12288:5zU242I9bHoAUEvqVonY7Cx+aMNag2jWD2blCABG1BUky/CRWskmky2+UjTTpew:BUqcbHo6Ys+aM52NBBGXy/+Ww2+MT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653629377, "uuid": "af02e7ff-5ae3-424b-b0ec-f0c603b7bb4d", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653629377, "uuid": "69fc4af2-1552-48b8-9eb4-4134dfa39c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653629377, "uuid": "28a11a8f-a55d-4225-92f0-fe1f19ed639d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22871.25954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f8cb47-dd97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653640148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640148, "uuid": "a2f70652-d431-4c4b-ab25-7786c82e89c2", "comment": "Malware payload (Heodo)", "value": "ad2a9167646c09fa37e84dd8ee936aa0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640148, "uuid": "e5ee6749-85fe-4c38-bfa3-e9396b9c3e2f", "comment": "Malware payload (Heodo)", "value": "9fb39a1165a42cf6bd79719d9c387b513ea21d067290c1c55cf0c0c016484e51", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640148, "uuid": "c22ea769-35d3-4a44-b5e8-8b472dc52613", "comment": "Malware payload (Heodo)", "value": "c106115301e6b2b3f042964b63ca34295080952d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640148, "uuid": "9dd173b7-c632-4a7a-a7ad-7a2c9b10addf", "comment": "Malware payload (Heodo)", "value": "635c8f7632745b3eaddd79b0e1c07dbfe4112eefe0f261f77bea8f983b3c1cacf27ef4043a00e3b5c89e111876e9904f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640148, "uuid": "64c3c130-2d5f-41f0-a68b-b8a4d3863e5a", "value": "T1E394CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640148, "uuid": "65b8679f-bcea-424e-8c92-4ec840876e16", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640148, "uuid": "2d050571-6146-4ab6-a9fe-e8fe91cb70ed", "value": "6144:I9wEpo6/4WaPgMIuxqqzAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqzAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640148, "uuid": "a79d56af-2015-4541-9be2-f11f23760b3e", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640148, "uuid": "3fcff6ab-61a5-488a-abaf-a30ce2c85024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640148, "uuid": "f42b90b4-e2dc-444a-9d69-db92e5aec846", "value": "ad2a9167646c09fa37e84dd8ee936aa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de72eb92-dda3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1653645642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645642, "uuid": "f2dfd85f-e5e5-4818-8291-ddf5ec388eb6", "comment": "Malware payload (AsyncRAT)", "value": "a202023ed61c9277f543da2ea192912c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645642, "uuid": "139a78f9-2799-4dae-a11e-06ab37252a14", "comment": "Malware payload (AsyncRAT)", "value": "9fcaa5634246b0f93dfa2db8f47da2220863ce3c4f3071004ecae96ef7099aaf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645642, "uuid": "a0861e27-2251-428d-be03-62a16450275c", "comment": "Malware payload (AsyncRAT)", "value": "2562d62a52177af7cd6ce286610c7b30bd1c3fa2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645642, "uuid": "c11566f4-fd5d-41e9-bdf1-dd0e1ebb7a5c", "comment": "Malware payload (AsyncRAT)", "value": "6dcad48ba81742af3fb7bfefb3a77e1288c5fdd85cdda3822e2e787e56d480bb0a1e3873cc32f5faa4ecd139353fcc3d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645642, "uuid": "8635a9e2-4ae4-4b95-80a3-e1528ad841b1", "value": "T1ABB1EA9B5F4B7E659BC0268316CD0AD6222E8B1328B10F9C93DB450EDD1C658F7D236C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645642, "uuid": "6a9162e5-b98f-421e-9439-b7f8610dc147", "value": "96:DTDY5rk1kPwIrTPYlDBkZISb+pehADoNy/XKu8OomkbfgIrMG215RAm4+:EVkSPPXYlauqu8OPkoG2pA1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645642, "uuid": "4ba224ee-afd8-43bc-a3bc-3cf05bd4478c", "value": 5448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645642, "uuid": "510f145b-acb3-4254-9bcf-c67c8be35969", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645642, "uuid": "441448d3-7fb0-4868-bad7-c351aeb31b33", "value": "w9g8w6saif.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db9b519-ddcc-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662901, "uuid": "59ca8561-f366-4d54-b35b-02ff48c06eeb", "comment": "Malware payload (SnakeKeylogger)", "value": "223ce012ed137945e7a9bf3a792969de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662901, "uuid": "42160c78-1535-4765-8403-b2d114a79362", "comment": "Malware payload (SnakeKeylogger)", "value": "a0f7b339ebdf7608d9c899c36e06978964ff3fafffa973875d973a5a2038d72f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662901, "uuid": "7c59d42b-4b94-4766-ac66-52cbe4ea305b", "comment": "Malware payload (SnakeKeylogger)", "value": "da8cf4477bf73dadc6eb27522b79f0822b57cd48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662901, "uuid": "76331f42-d15a-468c-b919-e1fecadbaf9e", "comment": "Malware payload (SnakeKeylogger)", "value": "b4a38bf0f706097afe72aa610f82e910cd08997fb18f0bbe8d8cc06e9c97b819c60cffded1d5e0f8f89f680bcf9f46dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662901, "uuid": "f8f09fa7-fb12-4c0a-8c60-2a5bb4277a35", "value": "T17A040729EC4296EEDD7409FC283597582D529C640E31DBEDEF6BF689863EC51230DA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662901, "uuid": "e3dc112d-e77e-4103-aa82-8b1ad60fcc76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662901, "uuid": "2f26907a-32ca-41c0-bf13-23c0d3caa73e", "value": "768:TVIkt8f/F8UtQ/jiLINRJeXCyUPTAVP853maWi3jLT2g5K:JltU/FnlXCyUPTAVP853ZPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662901, "uuid": "71f29f77-ee5d-451a-83ba-e6a6bd4db6d5", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662901, "uuid": "82148a47-086a-4f2f-a6a3-e222df47885d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662901, "uuid": "93e23010-04e7-4d11-9de9-0a595a64f7b8", "value": "VSL details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28f8a40-dd65-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653618966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618966, "uuid": "eecd899b-fe61-4817-a789-4f5cc276036e", "comment": "Malware payload", "value": "5874a51d2999e5218dbb1e9d6384f383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618966, "uuid": "880d2de7-e17e-4d85-8958-06722ab051f2", "comment": "Malware payload", "value": "a311ac6cf877278cf6b21c0f00f62f60b5a2d8829e50a375cc27cb145a15a250", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618966, "uuid": "0dcf4cc8-c430-442c-acfc-7ea3f9aa2c4a", "comment": "Malware payload", "value": "1e69e0a8491134b1a4a22ed121781ffc38644783", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618966, "uuid": "7e3ac4a1-db1e-45f5-bdc5-319232cfb092", "comment": "Malware payload", "value": "08b78d66cddda01813e9dd7634055cd13273b732f427fb04b41b6e6340434639c707b27187c44872c1801d150d4b85d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618966, "uuid": "733c35c5-6ec4-4068-a61b-ed38fb41708f", "value": "T1E882D0C5BA40EEA5F64058B36C2C81BC899BF75E07A72071CCD5BD4DC74A4A6149F3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618966, "uuid": "aa8ab3b1-5cf0-4b0c-99bd-20f1bd7f3e53", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4kjN1:pwkyTc9pHiGJ7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653618966, "uuid": "44f7533a-16dd-48ab-b211-b152ef270fae", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653618966, "uuid": "6c450b4b-ac9a-4ad6-951e-49b181153783", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618966, "uuid": "bf594efc-dfab-43f9-b848-98c30ef527ca", "value": "SecuriteInfo.com.Linux.Siggen.4218.7289.18978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9e7125-ddd7-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1653667894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667894, "uuid": "eff97ad1-3455-4d6a-ad6c-b3f29ef43451", "comment": "Malware payload (DCRat)", "value": "a66d28a5bd554c5e6ebcbeb21be9df10", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667894, "uuid": "09f4eee3-1a2f-4746-934c-a21908ff5d3c", "comment": "Malware payload (DCRat)", "value": "a324a01288f5f0414ee8a0b23501904df970caec1c4aa094792febaa18482396", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667894, "uuid": "2f6ce9dc-45e5-4170-85e5-2413df713a90", "comment": "Malware payload (DCRat)", "value": "cb3625978c1d59e283e93bc998b26ea82af7d6d4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667894, "uuid": "388a86e6-5122-4499-9871-04df67a6cb40", "comment": "Malware payload (DCRat)", "value": "cf0e8fea61c633563931ebf7f7b68b1d770f7f2d441bad299cff4fec47b6f8b00e15c6fa08fe5a3d2189826dc3c83bc7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667894, "uuid": "0b846d83-32df-44c8-b5e1-d512d18613d5", "value": "T1EBA5BF017E44CE51F0191677C2EF52244BB4AD516BA6E31BBDAA337D96123933C0EACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667894, "uuid": "b7fa78d6-5cec-46d7-b9ba-5e35383a09fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667894, "uuid": "56dc22b1-fffc-43da-b6f9-8b9c82b733be", "value": "49152:dHZIvhoZWmkyQEg5ql5Doxr9QsT+s+XULCQnLI:d5IvhoZWmkZJ59t9Qs/+HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653667894, "uuid": "eb76b08d-5331-40ca-8831-d4cca8c91dad", "value": 2197504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653667894, "uuid": "e7a05e7f-0262-4d3d-9b97-d60c2013af44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667894, "uuid": "4532628a-d757-46df-be81-cd444cbb7a26", "value": "a66d28a5bd554c5e6ebcbeb21be9df10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e690d0-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653665252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665252, "uuid": "3ce6ae67-6ab4-49e8-895f-119694f3844d", "comment": "Malware payload (RemcosRAT)", "value": "aa904f344c89b2ebf901a0a131641ba4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665252, "uuid": "e10a8d35-16fc-4e72-8761-7aaabf030578", "comment": "Malware payload (RemcosRAT)", "value": "a35739159d8ec8a88d901e6f299abdf7050719a14e19bca9dd2cc1bc43fefbf8", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665252, "uuid": "8dca091f-dc23-4414-9d90-1fa4825bd31a", "comment": "Malware payload (RemcosRAT)", "value": "07cda98e0352fe5a8e50bfcae691888f986b8c47", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665252, "uuid": "86d0d9f5-df30-46b4-a194-6c38c6214482", "comment": "Malware payload (RemcosRAT)", "value": "dd299ec5e72b6517c745027b84b92dc4388903b7a2c485d19833c6eb4d94524bcb2185a799657a5598cc32a44984aa5f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665252, "uuid": "b8f9a649-7be4-4bad-8e1d-8261a3271d51", "value": "T16843F28AD548E828F79F4BB259C8B8D27217629C2542195F2C05931E7E196F3370A1FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665252, "uuid": "f3783f90-f313-4fc0-8dba-9d13a48783db", "value": "1536:SOElqxNdUVuPuOvcN9etgALXs7GAe2hGw:SOElqpUVzycC5jiGAbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665252, "uuid": "ecca75ad-7504-480d-ac29-4e203c0c14b3", "value": 58206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665252, "uuid": "e0eb0f74-05fe-4bf6-8c99-873894dabde0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665252, "uuid": "3b50dd34-7620-4d89-8500-a79cb75f89b3", "value": "New purchase order CYO-751.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00c2c87-dddb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653669589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669589, "uuid": "12fded8e-8662-45c8-88f7-81992aa44bca", "comment": "Malware payload", "value": "86dcbc081a1ca497bcddd88b0109cacf", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669589, "uuid": "896294b3-88df-4138-9caf-a34ad5f3384c", "comment": "Malware payload", "value": "a35bd1ac67da3498ed1d0abf6f52da7fa5b64c7a27c01d0d8ba371b766b08047", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669589, "uuid": "29df5271-5929-4ca8-85fc-e6a64e5e0bbd", "comment": "Malware payload", "value": "2c8b42231c3ef2bdc0597f58113d4b4cdbe30d64", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669589, "uuid": "01eccde5-d941-4e34-8667-5ca7315c96dc", "comment": "Malware payload", "value": "7d6169a6f2af6ba1295bd90cdb51b4793a3ea811f03e2f532311a6d27c8d23d3e72d0a33df0ed7ad3a37ee8605ecb290", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669589, "uuid": "8aaf7b6b-1ce6-492f-abaa-9f5519b9d158", "value": "T105061605D17DE5D9C337A330284D5FFA9F789808662603B36184D125FEBAA209E71DEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669589, "uuid": "b6770dc1-a0e9-4baa-914f-b70f4e1c3a33", "value": "24576:k3JXMVOudGY+m3g5QWZlYYTfX0jmgagF5MT2FYfSB0betgH6p8Dm1IPCxkLOdQe9:kGirfu6lBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669589, "uuid": "8f9e2a19-377f-4132-a74c-ddd2b1d73014", "value": 4008448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669589, "uuid": "5a98f105-aa05-4019-9692-83ad1b68db44", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669589, "uuid": "8ad5c009-d0aa-4894-bc47-1479999757a2", "value": "SecuriteInfo.com.W97M.DownLoader.2730.25424.5192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f97860-dd65-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1653618965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618965, "uuid": "ab35853f-1cb4-4959-b5bb-93c503abbfb5", "comment": "Malware payload (GuLoader)", "value": "c5bf732066ab84d1abba5b27638a5191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618965, "uuid": "0908e140-89a5-4cac-9b1c-4652a9359483", "comment": "Malware payload (GuLoader)", "value": "a4bdfb7869d435589479e095b8d0c9c2b8f987bd3a8c961424376f18c31c650f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618965, "uuid": "1d814228-53d8-46cd-88eb-24b0c6b3de07", "comment": "Malware payload (GuLoader)", "value": "07b3b8a0e9008e459bd7ba727dd8380320dbc5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653618965, "uuid": "8db6971c-2ec5-4c93-93f1-a4c33630cbd7", "comment": "Malware payload (GuLoader)", "value": "9a09a9ec6f9f5a5383b5e154f87d63f9a4fe370527269447e3632d78cf4d8ec71afb35c83564ed3a20212c146bb9bd88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618965, "uuid": "27fc0242-6572-462a-be18-e902a0ab95eb", "value": "T16F65BE88E9CEA255E81B9774E33DCC3851116D6EACF8184C6CCA7E2337773A6452B631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618965, "uuid": "e26a3cd4-bfc1-4bc5-ad13-fb68e47bbcb7", "value": "2a2a662be9dffc461398e7c94d0b55b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618965, "uuid": "7e516c51-7fd5-47a5-86a3-78ae229220c1", "value": "24576:Nso5AJseqW68ZKg1gYLCh3JgzRQJHhrbMDEVuI2N1q:Nso5AJs+gYGh3JfEwVu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653618965, "uuid": "044ca528-7b4d-4d4d-a01d-d89bf72147b0", "value": 1490944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653618965, "uuid": "e7d0bd61-8ed4-4b87-b43f-9f3a2bb4d380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653618965, "uuid": "22f5e343-f155-4e1a-9836-210569c7d86a", "value": "SecuriteInfo.com.Variant.FakeAlert.2.24488.8627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703f60b9-dde5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653673804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "593071a2-398b-4d89-9e26-5c07636e78b9", "comment": "Malware payload (Mirai)", "value": "e64c10e496d39e9d20786ff0df2f7d59", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "f51e6ecc-9c40-494f-987d-f56cb377d3d2", "comment": "Malware payload (Mirai)", "value": "a4ea9b6e8713da4804c10f4869208a1cada3122b906581358fc1bb2cce92ddca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "7c27ca73-a427-4187-9aca-b2b5fcd8015e", "comment": "Malware payload (Mirai)", "value": "25d85c14f468ae6875c33934d57c12f1d3c3d8ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "f9f7a27a-5c8e-44ae-b630-a65214f4db85", "comment": "Malware payload (Mirai)", "value": "49fd3b9ed48355c6318e9374893815b380015ea28cce3a3325133abd8a4d255704872f27110cb79c8d79b8fd790e9c01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "5222a5f4-bce0-4fc4-99ad-0a0fb4e04b67", "value": "T10983082B9251C1BEC08346B52ADB9961AC73FC390B3662067395BE6C3F36CDC5D99342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "c4bbcd46-9593-4542-bcd8-6f859d48f224", "value": "1536:q6u1g3LMtD2qtAoaEeo6GJ+NPyJax67m4fkr66dnjtwOUeIpnKJRU:q71gBq2Ljo6hPyo67zCbdnjtwOFIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653673804, "uuid": "468c4938-14f3-4dc5-bb27-9d863aaf1443", "value": 88523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653673804, "uuid": "28749e2e-80ae-472a-be18-1aa016378bcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "57452592-60e4-4580-bb6e-86e806d700b3", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a322e07-dd9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1653643326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643326, "uuid": "31acaefb-45bc-40b8-8e57-c657d17f0894", "comment": "Malware payload (NetWire)", "value": "d0e43afefc9b65e1ec9d46ea31b1b8c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643326, "uuid": "2fd754c3-eb92-4469-8d82-2b7c077b244d", "comment": "Malware payload (NetWire)", "value": "a5140fceb2803eef7a1c8081c3428310baaa0dea404ef86e5d2d4a96b80fe538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643326, "uuid": "a0a4bc72-5f2d-4c52-a012-72424bc55535", "comment": "Malware payload (NetWire)", "value": "40d365bb7297a8940cb2213790ea37b019ad28a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643326, "uuid": "dd9bc116-43e9-4d41-b557-1767f9d634c0", "comment": "Malware payload (NetWire)", "value": "4f0e4daf47083b2155137bbc178a739980ce4609ca070a35338600911c1294ee149d5d45690d2e038e05ab49ac685b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643326, "uuid": "0f95c3f8-5299-4cc3-a772-3b575dc5ee65", "value": "T19F05010032F85B12E8BAABF899B8959407B57D697531E28D4DD138CB3B75F608E40F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643326, "uuid": "275ead26-05b7-47a3-b32d-3ec2b7618146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643326, "uuid": "40c4496d-78fb-4993-9d08-fc06d5028482", "value": "12288:n50m2w9bHoWievqVwABzFhP8bJdY7Fd8JjeMOnJ+r5CnlQFW8Ljd2Cy8ff:50P0bHoMANAbTyW5OJ+rMlQXLYCy8ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643326, "uuid": "c7cbd040-c57c-48e4-8167-e4117046c869", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643326, "uuid": "9337a261-ffd5-4038-8aeb-106e5b84569b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643326, "uuid": "62b2d6bd-687a-401e-949b-223843aa015d", "value": "PO1153652300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d20446-dd90-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1653637254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637254, "uuid": "6123914f-9af5-4571-9073-8e55012fa23a", "comment": "Malware payload (GuLoader)", "value": "7f369d460c84146944c3c12bf83901af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637254, "uuid": "aee47fea-618b-4def-9835-81ab28a4bf10", "comment": "Malware payload (GuLoader)", "value": "a5e095edbdf743431c5e866c01c3a592fc5a7ddf6bfb617d72f81181743adf3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637254, "uuid": "648a7da6-da4c-48d0-905c-b8d0aea622ed", "comment": "Malware payload (GuLoader)", "value": "29ea3441429d555ddfd0fd8d5973aab0f9ea2663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637254, "uuid": "4a1009e5-ec16-419b-a5ac-86efd8803f85", "comment": "Malware payload (GuLoader)", "value": "d77124e306a5262ef5192b9ec944cfdf8d2675956afaf468c96e0d2cf5ce9f438a9421b1a24e50b8de0d5a655fcba016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637254, "uuid": "55a66824-046b-4c64-84b3-0c88e20e3cc4", "value": "T17C15E0C0E94495A1ED1DAB716A36CD3546237DBDA874A81D25DE3E2B3FFB2D31026023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637254, "uuid": "a134bbe7-a67c-4d38-85cc-f4cd3ae7c20d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637254, "uuid": "a2e3fd5f-a732-4c8a-adb0-3908c32e1978", "value": "12288:YbKP7r9r/+ppppppppppppppppppppppppppppp0Y/e4hZJgtQ9STVQ40QPKBut6:YbK1M/e1Q4VQ4muENar+Wav5BK3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637254, "uuid": "fcd20e61-efa4-4fd1-bf64-d1d84be68a42", "value": 929272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637254, "uuid": "630f0d60-7f4b-43f7-83e7-705357ce5f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637254, "uuid": "fca1c2f0-ef0e-4345-85c6-bf7a58c1cc52", "value": "SecuriteInfo.com.W32.AIDetect.malware2.5627.14109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993d42c3-dd9c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653642519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653642519, "uuid": "ef58716b-2bd9-4c10-a895-c3b4ed22f781", "comment": "Malware payload (AgentTesla)", "value": "fc6e416ea0e2daf2ae99e6bfd7ddd2da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653642519, "uuid": "ae28deae-74fc-481d-aadf-197b8706b02e", "comment": "Malware payload (AgentTesla)", "value": "a71efc41db8a093cf37dd7fc54c6bbe9995b1691222ae126eea2f5ac7eaa23d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653642519, "uuid": "8c973180-2011-4f4e-b07d-4aa47079ac08", "comment": "Malware payload (AgentTesla)", "value": "b8154ef4d691f273a5e97870869fdc42e377c408", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653642519, "uuid": "5538889d-18e4-4c2a-8922-80f72f5f08fa", "comment": "Malware payload (AgentTesla)", "value": "22fae5cc1a7fb5c65d73733b93588bef63963552c9b7a9322f43fd83df25f63a583e943620fecfc6836cca00d2267ec1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653642519, "uuid": "53c5834e-9302-43fd-81fa-0122e8b3bd9f", "value": "T1D9B4CF20375C7B11D5BECB786160800057F0A54EFB6BE60E7EF719CE256AB818772A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653642519, "uuid": "4ca96bf1-ec65-4dd6-9fa8-eb69a45a0445", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653642519, "uuid": "9ce002da-4c1e-494f-9d85-456e273cf591", "value": "12288:T0ZfrglBRgYb7jTMVxxdBISHpiHQSgiPXts:MfrMgYb7jTyHdiSHwQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653642519, "uuid": "ac64f51d-5330-4ca9-9be2-b74b9cf10c10", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653642519, "uuid": "20c1b4c8-1d3f-4b15-a599-38fa0594de29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653642519, "uuid": "2f17883c-f634-49fa-a333-5d58e27846d4", "value": "QUOTATIONS FOR JUNEAUGUST SHIPMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d20b35-ddd9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653668735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668735, "uuid": "240b6515-71ef-44f2-96e2-5f524ba3c604", "comment": "Malware payload (Formbook)", "value": "070a940ccbc84f85a8ba749eccf55618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668735, "uuid": "3a7c90ad-cd42-4d18-841f-8c98b2dca7a3", "comment": "Malware payload (Formbook)", "value": "a734d235386d77a1c6a88bdf63efce5134a82a90e113be647200401b717b891e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668735, "uuid": "70dcfd01-9dbe-43f9-93ae-677ac3ed58e7", "comment": "Malware payload (Formbook)", "value": "b6624708fa177d6a591c01ba291d40390bb6d8e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653668735, "uuid": "35f80a40-7039-4aae-9e6f-53b59e66f31f", "comment": "Malware payload (Formbook)", "value": "a2dfbb07b24a36924ca7961a4db5dc70b3c70fb919f32f69a36ce74828c64fe2de05901665ba44a3bd4c53e15ff7e6f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668735, "uuid": "fe0d4a90-acfd-4282-8a7e-5b84503443bb", "value": "T1504412D337E2C1EBD4070A315F7665B2F371A268932B52C70BA05F2A6F711CAD912296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668735, "uuid": "330c70db-24fa-4209-a693-baf1185d5b7c", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668735, "uuid": "0f7d10b1-a6ee-414a-8777-ec94a968e7b2", "value": "6144:B0Ykc3Mje3wl1Xv3pXF0E3/eIZpg63Zb73lUWeboQXJKAw2mttww:0Gyzl1/3HeItJVUWulQAw2rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653668735, "uuid": "3caf2ad3-74a2-4c50-90fe-756ecc4b8ed9", "value": 278102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653668735, "uuid": "cfbf13a7-9a94-4e63-8636-28ee63961457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653668735, "uuid": "e781f7ba-da22-497c-b5d6-bf47c3e859d9", "value": "skyrunyyu655432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7fd68e-ddd5-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653666949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666949, "uuid": "158de7fc-66f1-4f6e-a33e-bb6ba141626d", "comment": "Malware payload (RedLineStealer)", "value": "af64bb679bd63e991dc26e1f46fe2935", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666949, "uuid": "87665a40-9ce7-46cf-88cd-9f7bb1902756", "comment": "Malware payload (RedLineStealer)", "value": "a8498bb17fc87c14dfd02e2815dacdf53755914d884b7215c03874d6ce3c3490", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666949, "uuid": "58224b4c-20cc-4458-bc4b-0cdd0f192a50", "comment": "Malware payload (RedLineStealer)", "value": "5c7f1d599b62cfec27a48ddbd58da36e7da5a8f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666949, "uuid": "2f50179f-8da1-463d-b608-9c05a5a2c746", "comment": "Malware payload (RedLineStealer)", "value": "c199b3e316d47dfc146b829830da6c9f5d00555ea565a5c755882f210f1f3431999516279b6179e2e6ec3645755277a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666949, "uuid": "01819341-94c6-4928-97b0-7c8d4b5a4c89", "value": "T1B4B329B5B7CDD904E6BE4FB06CF0109543F4E5536901EB5F4EC920E91EA2780EA21AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666949, "uuid": "e4235cc2-4cc7-43b4-ab04-68d87392cfe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666949, "uuid": "a2fd3e65-a161-4a85-86a7-848601db3164", "value": "3072:WGhlBNCn+YzGI88PrnjlMS55t7hDvhygoaSV:WGhs7zjV5PvhygvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653666949, "uuid": "dce49771-2ee8-46e2-9fd2-c35088441531", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653666949, "uuid": "309b39b7-f70e-4466-abb9-82d95b6ce15f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666949, "uuid": "e5f3189e-3818-44f3-9cba-790d0f071e54", "value": "af64bb679bd63e991dc26e1f46fe2935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15f8c8b-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662746, "uuid": "eab12862-eccf-468f-9303-b446288b7b82", "comment": "Malware payload (SnakeKeylogger)", "value": "0ed5b8c5916f7fb55b7b6923f005e49f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662746, "uuid": "f3dc8c09-45d2-4747-a1c3-9cf4169cae32", "comment": "Malware payload (SnakeKeylogger)", "value": "a87b305bfd4bfff6859563f1ac6b0456eff128ba0c43d308112fb7ab9f594bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662746, "uuid": "6702429c-6789-450e-8c4a-378d636b3936", "comment": "Malware payload (SnakeKeylogger)", "value": "ae7862d103baba1c255981f7683597c870d9a9c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662746, "uuid": "c91962c1-5b79-4772-997b-3798c5c2c3fb", "comment": "Malware payload (SnakeKeylogger)", "value": "2157814411ad410a8653e888388faa94664e309e884fe4d4402c10099e4bc2bfbc2fe99157f10f95137282b327ca8143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662746, "uuid": "334ec2d8-6cfe-45df-bede-ce698e883859", "value": "T18904EE49D118A80DDB7041FDBBB48B264CDAEC54A97C1AC26760358B353EFEDEC8D50A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662746, "uuid": "a5d08fcd-0b3c-4c72-a005-f7ce93b63598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662746, "uuid": "dac4ec47-d9b6-4db9-b602-f52ff33d34b2", "value": "384:0oVc9EpvkET/xain8yP0X7w3bkrEjd9tWZ+BqlHVfiugWAMDIcWKuI9W:1Vm24yPy7w3bTqlHRiugWrDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662746, "uuid": "1320f7f8-5983-4c58-9c41-6f6c0cf40f16", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662746, "uuid": "98a3d7ad-aec7-4a63-aa0f-dc8d56cfb255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662746, "uuid": "ba93b7b2-f12b-4699-abb6-5f2b4ad4692d", "value": "MV DA TA DETAILSI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b40367-dda9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647941, "uuid": "a097b8bc-d330-4aa8-883e-ca816fff5a19", "comment": "Malware payload (Mirai)", "value": "5503ada6da9fa406b1b76e372b1fcbb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647941, "uuid": "40ec5dba-2387-462a-9dfc-53d83e5d7021", "comment": "Malware payload (Mirai)", "value": "a909a24a46ef6270ac602102003e78a139e0750c3502a39f6c958896143d5bdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647941, "uuid": "5ca29d01-69bf-4c98-83b5-7b9c7d4efb29", "comment": "Malware payload (Mirai)", "value": "2aee070f638cbf5b49c5257c036118d9ca558f56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647941, "uuid": "2ebb56be-7037-42c8-9cd3-a114f23687c2", "comment": "Malware payload (Mirai)", "value": "2ce7e790a307e45a71ef38e4536528a859cdd7bcd4715aef12e458983b7b897b41e2b4700500acb61c4f34eec3d682d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647941, "uuid": "10b0a4e3-a363-4a6d-bdf7-970f2034a542", "value": "T14193A61E2E258FBCF79D863547B78E229648338A26E1C545E15CEA011EB034E741FBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647941, "uuid": "2973917d-ad53-47bf-bd16-a0a68685a383", "value": "1536:wa/QRnJeT0Q9aK88Q5Hi0eVTiZU3WSkHquiG7oBilom:FencTfedC0eVGZHSkHquiG7ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647941, "uuid": "e9eed502-8cbf-4b8b-8c0a-5b2b4bb1cea9", "value": 89612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647941, "uuid": "0f0df5bf-f9d5-482e-a070-09d0ff6d5a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647941, "uuid": "79bb5bd5-0834-45b1-8087-d5b46f138e48", "value": "5503ada6da9fa406b1b76e372b1fcbb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d38740-ddea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653675878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675878, "uuid": "cecd5a4d-a850-4631-a49a-a44d95144ad2", "comment": "Malware payload (Mirai)", "value": "e0c4f532b0a9fda3ee7d800775deb908", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675878, "uuid": "36431049-3560-403a-be63-c6e997e59216", "comment": "Malware payload (Mirai)", "value": "aa18cc657da907f749d8bf4aae9867152acc7320f518aa1f9a33bba195e19328", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675878, "uuid": "6e01faf2-696f-4aa1-9a1a-263519003d45", "comment": "Malware payload (Mirai)", "value": "63f144f5b1f316e34510f15d4f93c3fc41d0b73e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675878, "uuid": "a3b6ab2e-a154-4b53-995b-4b6a32c9edf0", "comment": "Malware payload (Mirai)", "value": "a8c9b138192af01a2ccfda90c046cc31b4e5b69d8a5b5dc0e59b05c1536bdadff89268a4e3d0517fb2f9c5da6990c2c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675878, "uuid": "61f63f67-cd6c-4c25-90b2-1a09eed8a671", "value": "T167637B32EC762E44D11A8AB2B4F0DE349363944096476EFD95A2C7A99043FCDF61A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675878, "uuid": "8827a6f8-fd11-4efe-9f0d-d679be32058a", "value": "1536:5ce4L4A9NKgIBiZeCjvhCRKbo9YlE9zXTVmAv6fED:5OlzKxTCjvhpbuYfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653675878, "uuid": "3d5376eb-13b6-466e-8c9f-947fc0810de7", "value": 71048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653675878, "uuid": "11ff4413-6517-40f8-8253-53b93d3c5fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675878, "uuid": "d4123e4f-3a3c-4b9c-a84e-2deec092d98a", "value": "e0c4f532b0a9fda3ee7d800775deb908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070f299e-ddce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1653663749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663749, "uuid": "b05d026a-8489-43c9-ace9-db03a04d358f", "comment": "Malware payload (Socelars)", "value": "9e81a152ce370081f8ae803f91619b23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663749, "uuid": "61d6edf2-ee11-45d7-bccd-3b5ab407d101", "comment": "Malware payload (Socelars)", "value": "ab040c592f99596a0dfb71d9200bb6deeaf3445eac826e6a78ddff95a5c7648f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663749, "uuid": "b96f33f1-d4c7-4491-8ff5-e2aa115342b0", "comment": "Malware payload (Socelars)", "value": "9e8f99ab21d8f9c2126a5b44e26ff5d910f8c190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663749, "uuid": "45282c34-28ca-4def-8f2c-0dcd86ad8018", "comment": "Malware payload (Socelars)", "value": "90be789361aea023f5093134a32135118ebbcd4551fd5f0bf91dbc7e3d05fef765d03be1726a04f77e59f7ca6d152de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663749, "uuid": "09378ac5-a90a-4a3d-925a-97c767df1359", "value": "T157659E11E6425036E8EF00FA86BF4AFF8D287621BF0462D7D3C45D6A5E605E23A33657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663749, "uuid": "3d729d09-c79c-4680-896d-3f557797c2f8", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663749, "uuid": "08315014-fcd7-490a-ab94-dee042caabd4", "value": "24576:nTpE4t7hXTv1Rpgt1E7y2NfXG7E3VQ+gvLJegPeRdJMFR5ic:TpdF1w+lBq4gPeRzM3Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663749, "uuid": "bc5ff1a4-569d-4220-902c-a8a396d5810f", "value": 1492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663749, "uuid": "77509bd4-78f0-41d0-8597-fff019669b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663749, "uuid": "03db26f6-591d-4b1d-8f59-8529b77c35ff", "value": "9e81a152ce370081f8ae803f91619b23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ba2d3d-ddd2-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1653665810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665810, "uuid": "675402a7-6f1f-4a20-a9f9-9c6bcbee33e0", "comment": "Malware payload (IcedID)", "value": "dbe6583104f0be4e2d6de9c2061068b0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665810, "uuid": "959d662c-cebd-4446-b153-67f2e0523d21", "comment": "Malware payload (IcedID)", "value": "adf8cb3421c726efbadff60e97a07f6df6de98818e0978382ec388e7d32a2128", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665810, "uuid": "4c8f6bf5-4254-4ba9-b701-e7d7dc8804cd", "comment": "Malware payload (IcedID)", "value": "cfcf0d220b5519f61e9750394a47582a95f58d2c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665810, "uuid": "13be9d9f-f401-46f3-9f73-234b7ae1927e", "comment": "Malware payload (IcedID)", "value": "2cf6aa970f10206dc3daff0c9fe5271e49c6ffa8dce0c9267a930c832036fc2485e46c0f05f5d7dcde110fd381299c6c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665810, "uuid": "a587da8d-2f88-45ad-8d18-f0c8adb3d1ea", "value": "T18E95AEB4F6102CE7D66E037BD9D7BED923B327228E97E88941A467D209B3371ED15804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665810, "uuid": "57b69bf8-845c-45b1-bbea-dd9c64c10e87", "value": "12288:t49cZXWTcALiwCeWu2E5u0v1qR/B8r5g1h:t4EGQtLuZ5x14w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665810, "uuid": "df2956a1-8f6f-464c-ac55-d2455d0a8136", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665810, "uuid": "69cce143-7bbe-4c92-82e1-16786008f9f1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665810, "uuid": "4c4c7185-a07b-4d26-8a2d-6c6490829555", "value": "StolenImages_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0028a410-de11-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653692514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692514, "uuid": "9c7a16a1-b16c-4119-82b6-379e80d3f2e0", "comment": "Malware payload (Mirai)", "value": "34a3c5ce816ca55c53df8985f30b717d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692514, "uuid": "2274669f-c5a7-4828-8d2c-0995471db404", "comment": "Malware payload (Mirai)", "value": "ae4f517c151554ce1c3121d719d18053f3db80576f092cb5355717a62f3e24f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692514, "uuid": "0df30551-9683-4699-a5ba-3cc77fea1ae8", "comment": "Malware payload (Mirai)", "value": "12c2f407ed869776357bbb8bfaa8aea945daa24b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692514, "uuid": "0b862b3d-bb92-4ed1-b09e-4b2b28f02391", "comment": "Malware payload (Mirai)", "value": "e670da40738a7a886fc6581c673d92ab54f92dd542c61374c3b4db12cb621c25a98a1a772c6fedb1330c4c75bb3b5ff6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692514, "uuid": "c14b2a7f-4f2d-44b9-ae70-971c1c63b7a8", "value": "T145638C7695789CA0C1048AB1B6ACCDB48703A80096B77EF5CAC5CF5A5807AFDF1097F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692514, "uuid": "65ff91d9-7355-43eb-bae5-d329afc13332", "value": "1536:e/4jT0azwt+DUiGt1J5SmJeYRmzdOYF4ix0oC3Vy:egj4InUlTJeYM4ix0oWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653692514, "uuid": "92d2be4e-0811-44d5-94ea-78ae55e2f09a", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653692514, "uuid": "5348cc95-31ab-476b-9ad9-0a83ef065e96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692514, "uuid": "5492d4fc-c21f-459e-8a1a-811bb6fadbc8", "value": "34a3c5ce816ca55c53df8985f30b717d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc121bf-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662470, "uuid": "342a5534-98c3-48dc-a699-cefc7feb0a96", "comment": "Malware payload (SnakeKeylogger)", "value": "bca06af6345aa0e84da9b852a928cc59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662470, "uuid": "c63db3a1-26b2-4cbd-9037-8cb9ab9d3b94", "comment": "Malware payload (SnakeKeylogger)", "value": "aee776159bce9c96220aebcfa2197c7ef39fcbc07c152ee0878fcbf7ae201aa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662470, "uuid": "c5b664e6-d375-4b5b-b7a1-b547d7ca13ea", "comment": "Malware payload (SnakeKeylogger)", "value": "363f9f99f3adeca04e4e915b5910b02647af5de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662470, "uuid": "0316e35b-8f58-40b0-a4cb-384929cf9e09", "comment": "Malware payload (SnakeKeylogger)", "value": "c82821b09387b72103d2391441f2016f857318c8d1186177897059f8fd3c854c6e7ffafe18e11053f18439345bb4a4d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662470, "uuid": "cbfcfca3-1f19-42b8-a9b2-771000fe72c0", "value": "T152E4CF3173AC2803C1A9CA795071815116F39D8E7E73E42F3E6B396E26F17815772A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662470, "uuid": "74fd0cfb-0533-49ac-8df4-9beaac32aade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662470, "uuid": "e9501094-7093-47b3-b341-296e2af864d3", "value": "12288:gx0fqYI7fSjw0td2FBXCSBDY8JqKEadpgSd5kb1LdlVs9MS2oHLPzpSlYiwV:/fz03tBX3BDfNprkbjrs9MSlHbzcYiwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662470, "uuid": "a06d3f09-ed51-4e60-b56a-7eb2fccee3d0", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662470, "uuid": "781ea6fe-2e76-4a23-a579-746e5ad072ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662470, "uuid": "b92f4551-c19c-469e-8981-75b9b87c5b2f", "value": "purchase order T&B19-20PO128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdd23a5-dd93-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653638794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653638794, "uuid": "06e07f5f-d49d-44e5-a703-284d958d3abf", "comment": "Malware payload (Formbook)", "value": "1042bda94adb7262d5a401d78c905524", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653638794, "uuid": "022805c4-6924-40fd-a5ff-a6fd31522c2f", "comment": "Malware payload (Formbook)", "value": "b01c10020580708d2d28cd94e8ec15fba89d16794a788d0a09928fb2af068117", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653638794, "uuid": "bf233db0-49be-4c79-bc54-207a194852c1", "comment": "Malware payload (Formbook)", "value": "add94df8371d823578177fddf8fc47896b275b1f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653638794, "uuid": "ee5f4ea7-636d-4b4a-8f4e-20c7ff02225a", "comment": "Malware payload (Formbook)", "value": "00d863b6d519779ed82a227266b064a9bbd19d1ac0183b3a77eca73d16c980759b2ac7a578eeba4645cc731bf8d1ec08", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653638794, "uuid": "caca300e-2206-436c-ba5c-fac756269a3d", "value": "T16251F04E358BB4A8133619F2DC1F145DAD32134BB27945A13E0AAEDACD350BCD38182C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653638794, "uuid": "7f18b064-6768-4598-8f65-e3164e3eb557", "value": "48:lOxC9+rROqV+KVEJW1rS+0EjgPkHWVlpUS0yxogS/Q0BdZlzymeQN+:yrNdV+KVEJW1rS+TjgM2VlZqH/QtmeQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653638794, "uuid": "c6665d68-ccae-4129-848a-4c6a6fc3963a", "value": 3135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653638794, "uuid": "0d2c417f-4728-41f1-850c-cd83ce08f8cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653638794, "uuid": "87ed3043-ece0-4d82-8846-6eb4d412553d", "value": "TT COPY Euro 57,890_CI0099484_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63bdbc2-de10-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653692470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692470, "uuid": "491a45e1-3e21-44f1-877a-cadb437651f7", "comment": "Malware payload", "value": "26b0294b429ebb10272fe004c41acc3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692470, "uuid": "989405af-9b0c-453c-b88c-ea2e2a220de8", "comment": "Malware payload", "value": "b0873513b2b6672b8874bf73e685db3cea848ba46b41fb2d69ef1a8e18449f48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692470, "uuid": "1777aa9e-e359-47e9-a5bd-e4e7e03f32a1", "comment": "Malware payload", "value": "9a663542a01b51a7a433b3ad2a1b9615bca8d988", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692470, "uuid": "731802c0-11f6-4856-a10f-4a71bd0751d6", "comment": "Malware payload", "value": "2baf87df1cf4b6a7cb00794bb1bf5b5b7bfcef7b751effbd34ce2ea0517d172992125cc68487012f65df56d36a99c53f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692470, "uuid": "b5126966-30f6-44a3-b6d8-6340df0b98fd", "value": "T1AEE2E1AEFBDB6DD6CB9C0839693A17640352948073A74F5813388E84BB1F11FE88943C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692470, "uuid": "0a752e5d-7259-494c-a272-ee908be77fab", "value": "768:Lm94mg6pK+f1ldUG/yI9knjbMQzfxy7gFWx:LCTpKA1ldUG/yIiMIMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653692470, "uuid": "b105e65b-fb1b-475c-bfc5-6e36ee9fd524", "value": 33092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653692470, "uuid": "d7c0f855-d586-4ac1-bead-9ff0ef50b4f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692470, "uuid": "e8be85e3-67da-4504-9ec1-8beffb617a23", "value": "26b0294b429ebb10272fe004c41acc3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c659738e-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653664929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664929, "uuid": "e0df7c30-6ef1-45f4-a11c-e38cb837b48f", "comment": "Malware payload (Formbook)", "value": "f35cd9bf17306d927c618ff222045eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664929, "uuid": "b1dbc2fe-368a-4966-b8a1-c1513796d432", "comment": "Malware payload (Formbook)", "value": "b1151fa2ddbc4bedbd3bcd7112ff359747776e38a7a57d20572ffaae4170d485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664929, "uuid": "aa168402-ed09-4646-b282-f4faab908ad4", "comment": "Malware payload (Formbook)", "value": "6bbc9cc2d2f31f9c83d69b3b040e882711aae0ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664929, "uuid": "abf96ff0-4c03-4199-952e-045b67dd1eb4", "comment": "Malware payload (Formbook)", "value": "1372a8dbac52c8a185a9dd9c5611336dba24e846d3470f2bbbc08675eaa2cb709c0e7dbdd55a3899ba713ecd08e0ae7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664929, "uuid": "51c282cd-4700-4a03-b5f0-ba68a3df34f5", "value": "T12954124A3AD3D05AD1123BF5593BE775EA76B217860240871BB51F73BA382C786393C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664929, "uuid": "f6fbe370-6b9b-446b-a49f-155a623a4207", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664929, "uuid": "08a82f38-0fec-4bbc-b3a6-1f764c3f68df", "value": "6144:B0YO4vDgRVsL1OzLXhQ9Rnyt8UxiUb8TROqIwNmd6nfQQKcwt8lFWZ:e4UMILXhQ90XsBnNmdCdlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664929, "uuid": "fcce140b-6504-4015-ad5a-4b22b8a49f5d", "value": 278697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664929, "uuid": "a33d6410-c566-444a-9faa-e7e7b74b310b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664929, "uuid": "9a8ebce9-5cb7-4c00-bd8b-a3686de5810b", "value": "odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66b3eb2-dd98-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653640958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640958, "uuid": "e0dc3ed5-deb8-4df8-aeef-1966cd3cc811", "comment": "Malware payload", "value": "5f358fc3941237cbb0d376cca1c70b04", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640958, "uuid": "52861724-4140-4ac3-b76c-542a4457298b", "comment": "Malware payload", "value": "b117f042fe9bac7c7d39eab98891c2465ef45612f5355beea8d3c4ebd0665b45", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640958, "uuid": "d00f392e-5fd2-404f-b3f9-ddaafe4eaa17", "comment": "Malware payload", "value": "d4059aeab42669b0824757ed85c019cd5036ffc4", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640958, "uuid": "e3a3c985-b632-4b25-8cde-f3803baab783", "comment": "Malware payload", "value": "6806503f9d454c2ad75f9119be24ea527cc461756bca31aa83cf437e577f9de346d7bb330e3f3f8df8ef93a648a0366e", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pymafka", "colour": "#A0ECE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640958, "uuid": "b8793dc0-d51d-4b6c-9142-7d3c85e7208e", "value": "T1EB65332357C8A77FFE8578FE9102168BD245A4309D9BBCD35D56B0E8253E9A8024CB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640958, "uuid": "b5775312-69ba-4d7b-ad16-7ab78411c2a7", "value": "24576:BgLLwLNBR6w1xZ2qIXGuL9/u8B8M9TnDYQ4bKPS1Rl64vsCxWyTkN+Y/OT98Q:aLELN9z8qgGuLtXqM9/Y7muvBkyI+Y/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640958, "uuid": "48034d16-a583-45a9-8aba-b6beb9cdfa3a", "value": 1458520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640958, "uuid": "ed2dbaaf-bd09-4c5d-9e0b-73916a873c60", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640958, "uuid": "2605c81e-006c-425b-8ade-93bcf0970a21", "value": "b117f042fe9bac7c7d39eab98891c2465ef45612f5355beea8d3c4ebd0665b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427d53ca-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653676304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676304, "uuid": "f9126188-8ae6-401f-b251-38e5fc162243", "comment": "Malware payload", "value": "77436b29832ded92b60491ea36018196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676304, "uuid": "ecf18109-9f26-4d26-8273-846070636554", "comment": "Malware payload", "value": "b19c8495104c354de9aa1b3403bff2d1211a89fe8892e866d2d8dfd7bb0ba5da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676304, "uuid": "f583a996-267e-4240-91e8-040edc2c188d", "comment": "Malware payload", "value": "0314eca204964e3e189b0c0aed7f449e487dc98e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676304, "uuid": "500491cf-7519-4ccc-beb6-3b80b1d9a75a", "comment": "Malware payload", "value": "c5f58bb55e2ee9a420021e3d0962744553ef465ad71b397f07320b9e9dd63ec8ccc9342d3df5fd104a865e89b209adeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676304, "uuid": "3cf83ff0-7f91-4a89-93de-3a142f0aaeb7", "value": "T1A52512216654F813E3900A71C5F6F3BD49B4FE382E61CA03A6687F2D363E75C9929312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676304, "uuid": "b0736e5d-674c-400a-b28d-b5684885138c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676304, "uuid": "53b1aa33-89d3-494d-afe4-2096cd159f9d", "value": "24576:bbHw3bPzBxU7lXzd2+gIsofFiXKU74yNC/:fHUnWxlMo9i6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676304, "uuid": "d64fec9a-f33a-4c59-b8ba-de57cfc7b2d4", "value": 1007819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676304, "uuid": "26987192-a7a6-4aee-83d8-81ee58e02651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676304, "uuid": "64f52e3a-62ab-45c0-bb07-66972f1e6305", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.7222.26141.9624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ffa446-dd89-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653634113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653634113, "uuid": "842f22db-68c4-4d1e-85e9-33a784a57bf7", "comment": "Malware payload", "value": "ef1fb090e25f780cb882fd662395a43a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653634113, "uuid": "f9516379-08bf-43a1-8585-b36a4ff8ceb4", "comment": "Malware payload", "value": "b29edf4b4062bc2bb82055aad932022ce697b291978911d323f9569ba1a83152", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653634113, "uuid": "c26eaf8c-889b-4a6a-9fe0-5c305f72b904", "comment": "Malware payload", "value": "296cfce073696375b46a77fd764e342eda29b064", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653634113, "uuid": "9f5a9d5c-5efd-4ef1-8960-8f5cfec78cea", "comment": "Malware payload", "value": "ce1a5073b938bef7dd1c590551c0502fa5b78b8079ec12ab205bf71799c04dea20f89406ce4a44536aa8bd4f490e4fdc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653634113, "uuid": "b3e538af-5973-4228-a496-5c96446c6609", "value": "T1BD1701A7F359EFAAC4F787328939323615564C609B83A7D36C04723D36B3AE08645BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653634113, "uuid": "6157a972-17b2-41b2-b53a-f2a6867ca35e", "value": "393216:Kzsrl6eFK34h8qCtMxZSp21ewxls2mGsnXRM0ct1rY4ygTj2JJI:bcy/5CkZSA1FVm5nXRXctMgTj2JJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653634113, "uuid": "0129ab67-6d46-4ad4-adab-7fad4d5a6ab8", "value": 19742633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653634113, "uuid": "61838268-ef4d-4cb3-beb5-e22136f22f13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653634113, "uuid": "83db265b-4e1b-4d53-90fc-c0f8da6ec298", "value": "Fashion SMS_v1.1.2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969bf8a0-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653662701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662701, "uuid": "796a2837-8745-4fdf-b334-8b1c6b5b12f0", "comment": "Malware payload", "value": "5b05b0c39181623ca00eae60934d6c5b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662701, "uuid": "b684be7a-383f-4c78-8a1f-85a6b2373444", "comment": "Malware payload", "value": "b32a3e508288590842caf8aa62eebf3da68c0e497a9cc724edcf8aec90e5a766", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662701, "uuid": "2811c90a-1c8a-43df-8550-fc141398215a", "comment": "Malware payload", "value": "dfef04cfefb4f179a32e80925e7a6d45f29fc4b9", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662701, "uuid": "c63e8d86-cb9d-4174-b7fe-2318029bd076", "comment": "Malware payload", "value": "3f30e930d9c16e0e20d4f7768471ff6d1a96cba0b94f66e692127dee14cc9f069525fc7fba3d09b9ca697ba00ed5fbd5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662701, "uuid": "aa111f8c-5e19-4922-a9ee-9bc0fbe6d2b5", "value": "T1CD163A05D53DE5D9C333A735684C5FEA9F789808672643B32084D125FEBAA208E71DEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662701, "uuid": "ea02c1de-8eb2-400e-872c-eb34072be50b", "value": "24576:uLs2sKsl+XM0qu2BYTG3kdtQasYyIv20Ueea2h5MT2FYfSB0betgH6p8Dm1IPCxS:uSWrve+7TyaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662701, "uuid": "521fe0e6-2ab5-40b1-9c94-470e5e4b859a", "value": 4179968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662701, "uuid": "765f0ba2-552e-476f-9b7c-f5a0dc9476cd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662701, "uuid": "9044be96-b4e4-43bb-ad49-50f4606717ea", "value": "SecuriteInfo.com.W97M.DownLoader.2730.466.21866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48623007-ddca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653662140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662140, "uuid": "e99222e8-5285-4dad-a848-74ca62bdd1eb", "comment": "Malware payload (Amadey)", "value": "b1da41b278826a17c5803c6183743eeb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662140, "uuid": "e5d61fc7-a60d-41d2-994d-168bf7465349", "comment": "Malware payload (Amadey)", "value": "b5e07c400d75286309c56f08650e3833dafe41ab12cc818ab09d29b26812122a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662140, "uuid": "81e8ed2d-a24f-4a5f-9fe8-a82b8ff17d3b", "comment": "Malware payload (Amadey)", "value": "9ee4d8d98ad9224d63545cfb82a7776eace2f03c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662140, "uuid": "d9f66603-c715-49bf-8bca-0bbeb9f95feb", "comment": "Malware payload (Amadey)", "value": "146796d65bcb3bd8ac4c97df6dcbd436641387fee6e083d8c97bee91c7d98564088704d7c9d9754796cf440b74bec661", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662140, "uuid": "3ebe1f4b-2f84-4e63-81d0-dd040de5077a", "value": "T17665235C2D688FD4DBC6B379212691F127F1EFFF5212572018A739004ABF6C568E8E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662140, "uuid": "8cc6c769-5ae3-4180-87e2-4dbfa68b3134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662140, "uuid": "34d9c388-a95e-4583-bb9a-d7029d36d807", "value": "24576:kd+W7Xo+NOmuS6dgNP/pH71/CInbHGuXffP3usKRZIho+IwUD82PwW+JvM3kdf4z:Qowydg/bnfXf3heet+2M3XSpAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662140, "uuid": "c8ecf513-a166-4c82-aa43-f4dc8ecf4bcc", "value": 1439232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662140, "uuid": "0719d6a1-3a1f-4e75-9521-267730958fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662140, "uuid": "d1d5af8d-160f-42c2-bfef-b32ed28a3e13", "value": "b1da41b278826a17c5803c6183743eeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71653a8-ddc0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653658139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658139, "uuid": "b6b6de22-4168-4cad-b974-a9ed74b7b6c8", "comment": "Malware payload (Formbook)", "value": "639399a6f01b51574bfd5d02053a5bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658139, "uuid": "f24fe535-8eb7-410f-a5d9-74987c833321", "comment": "Malware payload (Formbook)", "value": "b5e186f373c99f75db50a9b6689f835d4c141c6f369fa63d58da21b5fa13e90d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658139, "uuid": "9d9a0bbe-3f2f-4b2b-ba43-29e74ae33469", "comment": "Malware payload (Formbook)", "value": "c284e6a8119a5f820654933719e4cd2c189df405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658139, "uuid": "fbcec224-03fd-4bf7-9ce5-0e0cf412cfad", "comment": "Malware payload (Formbook)", "value": "5a97fb79b7637e64fbe2827c8ba1ca24dbaaa44bfc57a8ad9b88e852d4f539807590a859e840c99d5ff99ac1b268c769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658139, "uuid": "bc9ee6a4-7f7f-451e-8a42-0df04bfd1b41", "value": "T107D4020CEB62A9E9F16D07BF3475A8262F509B32D8BED95D78A432561D34793004BCCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658139, "uuid": "cb8bffad-0dcc-4608-8834-629cd92fe5bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658139, "uuid": "7b7db304-a574-4ffe-9763-72fe90107d98", "value": "12288:B5bHo6U8T8/rg8m+T5BRinfx/yNtCYvahRkwJ3koKuhFr8:B5bHo62rPRinfScNJfKEFr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653658139, "uuid": "56ed9a18-fa24-4668-a4f1-a9d2b3cf458c", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653658139, "uuid": "df8ece6b-19b8-4b88-a935-939817a76f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658139, "uuid": "cf912bbe-edce-456e-9058-77ba8e133e9a", "value": "Advance Payment-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82a0338-dde6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653674408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674408, "uuid": "395d0c48-490d-4390-877a-f3967cd7d8fc", "comment": "Malware payload (Mirai)", "value": "ed9ddebd071ce54d02f6ef346e6c34bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674408, "uuid": "111be310-c32b-4675-9277-49904a0c3a5b", "comment": "Malware payload (Mirai)", "value": "b60a151390ba1b32c773ef74db98b16f2d229d7cd521ace2e6c6906235eef46d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674408, "uuid": "3ebf8ee5-a98a-4597-8a64-f9fbf2bba445", "comment": "Malware payload (Mirai)", "value": "00c2b1393b7b44d9e03540dbf96071bb2bd107f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674408, "uuid": "a6d2ac05-3774-4776-add9-3730786c63d3", "comment": "Malware payload (Mirai)", "value": "b5655d7ef7133ffccbbc9094b74b351f3072d5455ccd41f4abdd54811d58123da5b6a10689eb6ee613ddecc610885bc8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674408, "uuid": "6b7b6a59-4d59-43e0-82f3-58a5ea731c70", "value": "T16103F1E9F0E4CB1DC9E813B6D7BBA26F8150547EAC8C835BBD10B7076AC5DC12626193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674408, "uuid": "6b8df740-6a10-4137-94ce-61c10781f354", "value": "768:PbGHrvv0k7He6VjPWpnci6EjEfZ+OmjyDX9EuzTER2Z6CMauQBPXFCZZnbcuyD7b:DGLvF7HeajEnci6EEfATcNzAe6Ap1onM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653674408, "uuid": "545a0858-f538-451c-87c0-a641956e47c0", "value": 37916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653674408, "uuid": "40cf8124-7049-4dad-b2ca-4a10320baf2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674408, "uuid": "7a34bd8b-40bd-427f-a404-af1af480bb0d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dff015-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653643935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643935, "uuid": "38481779-498c-4543-af09-fdc559ae2f52", "comment": "Malware payload (Mirai)", "value": "91638d450f8a4faf1061dfe5f283044d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643935, "uuid": "dbd2f7ed-7228-4f4f-baa1-9946b02afbb1", "comment": "Malware payload (Mirai)", "value": "b6615f5067419bdad205b51bade85b152082dc6ff2357f98f83a9b50f842004f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643935, "uuid": "5aa2db98-da16-4d29-91b5-70351d7ed2b3", "comment": "Malware payload (Mirai)", "value": "93e405ba8f5dcf8f55b631703772652dadaa39be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643935, "uuid": "68923d24-390b-41a9-abea-bf6d258b06ad", "comment": "Malware payload (Mirai)", "value": "f7b3f82b4f1ce11d2bbe8290958c83cbacc69be45e046600a620fa3926bb6d17b5844b6544d30a64bed37aeb2a69d180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643935, "uuid": "4dd4dda2-10e8-40db-84ce-8338b5fb9345", "value": "T1F533F23EE239B3F2DD4D96F9E18E27690C7570A5F33B569933608508452504A394CEFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643935, "uuid": "7890ba77-da6a-464d-b0da-5168b0a51148", "value": "1536:HZFo5KIItdW4epUaKhI/dT18WR0ZfV5gPXSp:X9tdSUaDJRWf7SE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643935, "uuid": "ec639c90-6683-40fa-887c-c3f272488f7a", "value": 50336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643935, "uuid": "b5ee3439-23cd-4783-b10c-2de2b862a571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643935, "uuid": "92837bea-046e-48e2-b6ef-4fb14d735c41", "value": "91638d450f8a4faf1061dfe5f283044d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40abdc3a-dd6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653622614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622614, "uuid": "597054ba-75ee-4bf9-8700-516d533169e1", "comment": "Malware payload (RemcosRAT)", "value": "38f2aeaec1fe65eec3273ee27a5facac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622614, "uuid": "95d65e44-06a5-4237-8f55-bab3c3860c15", "comment": "Malware payload (RemcosRAT)", "value": "b6cbbd914e6466a18364e387503ecb099cb0b497807a85a1f5a8fb5e2df13213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622614, "uuid": "4e670b28-0ffe-4c7c-9b99-39999d748c54", "comment": "Malware payload (RemcosRAT)", "value": "83cd77196c39b276dca9567af2ca29038f828594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622614, "uuid": "491cdc0d-7e34-4fb4-a5b1-89a104bd5e79", "comment": "Malware payload (RemcosRAT)", "value": "089c53e16aa56cd9c8f4f3b70d748b3266c0e5f176457cbc16e7fdcd897744500e099ba76fb588c0d6fcb794fde29de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622614, "uuid": "9dce4d36-8894-4976-9f6d-06c20f0ccd22", "value": "T19AE423EE7FA5E153C1C90AF19F52E21DA2789164351322632AF9DE2EDC207C23E4D2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622614, "uuid": "e9e8112b-d5a9-446a-b605-91960e2f4d9e", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622614, "uuid": "70d77ffa-f92e-460b-85cc-08789d58da88", "value": "12288:/1F4mb7oBEsnmUZOwmhtfVUr29vcx/YN3UsCsgl/aw6V0WgJtULt9jiNZe:/1F9voBEGmUlmhtNiDsqH6WW2qHjye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653622614, "uuid": "7d1b4eea-4425-461f-9f42-ee063edf3f68", "value": 707382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653622614, "uuid": "a44e9841-ba20-493a-991a-1ae97d88265f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622614, "uuid": "f3aaa152-7d29-4ceb-83a8-cb2a50939c73", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.27131.8894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2145ba-dd9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1653643442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643442, "uuid": "0a22cb2c-111b-415d-a72a-9ea8983066be", "comment": "Malware payload (Gh0stRAT)", "value": "ae5efb93e6823ce7fdb3d0441bb3c208", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643442, "uuid": "ea2c476a-6e8e-46c8-a890-23a523c6d913", "comment": "Malware payload (Gh0stRAT)", "value": "b72acf4b6a14655e8583b209b60c2bf0177af1e40ffa4765523cd9bbbad48451", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643442, "uuid": "43154594-2f11-4d3a-bc1f-177be773ab34", "comment": "Malware payload (Gh0stRAT)", "value": "88e8cd889f411a2a6f865bf95fda7923ef6cc558", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643442, "uuid": "2d401634-42d2-4af7-b643-fb229b3484bc", "comment": "Malware payload (Gh0stRAT)", "value": "ab80e225f3ba01230447d8eeb9c81d5b03a597add3b235931cd8a74c7f3f02f699f127b019d65164d31712d30157d8fc", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643442, "uuid": "26e6ce0a-ac41-4d69-9d96-9c239375dd67", "value": "T11BA41891C01387C1E639D332C4EC9D92E2129C6796918A9FB33CF8E79F725439D1A98D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643442, "uuid": "13cb8da7-c9c5-4cdf-b7cf-db3e7fcaacb8", "value": "ca42cdbd08085dc811d567b0b30d8b2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643442, "uuid": "04592970-209f-44db-93c9-f87ff12734ef", "value": "6144:N618QqGw0vrnuHjmTcU2b3V0h7FulG7cBaP+vifhgh3i8PRIbWVIt6f9aaApOoIU:NuwGP+vD2WszsoIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643442, "uuid": "6980d74b-752c-4070-9d36-5634b3758a7c", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643442, "uuid": "3b1302e9-3920-4087-9167-f7a2503db2d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643442, "uuid": "ab99279e-7c25-4ea5-a712-0c10517063c4", "value": "Telegram3.5.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b5b875-ddaa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653648603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648603, "uuid": "e3579ca2-9760-4fa2-92b3-87ab3507d154", "comment": "Malware payload (Mirai)", "value": "a252efe7d05064b553338d88b2d7ba5f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648603, "uuid": "3a8078af-8f70-48b1-9872-f18e2bd1a29e", "comment": "Malware payload (Mirai)", "value": "b74fd08f1347bfba0119b41d3b7452aa622664e0c1f6be5bdd9393f1f168697c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648603, "uuid": "b8a72056-1320-49a3-9874-92170d4e0209", "comment": "Malware payload (Mirai)", "value": "162dbe359bfd2ff1c54016e095e805766aa62fed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648603, "uuid": "02ef8be3-cfb6-497c-936c-f3c5f8ab930b", "comment": "Malware payload (Mirai)", "value": "345e6e79652f44f93fde807d50aeb0b0f882235ce13ee25e63038f8c6e387cba074a6d67c356bcfa0974130cd595a627", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648603, "uuid": "4787dfb3-9009-4c24-81cd-2ec4ce74ad5b", "value": "T1E4633BC8A5C3F9F0DC150A39307AABB25977E13B2139ED9FD7E91967A901342D4013AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648603, "uuid": "19aa404f-e00c-4a80-b74a-517ac000354f", "value": "1536:ZXuL5MVqr3MOWaunK2ULffbjiUe//zLQa2ehH0hYzg:ZeLqVqrdhun7ULffHNe/VFpQYzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653648603, "uuid": "a021ba3e-6639-443e-aa1a-0f6837444790", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653648603, "uuid": "7b12ad35-d777-4486-a9c5-408ea6c49b1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648603, "uuid": "8008ea94-d047-42bc-b909-3e916355e678", "value": "1isequal9.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f25471-ddce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664091, "uuid": "af271f07-9d28-42cf-aa1e-06d797cd21f3", "comment": "Malware payload", "value": "15a0315f4b7d9a3d3b332d4688d97886", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664091, "uuid": "ba71feed-ff0d-471b-94d8-2d6bf059f95c", "comment": "Malware payload", "value": "b8aa3e8fc64844920b0a9ac840ef1988272e7bac1332a10c824dfcbee28356fe", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664091, "uuid": "b9f268f2-9e2e-41d5-a071-74e09f2c8b79", "comment": "Malware payload", "value": "e9bae115907d70781d6c944b634007b66e9103d2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664091, "uuid": "64faeedd-5100-475f-8043-745beaf4435a", "comment": "Malware payload", "value": "8f58cf2d3961799b5eaf5fd07d7f37e8631798c6546ab219e05fe88d5be090009a8c874e79fc4db891ac225ee3098d95", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664091, "uuid": "52448804-1bea-49cf-8777-ae0b2f651066", "value": "T122E57D22F254757EC4AF0A3B5937E3149D3FBA627612AE1B17F4488C8F359402A3B647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664091, "uuid": "86c4413e-f0ea-43b6-8bd3-b6e4f8192b3b", "value": "49152:4+m/c5amDBrkSJqCI5wS0shP7R9t+X7xUnT0EwvudWcOYGEA:Q/c5JCd+7aoLWOYBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664091, "uuid": "62c1b56a-42f8-434e-9618-4e6f52626ade", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664091, "uuid": "659fed4e-dd84-4a32-9d53-0ec43f500637", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664091, "uuid": "56f6b0bb-64fc-4d88-869c-34f2faf05ecd", "value": "FacturnowEndesanownopago.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b54603-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1653664604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664604, "uuid": "1d483e89-e719-448b-8e69-d82ca4be50e3", "comment": "Malware payload (Vjw0rm)", "value": "3d6bfb78b4507146f160b706604da6f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664604, "uuid": "deb9acbc-7bf1-45cd-acb6-5fca4b2ba2c6", "comment": "Malware payload (Vjw0rm)", "value": "b92b2c3a689cd2c5929f4123642004b7f23482c036dbf467813a18c91b3537df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664604, "uuid": "79edd810-db18-4075-92b3-1ea4f4ef4c96", "comment": "Malware payload (Vjw0rm)", "value": "9c189911fb19625c1f9418096fb8b5c65b1d34e9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664604, "uuid": "63cb098c-2b1b-451f-a361-4258b7bec28e", "comment": "Malware payload (Vjw0rm)", "value": "e37190707a58da85ec49c063df3e0c90c186e123afa397be0f319484ddf78db39c2fad027aeabaa2dcbd412b07576609", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664604, "uuid": "1ddb3f11-26b9-4031-a6ec-fb074788553d", "value": "T12E74BF218740AF999A944807E07E1E4F56F3136AD433F2CCB79B390B2BBEE0D5716895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664604, "uuid": "55a245b1-abfb-47e0-998a-fd45b348dc62", "value": "6144:vJ2rO57l/9SCe0X4HxfHPUjncpk+psFAcqGGErm6lUcApLgA5Zg3u9VhkvYqaW:vJ2rO57JAt/xfvmcpkosFIGlm6UcjAwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664604, "uuid": "99c79060-58ee-480d-9e9b-8573a3b584c3", "value": 345985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664604, "uuid": "2855a396-7cce-4d65-8578-cde8c5e17d10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664604, "uuid": "3a43ee14-a51e-4c23-9472-f369b68c745e", "value": "CIQ-PO162667.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee24684-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653664916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664916, "uuid": "d15daf78-98a4-43bc-8b7f-12b4d71c2c6c", "comment": "Malware payload (AgentTesla)", "value": "a4997cb9d3682c0b7043e6b51681fb9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664916, "uuid": "13f98b96-f69b-4eb0-9152-4dea1ccd03bc", "comment": "Malware payload (AgentTesla)", "value": "b961dc186d9a191aa1682dce8f0c83c2413f94a50741a8db18b1aca53a4647d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664916, "uuid": "a7421e45-db0e-475f-ad3b-a5299231c4f6", "comment": "Malware payload (AgentTesla)", "value": "191cf781f7a5e60a58277e1014509e3aa972b618", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664916, "uuid": "72ca3f5b-780c-422e-9c46-50032753472f", "comment": "Malware payload (AgentTesla)", "value": "7c5f3ccc7d2915c29b19d6d709fe065aaba7a5a61a72f1c81af2e7638de4a7b80bc8aa52d4d10d5a76ad23406446bcb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664916, "uuid": "90401972-9790-4b40-8ce3-0c42c8a945e3", "value": "T16B740244378D8502C6AF0DBF8DE281648BB2E9376E83DB4FBEC4526D19613C26552B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664916, "uuid": "f8f80b49-bdbd-4397-b0fc-c36cd5c09512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664916, "uuid": "84ada92c-c184-44ba-bfb7-a6c71056b2e7", "value": "6144:5n5tMcER+jhZolfDWv5lsuzExItERhlVyI7l7+OA4/IwLlVr2T:5n5tMVuZybWv5lLzmItERh3yo7+OA4QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664916, "uuid": "94db7f94-63ff-4442-a1a1-456b97d68743", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664916, "uuid": "799e4553-59e6-4f98-b4cd-7212d8d76dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664916, "uuid": "3a900443-957a-4f07-93fa-7542b6b5f0a4", "value": "Dekont 00%122000_Gelen Para Transferi_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d756ac-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653676308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676308, "uuid": "e1b0009e-3043-44bf-99e1-0c3c9251731b", "comment": "Malware payload", "value": "4db7e51b80d3c6eccc2e57ad94dc38fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676308, "uuid": "618b843d-561a-418e-a7fc-5657c6105c06", "comment": "Malware payload", "value": "b96dc2e426b1ba3bd10152515239aa59d9b2314ac4ae4a60355e0be7eb887956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676308, "uuid": "0760e8fa-a775-4629-9054-0cd656724b70", "comment": "Malware payload", "value": "91482c33aa9c62e3b420b5992b0d81a1d96d4c94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676308, "uuid": "e824dcbe-ff76-43af-9d5b-a35383adb488", "comment": "Malware payload", "value": "eb870cce4b122a4d893139e2b43db7e23e3bdbfd030b8089c9d0c260f7d4f94c8e2b37a68ff69d7fba280ddf9375fccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676308, "uuid": "904cd74a-ae6e-4c20-9f5d-3aa4a94c9d56", "value": "T15D35892236EE505DF3B39EB21FD4B8FF986EF673260A70B9215117458721941CCA173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676308, "uuid": "9732c0b6-d1e1-46a6-bc37-b3fd6d8c33a3", "value": "1515ef21d217e5249d717ed551808598", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676308, "uuid": "6a839bab-2819-4f58-9983-bcd03704ba57", "value": "12288:vxWphwSRnAFCl+B7zKxOEf+NM/jKg0m0tKWveFlyyBJw81wC:Jxjstf+NM/2g0QPtJw8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676308, "uuid": "be5e9173-49e0-47f1-9c2f-a170954d8cfb", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676308, "uuid": "1401c846-4995-47ec-943a-1cf5b2f774af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676308, "uuid": "f40ded1f-73d9-4ac0-be60-624c1c166b74", "value": "SecuriteInfo.com.Variant.Lazy.184878.175.5572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d90e9f7-ddea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653675947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675947, "uuid": "aeb4eca3-c5f2-437a-b70b-c0d169be10ba", "comment": "Malware payload (Mirai)", "value": "275c6e393dcacee32b9ddd8bb4ad8196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675947, "uuid": "4b30889c-deb1-471a-942a-be9cf99deb2b", "comment": "Malware payload (Mirai)", "value": "bb0fea23f67c783d1b0d3f8f92e1fd91f1c5d85f7782bc135f0269057e2ab4c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675947, "uuid": "86b19e4c-b20e-4181-8dd3-a10074f5414c", "comment": "Malware payload (Mirai)", "value": "64a8605d5f69142a08385b359d3a6fd73120880d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675947, "uuid": "cda4083a-f1e6-41ef-83ce-db455c2b43ef", "comment": "Malware payload (Mirai)", "value": "6e04fd96cb5299c5af776c6ba2e748a2279e5a07236600129a2f2048634cd8370b1be8f09bab4ce4d5cd03c919624296", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675947, "uuid": "35d5d37c-c64f-46eb-95b1-c5493987f623", "value": "T1B513F277DE1991B6EE5992720ACCC6879C56A9D07B03D88BE825D7E02EC70163203AF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675947, "uuid": "bdae2fd0-3e99-4ac1-a21a-2bfd8cf80b84", "value": "768:kBngnCJnfsrVyYfvYdu80skETund52DdwyX2uxPvxfG6sNEx/vjE88VPwqJgGlzg:kBgnwUVy8v0u83TunTL8v4653jE88eOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653675947, "uuid": "6503c031-6fa3-4f15-abb6-f873e5bbd506", "value": 42432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653675947, "uuid": "2549ce96-dd48-4383-9b81-69115bb3cda4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675947, "uuid": "cea11f05-0ac7-40f2-a45f-be5ff2183375", "value": "275c6e393dcacee32b9ddd8bb4ad8196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85dfd8d-dda3-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1653645551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645551, "uuid": "2bf7a248-d204-427d-9cb1-92fb0e4a0b34", "comment": "Malware payload (GuLoader)", "value": "3fed4357a9a31f6d784d90e0e2828cef", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645551, "uuid": "e65fb735-d8da-4acb-b19e-2b3d80734ead", "comment": "Malware payload (GuLoader)", "value": "bc03e79179795e31ba88934475f0746f25a7382a157ab005a54cae03b83c797d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645551, "uuid": "37fdc0ae-388e-433c-a49c-6ab72947c5af", "comment": "Malware payload (GuLoader)", "value": "b10fe00a3142c331aa805a78b5e01e9fa73d9c6b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645551, "uuid": "5a80724b-e37f-4856-9f15-865490496a1f", "comment": "Malware payload (GuLoader)", "value": "423176838240d9b6fe0ef7fe207ce7bb8846ce30822f95892796acce89d278064fabb030ac08abe87114fe945e9b4f13", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645551, "uuid": "756a859d-f587-4329-83db-51d944397a95", "value": "T120F423B957FBC328D35E472592207FB81CBCF1114E133E768D22769D86228A6CE5E11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645551, "uuid": "40e508be-3c34-4e70-a3c8-1d51d0ebbed7", "value": "12288:UML7nvXmvi+sc3vTA2Q3J1XyQEAHd/vcjtCbQ0kMYO2eFUOoV35YqT00hXTrS2i1:JmviHc37AXJwQNc2RKbsd0hnS2Aaqvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645551, "uuid": "07656750-428e-4438-ab57-8216825969f3", "value": 750902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645551, "uuid": "3c424f5f-b5bd-4b18-9c18-29e793ff47c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645551, "uuid": "54716297-eaae-46d8-8eec-ad5a05c6faf7", "value": "#confirmaci\u00f3n+y+correcci\u00f3n+de+la+direccion.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a98eb1c-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653665043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665043, "uuid": "7125e0de-63c9-4b4c-bb58-5330f40f76b3", "comment": "Malware payload (Formbook)", "value": "81e4012e3036befd629438ace2e798e2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665043, "uuid": "a2c6c7a4-8612-4f87-83fd-ecbd4894d353", "comment": "Malware payload (Formbook)", "value": "bcd31729e663369b99fd178377977c5de078512046d2cb4b38c51d80d9801374", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665043, "uuid": "f91b5bde-4c6e-4d0f-b27a-4e5cb8ad55ee", "comment": "Malware payload (Formbook)", "value": "d5b34d7dd4d4255fd3279bdd99c98b9e760bb34c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665043, "uuid": "a608e69f-7a71-45ab-9a2a-fc4bc4f025e4", "comment": "Malware payload (Formbook)", "value": "93df14993a61a37afebaf5bab43bf1a2dd67d9f2b566b3deff1186fc0f67713c9f1f2aca18faf244038e612a07c5f707", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665043, "uuid": "8fedecfb-4f00-47d8-a2c5-d1cd8b1955c2", "value": "T149E4122D22EC0628FBFE5B7E10B95500077AAB4B6117D70F5EC574D82C83B524E16BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665043, "uuid": "e85d1fd7-80af-4d90-8984-bae13f8d8e69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665043, "uuid": "d8fd55f1-2305-4c13-a273-95cb133131e7", "value": "12288:jML1Aw768uPZbHoViBdtz4X6RfBnlw/lqOqUC03Ojrx/4c/6bTmA:jML17MZbHoVivtzhf5lw/lq1XoK3/6v/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665043, "uuid": "04f11cec-fc76-4d64-92f7-531ca7e0812e", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665043, "uuid": "319d8099-94e1-4015-b8a7-8b5b3779e934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665043, "uuid": "c309980e-cb16-413f-a3ce-29da3055f7d0", "value": "DHL WB# 2343640950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ec14f3-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653665069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665069, "uuid": "b0d7b2a0-9747-46ec-b3be-0dbff9fb700a", "comment": "Malware payload (Formbook)", "value": "c97dfff9af3555ca25082cc686715c76", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665069, "uuid": "4f41e6d3-7273-47a3-b791-4d9b2497824b", "comment": "Malware payload (Formbook)", "value": "bd89fe68b099ed00bea985dbdf7c8c0d87deb5a85c29d7a27f09764ab5b9d04d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665069, "uuid": "e632e754-7366-4f88-9b83-87ab685643b1", "comment": "Malware payload (Formbook)", "value": "efc71d34d01661436ef23e2af1a36f7f96319122", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665069, "uuid": "6eb21a99-d2e2-4968-8b13-14fb8a410598", "comment": "Malware payload (Formbook)", "value": "34a8048bfcf4d57c9f79ce9a3cb4b1b75fdd327881bfce87f8aad6a56b577d26917bb86cb5377b65468876daabc27da1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665069, "uuid": "ec5cae78-2951-499f-a6c4-cfacbddf56f0", "value": "T1B5B5B337DF344E2592F9A719A9644912FE30A78F4A41870FBA7D060C1F3B77A114B72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665069, "uuid": "265d54a3-b15d-4b2f-82e4-5573083ce0bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665069, "uuid": "ae4765ca-5d71-4351-97aa-889e95dc0170", "value": "24576:Wmnp0sdiKbb62RNH6AyM1l/+rRa53ruU:IKbb62RNaKsF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665069, "uuid": "cfd91b4b-a21d-4966-a8ba-b8aaa7929ce9", "value": 2419712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665069, "uuid": "39085bd8-50d5-46b9-ba56-8ea5b555b185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665069, "uuid": "b5dada3a-fe8a-4e97-a299-b7c1678e79f2", "value": "DHL_29028263 receipt document of the purchase,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a46cdb6-dd97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653640159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640159, "uuid": "e602fe65-f89e-4817-ab58-8280a26aaebd", "comment": "Malware payload (Heodo)", "value": "f49cff4024b5dcc49514756f662ea49e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640159, "uuid": "e46b9d58-bb70-4459-b721-ec32abc5b7fe", "comment": "Malware payload (Heodo)", "value": "be9ac0e86d3e24e043e3b85707e9a67194a40e14199f83887241484b23667fd2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640159, "uuid": "ffd4ec37-97d0-41e4-838d-e948b700de4a", "comment": "Malware payload (Heodo)", "value": "d2e07ffc6ac308bd10adfc2b30e535eeb00eecad", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640159, "uuid": "d5036c50-2ae3-4bd4-819e-4bb5fe02c909", "comment": "Malware payload (Heodo)", "value": "1566a9160401b36be7b64823d8f85b6bec44f4f5738caf16ba2e6248af6f9b2797bebea63e41fbcd24463aeae864e856", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640159, "uuid": "4d635faf-9f38-409c-9e0d-441241c7cd22", "value": "T1B194CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640159, "uuid": "7f0f5e61-033b-4211-aa4a-3f251a55a006", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640159, "uuid": "8c995bc9-c873-4ded-86bd-31fee4ead445", "value": "6144:I9wEpo6/4WaPgMIuxqqgAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqgAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640159, "uuid": "34a89cb4-83e1-4f5c-be69-e0388162380d", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640159, "uuid": "821447b4-3d04-41ce-b1bc-86b34347e359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640159, "uuid": "b7a322ef-d2b8-4444-b995-805eef5862b3", "value": "f49cff4024b5dcc49514756f662ea49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc571bab-ddcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Nymaim)", "timestamp": 1653663731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663731, "uuid": "f01bc951-fc54-4ee0-918d-e96698d614e2", "comment": "Malware payload (Nymaim)", "value": "ce1a321ca8b7b8ee62ecd81cff2437d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663731, "uuid": "664417f6-d84d-41a4-9550-c0c4066ecc2e", "comment": "Malware payload (Nymaim)", "value": "c03322daae067eb06fe2e1655c85ec5f5e9a0173fd3eb24c76540c9a1c8b94b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663731, "uuid": "696147a0-5512-40ac-843a-42394754c62c", "comment": "Malware payload (Nymaim)", "value": "cf1c9a2a0f0101a81e7f02f537ab6afd5e03982e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663731, "uuid": "fa94b912-426a-4887-ba9e-a371bb439337", "comment": "Malware payload (Nymaim)", "value": "a37bad64db9769b758de3f3f9dde8812ac450d1bdec0aa2e965748a83e7dfb9e3da03a575a084ece3a5245706f696a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663731, "uuid": "b173039f-3baa-4242-a6aa-ba46b21eb94c", "value": "T14D84D0113AE0DC30E4A93E309472C6A5267BFD6269749507F7A07B1F3EB33819A31796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663731, "uuid": "f78df5d4-f038-4aad-8f6b-8858c84d5e3f", "value": "a5be41551dc2e25f2c00beb7c9d80493", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663731, "uuid": "51962a2a-46d8-4cac-b9b1-3916ab6a2646", "value": "6144:LbbPjzI9JW41SNYQVMttqopUtj9XLzgoVK11r70C2cC6HJdmQbh0ToYigavwVf:nr54SN46Vtpzc1BAcC6pdbmcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663731, "uuid": "781ce1b4-034e-41ac-a9ea-8516d71a438d", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663731, "uuid": "1554c48e-8a15-4704-bc48-6fbdd54f6807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663731, "uuid": "985c905b-1fea-4aeb-8125-235bdc2ed15d", "value": "ce1a321ca8b7b8ee62ecd81cff2437d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546ae923-ddea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653675905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675905, "uuid": "787fd06f-1e8c-4c62-8cd5-7242a09ec247", "comment": "Malware payload (Mirai)", "value": "d74bf4db8e2e43cbdc9c527ec15356b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675905, "uuid": "031460bb-f994-4bd8-8fbb-9ef56c0ce821", "comment": "Malware payload (Mirai)", "value": "c0b3f4b9a9a57965c0429b5199e634012e223a4617a13a89dc5e2508085e5575", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675905, "uuid": "7c3143c3-fb39-4ef8-8590-0f249a7dba1a", "comment": "Malware payload (Mirai)", "value": "5de6b4e1a4b1f896ec6b3b6b473c8afb4d6f40a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675905, "uuid": "5c94718b-e8ec-4fe1-b6b5-9e54aefc349c", "comment": "Malware payload (Mirai)", "value": "33efadd700b886350198d4f6b66c7849ffc4f8dbce173a21c538cd971cdbe59b819964b8186060de1867d8d5973b051d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675905, "uuid": "9d39c135-40e6-4f81-bb6a-0958d8aa3532", "value": "T1F903F1BDD0B90DC1EB6BED6C8C77C2A82EE15F9AF2E6CDA4329C6F5149060395345D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675905, "uuid": "6de95f25-7c41-48ce-bd26-0e58c02eec07", "value": "768:FdCZnhT/jFCaEQd4RC8he9+QZu3ckO7jTlZKhnHdM9i285BE4uVcqgw09M:O5hnFOQURhCZtB7j/oHdAijQ4u+qgw0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653675905, "uuid": "2337fe26-4ff2-4518-afcb-f9bb02f7be67", "value": 39372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653675905, "uuid": "e2021039-7e0e-414e-a9a7-d84e9780c291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675905, "uuid": "e82509e0-184b-4584-b00f-ae1486b7060f", "value": "d74bf4db8e2e43cbdc9c527ec15356b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043952b0-dda5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653646135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646135, "uuid": "8f546e4e-9ea3-4a53-bce0-80653b106215", "comment": "Malware payload (AgentTesla)", "value": "ab78deee7a694c0132f536f2d8e3df30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646135, "uuid": "d9214ce9-7c91-4b6e-8c4f-2c6af9628ad0", "comment": "Malware payload (AgentTesla)", "value": "c0b833344c0c59941ffb1484a538a47048d71e9a33e2f86ff602e63ac71f3746", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646135, "uuid": "a4939d08-4c57-42ce-9603-58bd0106f8de", "comment": "Malware payload (AgentTesla)", "value": "59d0d05daae439266ddb47433da72c097d5dab47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646135, "uuid": "0cdc522e-e7fa-4a13-bb5b-e25f41567724", "comment": "Malware payload (AgentTesla)", "value": "05d0d374981ee6e0922a7c5d6403c39a5e776ee06d888212d1f458182cbd940bbcb7b443433ec0d1a31967bf45fd8c6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646135, "uuid": "c8c6e7b6-9372-46d7-937d-5684b54501ae", "value": "T1D4942322E38464A6BAE03674FE7F97A2B045C7D9053622A339D37C96EF463174B4860C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646135, "uuid": "ad3de2ab-b8ee-4bcb-a183-c13b446a47c0", "value": "12288:4Auyueax4LhG/kPQwAS4eLF9VDJiYxFjfv:9uXewihvQ5Q/FLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653646135, "uuid": "d7cfeef0-7945-4d88-a35b-0f90eca886e7", "value": 412701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653646135, "uuid": "cc5b20ec-ec79-4b6d-ad00-48a6627c20d5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646135, "uuid": "2952619d-759b-4bd4-956d-6286b3a79b14", "value": "documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d794bbb8-dde6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653674407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674407, "uuid": "f9f9acdf-219c-4530-a9ab-20861a3b52dc", "comment": "Malware payload (Mirai)", "value": "d11aed3f584868f854114b9857b0be93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674407, "uuid": "a6a35ad5-048c-4b5c-a425-66b4603ddb3f", "comment": "Malware payload (Mirai)", "value": "c0ec5bfbe38d08a565dde5f6a9fdcf372b14eda7c3d36819148f8bd0dc2ea4a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674407, "uuid": "4d8a7cb4-aa2d-4938-9d39-4766d85c324e", "comment": "Malware payload (Mirai)", "value": "7e76b78812d58f1e4c60b65b35c047342a857301", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653674407, "uuid": "6828aec6-fdf8-400c-9f3c-eead0cb6881c", "comment": "Malware payload (Mirai)", "value": "7fba7583e3650effb4bb34c0bbbffe14b2ad50dae7788c8d87cc098d222840bbfe01ca1e237002aff3f891aee2f73001", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674407, "uuid": "3370fd22-3023-4bf6-96b4-066cfafbff3c", "value": "T1876301A6C336D893C741ACB3F544849AE16B85BB9F7F342723B46ADCB6940814F9A403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674407, "uuid": "0ba03c69-8917-4eb1-907d-5a90bb307090", "value": "1536:J1MGL2VhqNplFayrsG7/gogsh8udlHtCkgLVCRoXa3b689mM6:J1CVhA/F9rLeseUlHt+LcowdYM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653674407, "uuid": "2914195b-28bc-4a09-bd41-4077a0f24507", "value": 67352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653674407, "uuid": "8b874103-4642-4e78-bc1d-ff21e67a32dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653674407, "uuid": "79aee139-5c3f-43d5-8b4c-f0c9c52c9592", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d7f06c-dda5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653646298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646298, "uuid": "e2ddbbe4-049d-4971-a00b-33b59cffd9fc", "comment": "Malware payload (AgentTesla)", "value": "cb490dd90ce8d9d11aadb9765abbe5e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646298, "uuid": "d1dc69b4-ec5f-462c-b1b9-3914358b1312", "comment": "Malware payload (AgentTesla)", "value": "c0f90aecb695c93c21e13bbb346f794928bd4dfdde1c3c88c70f62acaf1d368e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646298, "uuid": "526ae0b7-9345-4b07-b6c9-d23744bc11ab", "comment": "Malware payload (AgentTesla)", "value": "1557b8f1f9c2879a8de75689530f78d796d8fc04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653646298, "uuid": "7bfc32ba-98b1-439a-905d-6a7c9a1d981e", "comment": "Malware payload (AgentTesla)", "value": "f7bb3e37a14b541d416cb5be62c8e9b073f408350bf523b615e9c90b43d171b9a6df0e9e50e0d5339fd99f7f8645a4b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646298, "uuid": "a00c0b91-4cf8-489c-a957-6f7dcea682f4", "value": "T169B457E42343C2B5EC05A73918D28921F2366F862D20D97E2602BBFAFF7F19B54151E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646298, "uuid": "543d5ec6-bb70-4169-8002-26973137f657", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646298, "uuid": "20e189df-d0a8-486d-ac7b-b6a428096cf5", "value": "6144:s0YynsIMquMA3WcHWlZMZ6hBTQaN2SX1RtUfVYuoPgymDvTvPIzwaIv6:5wqIWMCZMZW2aNl1RtsVYuRymDbI8l6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653646298, "uuid": "f9f62377-e6fe-4b59-b475-1d149b2b07ab", "value": 511491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653646298, "uuid": "e41c5bb5-ca49-48ee-b6d9-d3cc358d7fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653646298, "uuid": "26e8dba8-7c09-40dd-9ebe-79cc8b0c5402", "value": "OR098765458900009876540.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c4f8e2-ddbe-11ec-8e58-42010a9c0032", "comment": "Malware payload (GootLoader)", "timestamp": 1653656957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656957, "uuid": "c548db78-2205-4659-b50a-f7db94dc420e", "comment": "Malware payload (GootLoader)", "value": "4dd369b5e028beebe3aa5c980960c502", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656957, "uuid": "f426dcb4-83d9-42d0-9740-e429e2ab2b0c", "comment": "Malware payload (GootLoader)", "value": "c1029f0b5f4f6dfbe0fe656f075cbb5ccc2fc308087db21438d73394b75ea020", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656957, "uuid": "802bfc40-d087-4bce-8158-fdfe92c080e7", "comment": "Malware payload (GootLoader)", "value": "2a32c3edb7edf4353f0aa1e8e4908f843b255214", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656957, "uuid": "7bb75dd8-920f-4028-b89c-f9d9110cdfd4", "comment": "Malware payload (GootLoader)", "value": "6d8a0bfa0212f84ee7e6c763a27d779ca6e403de0665ceaa50d788715b433dac12857331c4f316b87b7b5501355a503c", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656957, "uuid": "fcb38691-fa94-4507-80f4-9200581545c0", "value": "T18254B4D9F78D112E423231AAAC2E12CDB77CD171560458AEFD4D597C24A083D83BAF7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656957, "uuid": "1c33838c-4735-4d2b-a165-5f03c54886e5", "value": "6144:rJshNVlV+TCtlFhTIeKpOcYmD2zK8w6JEDPx+WK+978FyW48L/dCaYNNEIPfbv0N:48OcYmD4/EPx+WK+978FyMheNPfhA+up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653656957, "uuid": "ae7f6138-d97e-455d-80d3-cb6d789b76f7", "value": 293088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653656957, "uuid": "3d3ca800-22d4-4cec-8563-f7679f1a0817", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656957, "uuid": "35aea3e1-4034-4287-af8c-8ff8903d40cd", "value": "making_a_contract_legally_binding_30040.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8c5092-dda9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653647997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647997, "uuid": "f34fcb99-3ac6-4be7-ad74-cff6e3c2ce9d", "comment": "Malware payload (AveMariaRAT)", "value": "60854a465d3636c200544a69eac40b4a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647997, "uuid": "dd01ae40-f4f1-4d77-a682-337909bc8b0e", "comment": "Malware payload (AveMariaRAT)", "value": "c1947e5cc56a809d15d4b703be9f3d820fbfa5cc3d0f5aa47b1c32f44b64504a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647997, "uuid": "c401f3fb-cf8f-41b2-a1ec-c56455ebb9ed", "comment": "Malware payload (AveMariaRAT)", "value": "0fc11c7886015a43c007b7c776fcd7def4b7527b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647997, "uuid": "09f7156c-c1f3-4bd9-b7bc-5976b08c34cd", "comment": "Malware payload (AveMariaRAT)", "value": "b989944ff8a92d566ae210ddd61ed3db3be94fe71e1a401fc84983af1d9f87791964bc7c7f2eeb2cfe58a7e882298ead", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647997, "uuid": "1286e9dc-5eb8-45e6-9b3a-31651521402e", "value": "T1EC243ED0AB5BDC3BF488B474A6858064BE9EBFE5F8D245CE205DF64A493279144F0C2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647997, "uuid": "7ca7c2c9-5e10-418e-9204-181dab8b8f62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647997, "uuid": "2b330502-e314-476c-9325-5a47099c3639", "value": "768:9rVPiiG1d2O50lQWnhObkAApLu3oiIDNzeJku9vx/SF5Mbd0oC3d4OoxnrKcSnYG:JVcYnkbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647997, "uuid": "90bfc4ea-c879-40fa-ab16-6f0150963248", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647997, "uuid": "f7aa1af1-b2b8-47f3-96a4-f3ccf0fdee0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647997, "uuid": "623e24dc-3fce-48da-a393-7dbec1331db0", "value": "SecuriteInfo.com.Variant.Strictor.272916.17678.10024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbd0f89-ddce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1653663973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663973, "uuid": "1c40639d-058a-41a7-8e68-32d628e8c8b0", "comment": "Malware payload (Quakbot)", "value": "1abd9b1afda3ac779bc01cb56cb30ef8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama185", "colour": "#D23AFF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663973, "uuid": "1309a578-b969-41bc-868a-a35df369420a", "comment": "Malware payload (Quakbot)", "value": "c340039882796575e931b463c65eb9e42e7c362f53d555792d9ac8afa83a28e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama185", "colour": "#D23AFF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663973, "uuid": "594f05a3-856d-4d8c-8271-f4bf4fbfd249", "comment": "Malware payload (Quakbot)", "value": "6f46d00b8517202effc0bcc43ac1b904d346f2a0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama185", "colour": "#D23AFF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663973, "uuid": "3ddf1522-af29-4d22-8e96-28fafbdeb10c", "comment": "Malware payload (Quakbot)", "value": "e8dd967e02d35d27f0c9e487ba9c2d575eaaf23d7b6ed5d968bcf1d982877da534e4ff68b1393b68e2f7b8d404c092ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama185", "colour": "#D23AFF", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663973, "uuid": "2b713a60-3d67-43f1-bfae-ff3dc605e128", "value": "T1FB15B0B876243DD6E66E067BDAD6BCDC1B76177289CBB4C84064B7C305A3372EE01825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663973, "uuid": "2226d66f-5845-48fe-a4cc-4d40073c7d14", "value": "12288:rhjcYDkZzYxDrD+Id9TNOPTtCDK+y42rIrO8EiuPSZI99/6AUXZ8P2RP/R+4sr20:rC03LboPhCw42rIWiSj/GTH4rgv1juL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663973, "uuid": "102c6a0b-c763-478e-a13c-99e95cd1b5ba", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663973, "uuid": "107e2efb-5168-4ce5-aedc-fd4e9065b4c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663973, "uuid": "73ddc432-4cea-4bf5-9b1e-7524d638561f", "value": "c340039882796575e931b463c65eb9e42e7c362f53d555792d9ac8afa83a28e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7049ede9-dde5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653673804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "5aa53bee-860e-46c8-bf42-01fb4d4f03a7", "comment": "Malware payload (Mirai)", "value": "85f4d82e56d3f216724c475b4b4cc17e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "31f13bb5-f21e-46ba-a68e-3844ad0dbe27", "comment": "Malware payload (Mirai)", "value": "c381706c96b8c6e5e9ddf8e86400a2bc16a94401c25388d5edb459b686971f5c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "b0122c7e-7d88-4b63-b252-63691a9b3054", "comment": "Malware payload (Mirai)", "value": "8430f832533bc71db049b7160fbdc62c9e1e7f0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "053f8a04-2915-4249-83c3-545cafd5a715", "comment": "Malware payload (Mirai)", "value": "9cf408427692fb8c6245c23df3ae63d061cfd4175859df3911116aa53e15996322d4bfbddf7bbb7c32f3895ee220928e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "12333ff3-82c7-40d4-a170-bec800c26bf1", "value": "T1C6A3E604ED505737C2D23BFAF79A42CE77351F986B97334196283AF41BE5B982A39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "b582c56a-f9d9-4a68-8b4b-73c35ad6cb39", "value": "3072:rwbRuW1i4sB9xQMOvA9dHB1WoAgqFhQQaH8kmIB4OrunluWMnoe:ADkmbOrunyoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653673804, "uuid": "541ea2b0-ee36-406d-8af3-483275bd3a99", "value": 102051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653673804, "uuid": "e9b04feb-64a4-4a2c-a8b1-6ea2e8c527aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "37ecc1b3-804d-4fa1-a3a9-29dd38b5558d", "value": "[cpu]", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a117dc-ddd3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653666047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666047, "uuid": "f87681e3-5b2e-47fb-8beb-00ed0d27cec7", "comment": "Malware payload (Loki)", "value": "d25f8bc8aa804f5ebc311ac519d822da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666047, "uuid": "1072d70d-8e74-4889-9853-5c4fa12754f7", "comment": "Malware payload (Loki)", "value": "c4c6068b86fcdf0f5ebe83a9d114bc16f2f5fd9baa4d056036954bdf06061004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666047, "uuid": "e8981f57-8f3e-4ece-a540-9e4314a8e607", "comment": "Malware payload (Loki)", "value": "8045ddb5725c757642b472c998f6c3a2afa9bf97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666047, "uuid": "460ed8d9-3ec1-4100-8db8-169f36ef10f7", "comment": "Malware payload (Loki)", "value": "6cb4d851786fc81c7efbb1c530f80cdec33f70d52abcd650d80b96bea549179e71ff8706117d4264c8e6ca608dd440a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666047, "uuid": "67621f70-67ad-407d-98b1-85fe77dad7fb", "value": "T1A6F4ADBC31907DCEC817CD7A89985C649A202C665B0BD207A0273DDDAE7DF968F152E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666047, "uuid": "3592cb82-e512-4e45-bd8b-b7a88bd6e5d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666047, "uuid": "fba80816-c425-416b-9a6a-89bcfe476a55", "value": "12288:mtwIwXJ6AJ9bHoAUNvqV5ApTwxwdhOMZjtIfnNkG9fLvmeep+n6TkdL:mtdw5BHbHo1TzeMrinCYjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653666047, "uuid": "8e4d64b2-9a85-4c12-8fa6-d502f62915e3", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653666047, "uuid": "df45909e-752d-4011-a564-28c398f00c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666047, "uuid": "e848f11d-1913-4af3-b686-f447b642b230", "value": "mezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96aebd00-dd89-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653634354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653634354, "uuid": "1a1f1811-7e23-4df7-bfd6-96d637ea585a", "comment": "Malware payload", "value": "a2ca3cd7935cc81e6fd1c2d0c9856c1f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653634354, "uuid": "0cf86c70-0a3a-46cc-ad7f-4d180e1c6455", "comment": "Malware payload", "value": "c62a22d098f1cadcab0c5ba6d97c306b9e310ddf205c84ddbbeb32e319cabce9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653634354, "uuid": "d4a53a15-4b9f-4b41-910b-4170745a8175", "comment": "Malware payload", "value": "7e13a276c02c33aefbaf6ba525af0d8dd07c91b0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653634354, "uuid": "aa537ec4-d928-4193-89fd-1b6fe93eb244", "comment": "Malware payload", "value": "f9843f642bbd84b97d36b93d216bfa4ae66c95f202f5f257c81af7d8bd1e66c15bec07f3e0348107bd2675c6c6096caf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653634354, "uuid": "35b3fea3-703b-429f-b07b-8b5ba8e1b420", "value": "T16F772347F3A9E99EC8F3933244756132055B4D21CBA39BD72E04773829B39E46B89BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653634354, "uuid": "cfc00168-bb81-4bb2-a605-f5126a6e2ccd", "value": "786432:j00RtKIr+OVS5oWBHWA0qZW0QnCTQuWii02xLF42:j0kkI3cT0qoHqLi0GLFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653634354, "uuid": "7ac07558-21bc-4d7b-bb9b-24eee9c3eab5", "value": 35822336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653634354, "uuid": "a5de3806-0e39-4c2a-b642-c81b147604d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653634354, "uuid": "d2ffd92c-a4e4-4999-aae2-2ec791c0e1bb", "value": "Funny Game SMS.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221c4d7c-ddaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1653650480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650480, "uuid": "c460b80d-caad-450b-883e-f9a0e8fdec25", "comment": "Malware payload (NanoCore)", "value": "de791f645b2235dce3572c7c5961e17b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650480, "uuid": "6cd64156-0ba6-4682-994b-9e7ba0bc8a79", "comment": "Malware payload (NanoCore)", "value": "c6523795348cbf7e88f40cf12cf9ab092242e54fdc972e6ef4591bb3b5497275", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650480, "uuid": "d4bbf732-0e0b-44fa-826d-98508fb6eba8", "comment": "Malware payload (NanoCore)", "value": "6568e7698ec8a060e0ed98cf7c11de815867d195", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650480, "uuid": "b047cff9-2bcc-4092-ab0a-d38fab84ab66", "comment": "Malware payload (NanoCore)", "value": "4330d4ea89d9fdfadaa6e4b743f582e18bd9114910bbf609f99eff637efde26c8912650e58c53d11072392d8c984aac6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650480, "uuid": "395dd2e6-a143-43ca-9ad3-c7504ced4de3", "value": "T110B2A251EF8C4E36DA263AF25B23F24002399ED25946CB5C24E030466EF2FF50E7E924", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650480, "uuid": "e9d5bcda-dfc8-4edd-b36b-3ee2b29b657e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650480, "uuid": "90794fb6-85f8-4f01-91e6-aa29db71935f", "value": "192:Mf8VkNtIz9D7XnXJlEBwXORllllllllllllllllllllllllllllllllllllllllB:MkVa+9rnXJlEBwXY9SS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653650480, "uuid": "60a4c4ea-9e63-4a5c-ab87-7a0d0909631f", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653650480, "uuid": "552bd110-5184-42b5-9a25-c8a8634a5626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650480, "uuid": "b0e1822c-4d4f-4349-ab27-96efbc9ac046", "value": "TM57812337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e25521e-de0f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653691893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691893, "uuid": "95bd43df-0d24-48a9-a79a-95ee9bbbfefb", "comment": "Malware payload (Mirai)", "value": "a2ac640b4acbe637a7e583462092b792", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691893, "uuid": "1be061f0-a5b6-40c3-a8dd-d50c3a3aab5a", "comment": "Malware payload (Mirai)", "value": "c8d24b58f6584fc69920eb137928bd8244811312aea5539b3c904d550978b798", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691893, "uuid": "d9d076db-6a65-44fe-ab84-e0b95130b178", "comment": "Malware payload (Mirai)", "value": "0cab93e1d9bef59165ee6d6bb66fc01d381ae540", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653691893, "uuid": "79134b5c-a436-413a-8fed-6bcea38d2896", "comment": "Malware payload (Mirai)", "value": "bd2134bcb67e2e4621a77132ee6652008968a675876907b8584ebe4cd29cfe9329558ff796e5415608cefe97013fae88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691893, "uuid": "25f787cf-aad1-4d7c-9154-a3979e567d9f", "value": "T13C733A753946F63CE9E590B8F84329D115220A083FEDD5E36C83607ABF70B89716CE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691893, "uuid": "bc671f52-aba4-4fb0-a902-cc60756a762c", "value": "1536:SVUiFHcgJEahRzvz3Ym1DMNYVBIVCCfy0K9k1qAfn:SVUiNcgJEyv7YODxujVfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653691893, "uuid": "cb2976c0-edf2-4d35-bec8-4bce887e2972", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653691893, "uuid": "cc91d44e-30f1-4bac-902b-04d3c24cb75f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653691893, "uuid": "4c63b10b-d3af-47a4-9cc0-f16c16b41c95", "value": "a2ac640b4acbe637a7e583462092b792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e0d0f4-de10-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653692448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692448, "uuid": "53d262b4-aacc-4633-80f5-49865d4d6b91", "comment": "Malware payload (Mirai)", "value": "6a300240b78737c30c383312f65b3700", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692448, "uuid": "4b3d525e-bf3a-483a-80ee-58c1b1f7c77b", "comment": "Malware payload (Mirai)", "value": "c8e9af822dff83dc0846323ae3ac6a05964af4882951d8c54272948b652cf37c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692448, "uuid": "3bd92ae0-f68f-4d1d-8939-eab49a7b4792", "comment": "Malware payload (Mirai)", "value": "3818984790a4be8fb154b2df3d5f4093d723c592", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653692448, "uuid": "56f6ff8e-9e29-42cf-b6f3-1831f8959c47", "comment": "Malware payload (Mirai)", "value": "ac82b5aa34efcede8d2b84a27f7f60369de5ac1ba2d134ce2365dc1ac9f1806a45a8b8f3004978ff3b374927d79d8c74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692448, "uuid": "8be336a9-1ba3-49d0-a5da-b0b2d5d01170", "value": "T1C2C2E034D49AD9B0DAF8993447A796C33E2A077CD1C6336D365848EC80D2F0B27382A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692448, "uuid": "20a1d1f0-ad87-4644-8741-e45e68158247", "value": "768:sftduqD57GZ4MZt+zXiT+Cxtime/XnyOs3Uoz9G8:Ibit+zi/xt1OXyzzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653692448, "uuid": "dae4c48a-fcfd-47e4-a90b-66fa7a9dfe86", "value": 27432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653692448, "uuid": "4184facd-4d4f-44ae-aac5-33d9d37b6eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653692448, "uuid": "7ec51f84-18ff-4381-8dcc-4d439ef2a170", "value": "6a300240b78737c30c383312f65b3700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1931f0c-ddcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653663713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663713, "uuid": "0a11e952-1605-403e-8058-aa622a52022a", "comment": "Malware payload (Heodo)", "value": "56a3ea0649478d78245277c619d7ffe1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663713, "uuid": "73f5d4d6-6ebc-4801-9098-5bcd0c9e2cb1", "comment": "Malware payload (Heodo)", "value": "ca3db32b8bd475fd2890e1dfe77003aa098ae6b9c74ffc44d6fb7393dc317d12", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663713, "uuid": "f87e9132-ace2-4c72-948d-69a4f4e57519", "comment": "Malware payload (Heodo)", "value": "31372d53906631a2f8e4a0f5308deb7711ad4215", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663713, "uuid": "38c76ee4-4fed-498a-aa7b-2c0b068cf974", "comment": "Malware payload (Heodo)", "value": "42fe7c38508b3a8ba467a33051e32bd7c15d9dc9e124efc19940f3133ac6683ee10bbbb48197bd652bef0be9f3393c9c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663713, "uuid": "44424feb-a99d-44d8-bcdb-a13e0c6ba3a3", "value": "T18D94CF57225148ABE3537275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663713, "uuid": "eaefee64-7ace-4be7-a366-c915f87bb58e", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663713, "uuid": "988da67e-52a1-4faf-bc5e-252543255b58", "value": "6144:I9wEpo6/4WaPgMIuxqqUAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqUAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663713, "uuid": "3aa99444-26bc-4d22-8aaf-bc311ea6043d", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663713, "uuid": "0edda105-05fd-451f-972a-110fbd146e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663713, "uuid": "225cee80-78b0-4f98-b71d-17f4e3b1465b", "value": "56a3ea0649478d78245277c619d7ffe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dedd9d-dda1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653644411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644411, "uuid": "a8552e2d-7e08-4971-b24e-c65f10539ca7", "comment": "Malware payload (AgentTesla)", "value": "6439dee80f70ac53e227f0c2f8e9c7b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644411, "uuid": "780451ae-6898-486a-81ca-6fc913260dae", "comment": "Malware payload (AgentTesla)", "value": "ca6e06cd9520b5cf4eabca2a25b35cad2068abb62b36c0cee6627a6bc875ba8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644411, "uuid": "96908b6a-1fb6-455b-a374-bedd977f50ab", "comment": "Malware payload (AgentTesla)", "value": "02f2e368629b1df6382b82333b73109560941a28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644411, "uuid": "d43e2bc9-3587-4ee4-bccf-317dc30eb49b", "comment": "Malware payload (AgentTesla)", "value": "9279efcdb2c6d52a9a84203f102d6861f52c6647d803839a13ef13c3904c56497d6c4aa00d38fee7d95dd1c4ad329e5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644411, "uuid": "7f02f842-c7a2-4f88-baec-36886fbf4e82", "value": "T116C423889F415B39D63BA0D3FEA35D2975ECF92170CF2074BC9518778A8216F2686C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644411, "uuid": "9d57ae44-f250-4134-a5da-e891ac6fef17", "value": "12288:0mYtUchLj7WVBU2k01Y7tcZ91knQaUVlqu7h4:0mHcxj7uBs01YRcZXkQaUu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644411, "uuid": "e6d8d248-e957-44bf-9bed-12c4c6a55b2a", "value": 591374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644411, "uuid": "ee681694-c6c8-4ff4-b325-d6bd5b4b83f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644411, "uuid": "65047c2d-1ceb-4990-a5d7-5141838ebb42", "value": "Swift copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba90417-ddf9-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1653682332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653682332, "uuid": "70aa9358-80ce-4526-884b-42661458fa45", "comment": "Malware payload (NanoCore)", "value": "0b3e38d2ac6ab696f6a760cf1c2290a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653682332, "uuid": "d92bcc99-db1b-467b-9f1b-f5c94633a1c1", "comment": "Malware payload (NanoCore)", "value": "cacb2f55774ab3d5f1e89e164ea67bfa9b0f612a6e64dd8b31d062bec1d12cb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653682332, "uuid": "3bbfe656-b48d-4849-bc83-25c3ff3ca9be", "comment": "Malware payload (NanoCore)", "value": "0e70e8253e753153028c42b11afd7dbbc790fa35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653682332, "uuid": "b6cd7bca-c612-4067-b7bd-b0fff3ce739b", "comment": "Malware payload (NanoCore)", "value": "15e7282f18f43def7300bab6a321b739260c39e5c9271c1fb092375aa608e32b8708aa72acba9d7e7f908cac8768bda6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653682332, "uuid": "6db3e7d1-38c8-415a-9052-2d69c1d7a1be", "value": "T1B5D41211696C8BAECC1D4639DC6521DC03F84D13BC52EB5BEE99B5DB1D333C2C221A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653682332, "uuid": "a3b53cc7-d60d-469c-815b-a904b46bcc92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653682332, "uuid": "7ba0a939-f6d9-4872-b969-d88357afacd6", "value": "12288:ErHC+ooJtQJOCPI/w3a9073/E+fu5mt8Gvt40pd+oKjQqB1HKtb:8bfQBPt3E04Osmxvt406xBB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653682332, "uuid": "a437b6db-7e3d-4e18-bf0c-b08c6976be71", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653682332, "uuid": "a0ef3d11-be3d-4733-92e3-721e8d36215b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653682332, "uuid": "4647f7fb-5342-429c-b900-38d1d9838eec", "value": "0b3e38d2ac6ab696f6a760cf1c2290a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e9bb34-dd5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653615137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615137, "uuid": "542e9b04-573b-4555-a2ea-4323a5cc00c1", "comment": "Malware payload (Heodo)", "value": "fe3e6647e0fc0b147b337fbd4d44c416", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615137, "uuid": "87b20119-9b59-4cac-9768-398aa20df3b0", "comment": "Malware payload (Heodo)", "value": "cb03036099932102e687f805a33ff15ef324aa28512ed105325cad6110aad0b2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615137, "uuid": "21c5ce5d-c3a0-44f5-80d1-f5d400573e02", "comment": "Malware payload (Heodo)", "value": "6f1db680a0c3fc370897249fa19b6fe3eb7e138c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615137, "uuid": "f0e4d543-5cfa-43f9-bef7-df8276820cc8", "comment": "Malware payload (Heodo)", "value": "e4ae90e997985d61bfc680a00629b13c2bf7cf5beee5feedbe3ac61d21c6c8583b899c270c88c3a61e0b1cc43b09854e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615137, "uuid": "fc4d2b73-f2d5-4d21-983d-0232d40cf8d1", "value": "T1E3E49D01F2AC80B2D06FD13989A34A4AE7B13C9497B593CB5251FB3A6F732E15D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615137, "uuid": "f8776e1c-7b7c-4a6a-ba34-daf6a0d336ff", "value": "b7b90674fa6c5f9a16bdab0725f21bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615137, "uuid": "96ce21f3-67fb-41b4-bbd3-263d1fa9e042", "value": "12288:8nUIW4anSDGCH0fu1QJKw+be1gUK7wrnUfpE:kUITnGCH+u1QJKKCwrUfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653615137, "uuid": "99255038-b93e-42e3-9357-783ccded2ce0", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653615137, "uuid": "1edb9729-4938-4db7-baa8-58cfd4917664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615137, "uuid": "0a4069ec-0519-4052-aa8c-5fdf8417799c", "value": "fe3e6647e0fc0b147b337fbd4d44c416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a21e07-dd98-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653640956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640956, "uuid": "b976e34a-3e2e-416b-846e-8e2239780293", "comment": "Malware payload", "value": "dbf59b349c547f587bd0ae41ccf01d0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640956, "uuid": "6bb7cf87-59ef-4b9a-bdd6-6b1968ced080", "comment": "Malware payload", "value": "cb264dedea2fe1eb2f7029682293b520ead318174bc7bd23c70cca6026d40496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640956, "uuid": "be536966-73fc-4136-9667-660ad3684074", "comment": "Malware payload", "value": "ef2debd37dc21d6558d20ebb7ee202b0bc71a7fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653640956, "uuid": "74ddb1b4-b6df-47cd-99c3-bba2a2a9dac3", "comment": "Malware payload", "value": "f7f2ca4b67310ca53503afb1eeb3ab9393debefadaf2e1849f22e37f4db98b6227d48400935491969ba0cdd967817b8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640956, "uuid": "4a0d76dc-a8f3-4849-aff9-3988b5b4ee86", "value": "T1B8D3AE4031D281BFD8656AB258688A8196AFFE322D398F8B734C157E8C745E0477BF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640956, "uuid": "ff3f50b1-6f19-4ead-84d4-ad4f7c5d1f60", "value": "bbb2f32f8d365f3ad9879bc589ae5fb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640956, "uuid": "7b96bfdb-b440-4d15-9e5c-79603d021290", "value": "1536:5/TOG+x8+YaGDARvmJVBqNvnlajcCOO0LdXU8JiA1OySu3PYRqSnakMP1BOBYCHF:wfbnR6BqNvncvhw4u3yqSng1kGCUHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653640956, "uuid": "47557b6c-996c-450a-bc06-fd8104432cf2", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653640956, "uuid": "9a43b5a4-4033-4d0f-b234-770e4cff224e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653640956, "uuid": "11f6edfa-df22-4c46-92ea-55e86f14413d", "value": "SecuriteInfo.com.Variant.Jaik.73412.4924.5223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfba518-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662792, "uuid": "2e65a23e-0366-4b26-8275-0336f6d30a6f", "comment": "Malware payload (SnakeKeylogger)", "value": "27ebfa446ded136e5811179f389e0ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662792, "uuid": "101f2ee4-96f9-4092-8c64-8ee1ebe2c057", "comment": "Malware payload (SnakeKeylogger)", "value": "cbcda2a8971caaa5fab36eb3745a6f8ec5f7bfcf4b6efe6a8f9aafd8d3d6a747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662792, "uuid": "8b0b0aee-1fc8-44f1-b14c-41c730520e6f", "comment": "Malware payload (SnakeKeylogger)", "value": "70874d9028cbd2b9105194e92a6e76aab2059f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662792, "uuid": "cbe6f7bc-eabe-4818-9c36-506c5610b1d5", "comment": "Malware payload (SnakeKeylogger)", "value": "122157087e490326abbcb8a496ffb6b5394ba0c8603f83db9190f5194873844ff48d4890ec4a49b0ff0077a521312713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662792, "uuid": "b225067b-5474-4343-8271-7600c7a84a93", "value": "T11FF4D09C3290B1AFC9A7CD36C9A82C10EA31B5A7570BD20BA057119DDD4EA9FCF115F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662792, "uuid": "bd7d1c53-6f61-4f94-a874-6b323434e66f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662792, "uuid": "d27b74d9-95a0-40f1-9f77-3da00fa08993", "value": "12288:uP7dZbHoTudH0kMKkdJq/Kevo67IUH5OR6XN44alfWU2rFfMSfkYAp987KCT6Yjq:SRZbHoy3RHrEoN4ZlR2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662792, "uuid": "6e636e07-58fa-4396-9bce-4a724e0583d5", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662792, "uuid": "7c043d59-a8f7-4259-a244-524c9500a4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662792, "uuid": "205d07a8-e4f2-472c-a8f9-0166ef8ea1fc", "value": "doc20220010010021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227dfb5e-dda9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647903, "uuid": "9f54288d-3a78-4d64-ad5a-14d5e178e84b", "comment": "Malware payload (Mirai)", "value": "9a812e57c6ffae8597f1980c3971cbb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647903, "uuid": "1130bab5-2f73-49e6-91a9-0b1989d166c6", "comment": "Malware payload (Mirai)", "value": "ce8dba6b60b2e50f022a360366edeff64638ba50fc70fa009ec3a1d9c35b3a2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647903, "uuid": "460099b1-816e-4c61-a279-86f9625c07f7", "comment": "Malware payload (Mirai)", "value": "6db54de2fc49a05058d12f37522e519a86f57d22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647903, "uuid": "d8ea9941-5d2e-4de1-9f04-27027c62a2b0", "comment": "Malware payload (Mirai)", "value": "934a2b20bab88f9a00e4ea4b5a6ec3e63089a6aacfc41faeaf0243cfe624c336a2154d8d938cd3a412b70890b98146aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647903, "uuid": "a2f35f5e-851c-49ab-8b95-b998ff6b0657", "value": "T1E793B30ABF740FF7EC6BDD3749A92709158C550A22E97B357930D818F64B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647903, "uuid": "c3c0109c-e50a-45e4-8763-b0022eb526cf", "value": "1536:zahaNVXM/WLJVBjzQkv32I3LY/0B/BXsZiaBLTe1:zahGVEWnB/Xu2HXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647903, "uuid": "18271300-68dd-447d-8055-76c328b9921a", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647903, "uuid": "91662627-c1cb-4dbf-8fd1-0032504aa8f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647903, "uuid": "079a3f10-1c52-4a0d-8e79-47a28a283293", "value": "9a812e57c6ffae8597f1980c3971cbb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb437bc-de17-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653695513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653695513, "uuid": "0037930b-4936-4608-b607-3f4ce05951c1", "comment": "Malware payload", "value": "cbb0118b67efbbbc60097198fb6eed27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653695513, "uuid": "fff31eb2-808a-49f2-8a58-502842539642", "comment": "Malware payload", "value": "cf21f09e90068f885e6f13009f71847bba6b0d8170515ce0f4b82da22de1012b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653695513, "uuid": "7944b855-c738-4952-a8dc-7027199bd301", "comment": "Malware payload", "value": "3a7c50d2b457e703b47b0e32b782d8e167f8fb30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653695513, "uuid": "6158b327-83a7-4202-a0e4-df7b374c627f", "comment": "Malware payload", "value": "122e03a68b5a0dc074365448459425ae8e057b229b80f9f5eb3cb4ff8b6604961a439e24e7a48a444d1f4d38672bc620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653695513, "uuid": "cbe1e881-0c90-4b23-8b74-1c12696a8d57", "value": "T1A094C0B876286CD5E67E067BD9D6BDE917B6373289C7A8CC806477C305A3331EE06814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653695513, "uuid": "98618839-0d6a-40d3-9927-3759f9418b23", "value": "12288:j1SX/m9v0+d8MOXGU5I3hwUWflXzpbZY/4oRh9JfnLUk:J/RFOWU5UhwU8XzxZZ8b5LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653695513, "uuid": "c25bfe15-2b1a-4c4f-8d61-9e9fabfa11fe", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653695513, "uuid": "e849d67a-3ad4-4fb6-84fa-eb852672eeaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653695513, "uuid": "0b222418-2236-44bb-9c80-8a8a3ed383d0", "value": "textels.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2cfd18-ddbf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1653657342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653657342, "uuid": "3cb1bae3-a788-407a-914b-049faafeb269", "comment": "Malware payload (Gh0stRAT)", "value": "6cc377a6617f0690d5fc4dba19b56f30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653657342, "uuid": "574dda9d-584e-4209-8a1a-c316b74b5827", "comment": "Malware payload (Gh0stRAT)", "value": "cfd557f37597360663528c0dec20b2a9d6a19afebd2198771fee5deef461e5ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653657342, "uuid": "96b39bd0-e7b7-442d-bf4b-abd9a7d665df", "comment": "Malware payload (Gh0stRAT)", "value": "3a4c976e8e04ed4725f1273033a2063db4a483b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653657342, "uuid": "ddec62c5-4e24-4247-8be0-6caa5169eb9b", "comment": "Malware payload (Gh0stRAT)", "value": "abf7f838afbbaad96427f60ae7f0fc4ebc75f452aaff2a282300da4fb9b217edc7b9635aca196418ef9b54c752ff8b40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653657342, "uuid": "6d0d0bab-5b64-4183-85b0-7a4cc9ab90b4", "value": "T1EBB5BF313690D4FBC9333670864EA3BDA3B8A7712A7156CB56911F383F356A28D1835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653657342, "uuid": "2417ad40-a8a6-4776-a2d8-843e9d512636", "value": "c58ee333e14cac3785c033cb90ee7ef2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653657342, "uuid": "22001ee4-6e35-4e7f-82d8-7381a0d1a8ec", "value": "49152:F1AVtB5+msMSo3cgauSImyFE4dr2ik8VVzYE78xu1nhkAuGbq+j/Oa9KrFfd:QVtB5+myM4uSImgE4dr2ikk8xuthkAun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653657342, "uuid": "28c1e214-d52a-44bd-9efe-51d9d4b48957", "value": 2412032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653657342, "uuid": "a89e1fbc-c495-4f59-9d0e-e7ed2f755c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653657342, "uuid": "850687f9-14bc-44c5-837a-54653e229605", "value": "\u70b9\u200d\u51fb\u5b89\u200d\u88c5\u7eb8\u200d\u98de\u200d\u673a-\u7b80\u200d\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23697428-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653664226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664226, "uuid": "0d034b61-0f75-40f3-a381-99fae1222e39", "comment": "Malware payload (Heodo)", "value": "46bc4d1dfde4e30607ca550dbe67fab0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664226, "uuid": "140cff20-7338-448d-951d-41cfe24f855b", "comment": "Malware payload (Heodo)", "value": "d121e079967d4bc8819e095b0349f5faeb6b4d865db9424abedaee626de62438", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664226, "uuid": "ee3c4832-f146-4811-9191-0ecbfa4eda9a", "comment": "Malware payload (Heodo)", "value": "7ceafef5e39d362f3b298fc859ebfb7982bba436", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664226, "uuid": "4a0efb9d-6b64-48f1-9abd-3c0e1d6e5b63", "comment": "Malware payload (Heodo)", "value": "46944da11668bf925b50f8287ce181980959d5f0bf00a09514830eb9ec19e5c50e57d6de615def31fe5e3bd3117ed6f3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664226, "uuid": "bac9f126-14b7-493d-ad71-5634fb23b94b", "value": "T19994CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664226, "uuid": "f631e6c4-342e-4cc0-bb69-787d5caf82bc", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664226, "uuid": "a1ff5879-7256-4a74-b789-ddff1062a141", "value": "6144:I9wEpo6/4WaPgMIuxqqZAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqZAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664226, "uuid": "9d93f52e-c181-4d63-99b7-99e7b7cae8d0", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664226, "uuid": "11d33d85-f21d-42d8-8bd7-7fba1e5e0077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664226, "uuid": "932b00e2-e827-4b40-9891-0a2184dd9baf", "value": "46bc4d1dfde4e30607ca550dbe67fab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12af6f8f-dddd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653670211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653670211, "uuid": "d6b254e6-85d6-4efa-bfc3-63209b2dc7f7", "comment": "Malware payload (AgentTesla)", "value": "944523351da5539c11f2556797423ca7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653670211, "uuid": "f2cc76cf-749a-4714-940f-ee1418e80921", "comment": "Malware payload (AgentTesla)", "value": "d285dd9606cf62e393b6203a843a9a0392da885f2f427106885bff3ebafef759", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653670211, "uuid": "2c20010b-8518-4575-bc38-ee2b03658ac7", "comment": "Malware payload (AgentTesla)", "value": "729c0a97f2398b6fdf34db8268d20d545ebc8d23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653670211, "uuid": "dc8ac3fd-f106-4661-b37b-20f6cb64c21f", "comment": "Malware payload (AgentTesla)", "value": "17d2a9b1b0263bb10236a887c6d9221b6f68d2db1e961ae00ad38c557352e5f8f102ff332f5e5dc9f4864b5bfb7f1ce6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653670211, "uuid": "8de410f8-6ab4-4a0e-a4c7-ce472d764ca6", "value": "T19305E16EB692AD13C1280BF680D7840423F15647E176E7872FC721C72E0ABE54DDAB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653670211, "uuid": "6cd7c5e5-7cdd-4fcc-9e2c-6e188fdaf5f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653670211, "uuid": "aa93cdd6-8d46-4895-85ad-5b817982a4cd", "value": "12288:BY8mA9rtULz/q7pbH44FQSDtjBt06kqAEy+f8ZJkMm3TZl2cmBtXaqrix:awqzCdb3QU/pyeLMm32cmTxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653670211, "uuid": "fd645bd5-a15a-4cc7-8582-e2f8341293b0", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653670211, "uuid": "f88cb119-a2da-43f0-bf7a-028abf839dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653670211, "uuid": "c3db7178-fa89-4d83-9166-8ccaeab94333", "value": "PAGO 041011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27207bee-dda9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647911, "uuid": "b92a3767-b772-42c8-b991-a3b9f1a39580", "comment": "Malware payload (Mirai)", "value": "1a7dc7e371dd56f9c4d817599a534050", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647911, "uuid": "e58d29e4-d130-49bd-ba68-fa31651530d4", "comment": "Malware payload (Mirai)", "value": "d3063711060e7645b34e5daf91137d8e4f8bac8bd91e3087678383d3e0ff17b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647911, "uuid": "6ae1fb77-6916-4c66-8602-7517e9271540", "comment": "Malware payload (Mirai)", "value": "96f35b9dee1d4a27912c5589da6aa595be15c82e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647911, "uuid": "79516d87-564a-4e9a-aa25-d37090718fa3", "comment": "Malware payload (Mirai)", "value": "fcc646a403f7c96f149f468595208ddd7b09d5f4ad03fde00cde62dd944cf4de79109a6f244842b1c17d5c20b7d5e0f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647911, "uuid": "a871ce22-4cc5-400f-9f8a-f75815485834", "value": "T16F635CC5E801DE3CF95BD67E90130A08B921635456A30F2BE6AAFCD77CB305C9E56D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647911, "uuid": "f71d826d-c513-4335-9ccf-a46154c3d71f", "value": "1536:+HwL/13tMFu+sQdXvQS6Nx8HZa2g8o08hbw:fL/rocCIZ74gDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647911, "uuid": "7305badf-ee15-4058-b02b-0b13d8eb3bcd", "value": 69576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647911, "uuid": "fba509a5-d1f1-49e6-adcf-58a828137555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647911, "uuid": "3638f00b-2972-4c10-ab9a-68496b2d364c", "value": "1a7dc7e371dd56f9c4d817599a534050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae9a55d-dd9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653643918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643918, "uuid": "614d8e82-d2ac-431c-b4d0-283d6836ee8c", "comment": "Malware payload (AgentTesla)", "value": "3e1b36d5b20c016402f090a182b4d2c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643918, "uuid": "4847f8d9-66bc-4c1f-a77e-7f3be4a1ea00", "comment": "Malware payload (AgentTesla)", "value": "d3d85fdfda274a606a262a6e670cb8768d61da6c136239d3eaa3468b0df72d93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643918, "uuid": "d450d06f-80f8-46a5-9ceb-3a92bdb553ed", "comment": "Malware payload (AgentTesla)", "value": "ac10ce1af8184f77cca478cb0452a82e6dd2eceb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653643918, "uuid": "57b14829-7f82-4cc6-a5c6-38e46b6c7c54", "comment": "Malware payload (AgentTesla)", "value": "e58c27f9ba62a24a83a2573a03a3df70a69e21cd2492b13834a4265aae493b2fdaaca689049b36c4b1c109190d45df16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643918, "uuid": "45d219df-8f66-4e0d-b8a3-ca005b46e1fd", "value": "T1F6B42326805B28F73FE126505DC3FE370E26FF0442DDDA9B4115E179F6AA13E6A68A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643918, "uuid": "007776ff-ee6f-427a-9162-c1aa28345b81", "value": "12288:h9THicWrFPBChePC9vdAQ7BGFUvoeO21AosWlLkayNVW:hoxYDldAQ7IFc1LjSfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653643918, "uuid": "6235d21d-348e-44de-98c7-ad3121b4f4a4", "value": 528229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653643918, "uuid": "c2165b43-e742-4a67-aadf-144284396bdc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653643918, "uuid": "0b5b347b-314b-4d07-b9ca-db279bb90990", "value": "Bank slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b3bd6b-dd5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653614703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614703, "uuid": "5c9ea11f-7e70-48e1-b553-6fd698b78b52", "comment": "Malware payload (Heodo)", "value": "cec93596e36fd722dfdbf1f1ebba0979", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614703, "uuid": "8886c10b-4a1a-40e8-8676-3679330a3f87", "comment": "Malware payload (Heodo)", "value": "d3e818d2652a43cefa07e1ba1ec5474578caab00f7e76c313fafa07d61372ada", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614703, "uuid": "ad4e9083-d50e-4ae7-be0c-0744168670fa", "comment": "Malware payload (Heodo)", "value": "806ad8c3466e9afc7e7780aed0da12514a2c92d2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653614703, "uuid": "077a7503-9665-4025-9450-a4b1d0e2a71a", "comment": "Malware payload (Heodo)", "value": "87d528d5f545c7c730d3f8f2dfb7eb5e0fa82a586910d2e110191db253b550211796146becfc251964b9335dd4a7374e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614703, "uuid": "7f135a03-391c-47f7-9d81-d57426b773e2", "value": "T158E49D01F2AC80B2D06FD13989A34A4AE7B13C9497B593CB5251FB3A6F732E15D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614703, "uuid": "ac134785-aa10-48fb-9b19-9d4c10eb5c72", "value": "b7b90674fa6c5f9a16bdab0725f21bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614703, "uuid": "9ad4aecc-862f-41a7-b872-f5d1353f7fc4", "value": "12288:8nUIW4anSDGCH0fu1QJKwube1gUK7wrnUfpE:kUITnGCH+u1QJKeCwrUfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653614703, "uuid": "ca2b1eec-4be9-4104-82bd-e19e8cf5270a", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653614703, "uuid": "ea4ff65b-87ac-4f1c-ba21-f6f787345fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653614703, "uuid": "b4d14b45-ff23-4cfe-bd85-ec7ff8ff67d1", "value": "cec93596e36fd722dfdbf1f1ebba0979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103f1b01-ddd7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1653667630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667630, "uuid": "a79a3e4c-9b0a-4768-b37f-44563d76fb0b", "comment": "Malware payload (Gh0stRAT)", "value": "7f1ae17ccc781ac8459a26f13ef95d91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667630, "uuid": "5669efc0-589b-4d83-b8c0-f3a5326a1832", "comment": "Malware payload (Gh0stRAT)", "value": "d3eea564009b7ebf8461fe6260105dd0a93dc3b817738837674d453ae574fcb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667630, "uuid": "24bd23ee-e6f7-4376-831c-387cdac15c87", "comment": "Malware payload (Gh0stRAT)", "value": "caf8033a2f6a71389e5fa0c0e9194ca05c80c8be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667630, "uuid": "6a944638-d781-4c65-be6c-1a5c1074f2b4", "comment": "Malware payload (Gh0stRAT)", "value": "46d08f9e737d66b8edb7552a1653b0eced5644e79478d410b86b57bad7354a162e1576c37e8b076c738efbf42112797f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667630, "uuid": "65a60a3e-ff89-497f-bbf5-8eb4e8fbccd6", "value": "T159C56B2B72E88035D36221F2E595DA7F5DF971300B358743A1628B3B2D760C1BE1A6DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667630, "uuid": "ad319142-39c7-4dff-8282-a1d2d2ab260a", "value": "2b3566576ae70e10957b23807430d3de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667630, "uuid": "60948822-238b-41c0-ac5a-0e9c528b077b", "value": "49152:cfTx64rfE9ZC1k3G8o4H1r8TAJ2w8tZ7COV0bAM46klcusd9hCMWj7hNCYe+PPJ8:gTXrOZC1X698TAJ2w8tZ7CkAE6kl5sd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653667630, "uuid": "a5429a01-62fb-4332-8882-f9065958e742", "value": 2734080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653667630, "uuid": "75aa1863-cbae-438b-bc63-8bca6def3c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667630, "uuid": "6ebef90f-5546-4624-85b2-343d74b757b7", "value": "\u70b9\u200d\u51fb\u5b89\u200d\u88c5\u7eb8\u200d\u98de\u200d\u673a-\u7b80\u200d\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662a530f-ddc2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653658754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658754, "uuid": "12db40ac-e11a-443a-9816-9e5fd581285a", "comment": "Malware payload", "value": "e85bb68b7cbefadf0d1acd4b7b8bd528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658754, "uuid": "eb3ef80f-44c2-4670-8620-879021fe58bb", "comment": "Malware payload", "value": "d4286a555ef8679cfcb40ade56c210469c749ec48718e84fbfea3b472825518b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658754, "uuid": "055590da-8d1d-4b56-9913-56a958b8f2f4", "comment": "Malware payload", "value": "6260ab4fe9793de221c38e2785ee011178492891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658754, "uuid": "da7cd3e5-7be5-4c58-85a3-155e7c1d5b3f", "comment": "Malware payload", "value": "d589eaa0d4bbe9ede5f63bac0557614074d8020b19118a681cc02f4b2826111be916ad8283d767012fcc2c96a2ea4981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658754, "uuid": "d488fc7f-16dd-4c4d-98fd-509e2c7f0f5a", "value": "T1F2D39D4131D281BFD865967199A88E81869FFE2129398F8B734D143F8C786E0477BF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658754, "uuid": "9b331242-4dbf-4b09-bc22-f927ec9d130e", "value": "568ce418a9b723ee7b6fd7d341d02902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658754, "uuid": "241c7a7d-3d9a-49c8-85b0-6431776df5b6", "value": "1536:RcTOG+x8+YaGDARvmJVBqNvnlajcCOO0LdXU8JiA1Oy9f6zqjzswa+98qSIJnXSe:5fbnR6BqNvncvhwiz2swteq4iG5sCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653658754, "uuid": "9cb08594-582a-4a0c-a1d5-993ff91be21f", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653658754, "uuid": "93436afd-a91d-4a61-ba63-5d5ac0cab3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658754, "uuid": "15e948f8-21fb-450d-8184-0b8ac674265d", "value": "SecuriteInfo.com.Variant.Jaik.73412.5033.9850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105f85df-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662476, "uuid": "c8c36852-fa3a-4293-afca-aa663fa95ce6", "comment": "Malware payload (SnakeKeylogger)", "value": "d9153a1e8861bd26d5aa125037a7afe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662476, "uuid": "d8293829-47d1-41cd-8006-874fb5d3a382", "comment": "Malware payload (SnakeKeylogger)", "value": "d44db4b3638e4be3e3766034e712993bc79d0e13d7ff6c17e29089368910ee3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662476, "uuid": "90f24100-77cd-41d1-82b4-a4332382bdc1", "comment": "Malware payload (SnakeKeylogger)", "value": "170510baab5700fcf2d6e4ccd84893387fcd6378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662476, "uuid": "29f871d9-3091-43c2-b4ee-07169c32126e", "comment": "Malware payload (SnakeKeylogger)", "value": "ae42f5fb6d00bd2d35fb03db75802d6b0c1591dc5d3f386f2e6e9bb4a493f80cc418fdef91cbc812dc4de1fc6bbe3992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662476, "uuid": "4cabce62-b333-48b9-b3bc-a07e7324f9d0", "value": "T162A4BF313B6C6903D2FADB7951A0C04405F19A8E7E63E51A3EB318DF25E1B819771B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662476, "uuid": "779a3d15-7c92-4390-a705-914137842a11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662476, "uuid": "6cd3e2a5-3f3f-471e-b6eb-40b30963067e", "value": "6144:tmFFYdESKto2WK3O/3XEh0t1TyD8yPDU7Hz/Hwm9OKsPugIQ9SUnmyB1eti4:t2FNq30it1T6Uvvwos59S+myzgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662476, "uuid": "58fae1a0-ee5d-4efb-b055-341955fd303d", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662476, "uuid": "73e7c3bf-3ae7-4c9e-98e8-0ba291aad72d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662476, "uuid": "b0db38da-2601-4d76-b951-69a8ac304fb4", "value": "Financial Year 21-22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986961c5-dde0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653671724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653671724, "uuid": "38a42eab-3fac-45b9-82cf-deaf8c0f5b5e", "comment": "Malware payload (Amadey)", "value": "a045c181979dc27891f83b8f949b2c61", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653671724, "uuid": "400f1d8f-5c0f-4d54-ad3e-6e96ecc8367f", "comment": "Malware payload (Amadey)", "value": "d580564f940ba230f8028972bed4aa32bd8ef647d31e0911747be5889636623e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653671724, "uuid": "c1519683-5a0b-427e-9a14-2696afab450a", "comment": "Malware payload (Amadey)", "value": "553c1d16ec59061e3a7f156c9050be96095e030c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653671724, "uuid": "ccc90ce2-aa7c-45d3-be6c-f95729382746", "comment": "Malware payload (Amadey)", "value": "624b9ba5082a9eec8f21f0f4484f98e489715ba74b1aeba919c2069775ee73ae4a9de8c49afd534f1cb93202f2f69c0b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653671724, "uuid": "8fe5a5ed-df7e-4026-9935-b1e8552dd88a", "value": "T110D533ECA327C5BEE75E513859AC7C0332A2223E50076D0746B29CE921D47D6ED90FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653671724, "uuid": "e9ca63e3-f023-4d45-8b7a-f1a43460e948", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653671724, "uuid": "3a71655f-fd4e-4a18-849a-fbfe56132201", "value": "49152:VuISQ62drydwvyKczDHa7v/NRm6PsH/um2Ib7uwZR0Ov2px9BO:Vfin6RjwLn0/v9BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653671724, "uuid": "8526addb-34e8-44c1-bd20-056e1f2c85cd", "value": 2819584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653671724, "uuid": "ee45f25b-8ceb-4fb9-8a0e-fc5e95bc86e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653671724, "uuid": "a212cb4b-b8ef-4e0b-96c8-a2cf2ab4856e", "value": "a045c181979dc27891f83b8f949b2c61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23299a87-dd91-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653637597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637597, "uuid": "25a73d25-779d-495d-85b4-7f327091565d", "comment": "Malware payload (AgentTesla)", "value": "6cb365de850ccb5ff6eaf404387033ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637597, "uuid": "4de96100-ccd1-46ea-be4f-b5599912ce86", "comment": "Malware payload (AgentTesla)", "value": "d63075745cefc22886781dc42d85399e7474fa3a3d06a98a7624c58457cbf8f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637597, "uuid": "faafe864-b61b-4754-bc66-df3c15faa151", "comment": "Malware payload (AgentTesla)", "value": "81e08a27c304e969ec65d252426a72f910fe67c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653637597, "uuid": "5f317f82-2681-4fd3-babc-ae8422aed333", "comment": "Malware payload (AgentTesla)", "value": "6d6370aaa90b00c6dc4af6471474deea056cb88c4ba8cc7c935e2fc400d5b0622fdc9ec7d4f307df2e2d49016e8911bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637597, "uuid": "5e0328d1-d709-4f95-9178-6b86135b8f42", "value": "T10C05E098369071DFC5A7CD36CDA81C10BA31B5AB970BD60BA057216DAD0EADBCF105F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637597, "uuid": "a9b760f8-19a7-4b06-9473-4a579acd66a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637597, "uuid": "8d7e60ec-3b0d-4cb3-90c9-a6048c35e8a5", "value": "12288:kp0oTGdKU4ZbHoXkcJxaPBMrxR8ZQe5U/mvC30PrOfM3amh0RfSJK7ouCdxquKK:YtygdZbHoXL+iR8ZQCcGraM0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653637597, "uuid": "f79c6701-2608-4cea-995f-1258f6443fc1", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653637597, "uuid": "f05ba02f-2c44-462b-88b3-858f3ec09b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653637597, "uuid": "f4b9b069-6c53-4396-81b4-22c95bc59ca0", "value": "TRANSFER\u00caNCIA BANC\u00c1RIA 1517796961.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a155cff-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662653, "uuid": "619645d8-ee13-4ae7-b2f2-a5c0f2c8fc84", "comment": "Malware payload (SnakeKeylogger)", "value": "cc9a939c9ca01df3df24241f3d68091d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662653, "uuid": "7435bab7-4b05-4e39-b7d8-890508a29771", "comment": "Malware payload (SnakeKeylogger)", "value": "d65e148619e7370e495374722eca15b73817ed71e9917398c090098468fab533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662653, "uuid": "b5d0f613-5808-45f7-a98d-a924cfb32713", "comment": "Malware payload (SnakeKeylogger)", "value": "9d1b3631e2f77a3ff7da24738ecf2732f910e7fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662653, "uuid": "1be22b9a-e48f-494e-bacd-6d771192e664", "comment": "Malware payload (SnakeKeylogger)", "value": "687e9fd467d25e5555b0fd8efaadedd9fbac7faa76185f743f85aeba2aa0367958df6a1989f9e9e88dbe0fbdf5152381", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662653, "uuid": "ef2e4038-ba0f-4210-9d14-055d706369d1", "value": "T17704EF49D118A80DDB7041FDBBB58B264CDAEC44A97C1AC26760358B353EFEDEC8D50A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662653, "uuid": "3d47310e-b3f9-482e-8ad5-af06aecf8aca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662653, "uuid": "b0a56f8d-bdee-4569-bab9-d1bb3378718a", "value": "384:W6V8q9WBKMWs6h4PS3bhMiC8yP0X7w3bkrEjd9tWZ+BqlHVfiugWAMDIcWKuKbW:NVb4KVmYyPy7w3bTqlHRiugWrDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662653, "uuid": "c7138934-690b-4ab4-8772-61d2d48f4b84", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662653, "uuid": "e7b78228-e1f0-4df3-8f33-a90fdf374fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662653, "uuid": "008c4bf0-d647-4d54-8515-6411a2eea650", "value": "Vessel Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37789a2-ddfb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653683392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653683392, "uuid": "31c5957b-f71b-4915-93d4-bf9f9cb897ff", "comment": "Malware payload", "value": "e172a5845263fa59bc6941e427c507de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653683392, "uuid": "8cbf6c2b-b28c-4cf1-8bed-c2dacd6d12f6", "comment": "Malware payload", "value": "d74850047c094addeb1fa289d47cbc072742f342200e6eb84099b8f5bfc98796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653683392, "uuid": "20eabb09-f7c2-4ad1-b2c4-79807ebbf0f7", "comment": "Malware payload", "value": "f6c059d58b4a5dbfca6af9689ce53e5b350d9c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653683392, "uuid": "f6eeb3a0-6910-4e4a-8d42-dbb2c49da4aa", "comment": "Malware payload", "value": "894683937107ce4924d7c3a8bb01360f2155e9a4aee9dc1c2806987e0952d5d2f7ef6b6c55ec14ec558fe5d4e9d68de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653683392, "uuid": "a8006540-330a-4006-bf1e-9d645e3128fe", "value": "T13B05E06CB2576E13C1284BBAC1CB951403F6684BA132E6D72FCA71D32A027D58DDA7C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653683392, "uuid": "7764531f-2062-4dae-936a-b95e6b441526", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653683392, "uuid": "bb1f72b5-6297-40e7-8724-edbd6009102b", "value": "12288:ct+hbJQF0EcbVlZ+uBluWPLf/gXUoLOymFLae2v2DF5o0dv6Y1:N0wz9BwWzQEokf2v2nd0Y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653683392, "uuid": "e537f182-e5a3-428a-91cb-bee45dfa5569", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653683392, "uuid": "16978eb0-3f0c-415c-af72-497d577ffacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653683392, "uuid": "09158d7c-c0bf-4bd5-a33c-a22a7fd5aaad", "value": "SecuriteInfo.com.Heur.MSIL.Bladabindi.1.15596.1464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3695b8-dd8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653635141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635141, "uuid": "75dde211-0b77-4ccb-a30b-7e03c1f868c4", "comment": "Malware payload (AgentTesla)", "value": "82b9add118c8e35b8e8ed5e5416b04a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635141, "uuid": "3820649b-dbdd-4fee-ae23-e1882c9a93ce", "comment": "Malware payload (AgentTesla)", "value": "d771c9a2281f020dc96e9d38f050987a4c607790388017b8d1bf560851541e1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635141, "uuid": "1709fa69-bab5-4e23-8125-e616fac22c01", "comment": "Malware payload (AgentTesla)", "value": "6b5aa13301b5ff317133d918cfb06b9108272772", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635141, "uuid": "2aa3cc7d-5844-46ee-9b1c-81af63204855", "comment": "Malware payload (AgentTesla)", "value": "667583c58fec651923798c15228d9a17d1dbfa29a3b7b7829e1a04f911d2f233a3751ed6ee7e273e70141767b83e411b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635141, "uuid": "1e1677f0-2488-4dc4-8704-89a221a8db20", "value": "T156244ED3C6C44290ED696B75643B4C3A066BFFBABDB4E55D989CB0312FB32D20026947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635141, "uuid": "b1a28357-1289-4c1b-bbf2-e17ea2cafb21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635141, "uuid": "f5971bfc-c549-47f6-baff-c32f5d2f5bf9", "value": "1536:dt63FsYAVF0lXohLgtCrczaSaOiYxu+7JsacijoUXlYw0jBb0qAxk+i/t/U4D1M0:doVs9VFCULgpasuFeYKq6G/nQIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653635141, "uuid": "0438a50b-d0b0-4c03-8fe7-4de632919c57", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653635141, "uuid": "88902839-32dc-4e5d-adfa-d8812ac42579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635141, "uuid": "f6790c61-1495-4bc2-acc8-f7cdc18cd5de", "value": "82b9add118c8e35b8e8ed5e5416b04a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc064569-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1653664965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664965, "uuid": "c32d902e-0902-46d0-a7c6-59f3ab51c8a5", "comment": "Malware payload (AsyncRAT)", "value": "995a13a7511b79dfd66a29e4dc7054b4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664965, "uuid": "abc95ad1-307c-42d3-b850-3d8d0ef8d1ae", "comment": "Malware payload (AsyncRAT)", "value": "d797f04305b70b5e4128b091cacea12b22b0c7b523ef2a14c9ab5231fe492ba8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664965, "uuid": "4cc01388-6bfb-4466-a7cd-e276af03a9d5", "comment": "Malware payload (AsyncRAT)", "value": "9a87f5274034fbe20926ea710704d2bfc069014a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664965, "uuid": "5fdee443-a23c-4b02-a7d0-95be716640de", "comment": "Malware payload (AsyncRAT)", "value": "79079c175372529d7f1b478bebfd0a0c069f61960f957e77c95cbcb8d0d19ebe3e6428224abfdfed407c8cee52c18307", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664965, "uuid": "96c917a5-e14f-4b3d-bfe4-a123a69bbee5", "value": "T196E4AE983A80719ECDA78932C9783C10A6216D6757C7C20BA857319C9F3F69FFE115B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664965, "uuid": "ea6dd441-37ee-41ab-9041-6505526462f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664965, "uuid": "e398af92-4f72-4088-9436-659069728a0a", "value": "12288:RpLyo+HVTZbHoKUfc+m0dePM6xIMb4YPS+br+a5cEjxk5YBg9zKyyPBNWVJF3:HLyoIRZbHoxUp5IMb4b6+a5AF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664965, "uuid": "9dc92b5b-c92e-4671-bb3f-cb061c6d5dff", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664965, "uuid": "51ea494d-15c2-4107-ac03-fbfdecf31550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664965, "uuid": "6bb08c14-50f1-4420-8202-12dd99c65109", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d90915-ddaa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653648308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648308, "uuid": "cf05d801-573b-4d11-9a9d-188295b92024", "comment": "Malware payload (Loki)", "value": "606484b470b191f4c2e5002225ee2e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648308, "uuid": "28f44013-69a8-41fd-8823-66f35bd5e43b", "comment": "Malware payload (Loki)", "value": "d7a88d2806270f681ee98030de00c8bed6d96826d2a7ba927669482096be25fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648308, "uuid": "0c71608c-3a53-4627-92a8-4ca13133d606", "comment": "Malware payload (Loki)", "value": "c80e255be40e29f7dc7e4bcfc569e396c7d8322a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648308, "uuid": "df5d5c92-77c9-4b7a-968d-d8e3fae7c515", "comment": "Malware payload (Loki)", "value": "bb34348d844c596c658d4cf11c274811d464ed0a2faf5c2533bf57c9e56d1b4ef6659daa2ef68c75f613d3916d8c380f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648308, "uuid": "0d72b3da-6e83-4569-8527-40af5a43754d", "value": "T12FD4126835EC0725E7FF0B792075111417B6B74BA223DB0E6E8970D96CC3BC58A12F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648308, "uuid": "7fbd9da5-1398-48de-8f4d-6ddd9d062a3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648308, "uuid": "8f110daa-50ad-4ff7-b90c-4a0579eeb9fd", "value": "12288:CMkcDZfPePZbHoXE9DAHBGsPS5n0rfe95+QoY4P4dG7xrXqW3pW:CMkcDtgZbHoDHsqS50jeTE4dgpqW3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653648308, "uuid": "4e662b09-f372-4b31-8af6-da244aae0c22", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653648308, "uuid": "50b4d5c3-1612-4e19-96f6-559859e3bbd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648308, "uuid": "b7e17588-086f-439e-89ae-04d8f6e998a8", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0012b484-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653665026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665026, "uuid": "c19e3cb2-ba55-4d54-b979-453f93f1e4a6", "comment": "Malware payload (AgentTesla)", "value": "3aadebe9b94245452d74c655b2f04c0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665026, "uuid": "0f231916-de00-420e-b0c1-8e6a1dabd096", "comment": "Malware payload (AgentTesla)", "value": "d9005fbd977fd39146b129fb7e391765242be7857ba9dd921dc59339ce90d06d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665026, "uuid": "b9e15c5c-c57e-4e45-b746-dbb8ac784433", "comment": "Malware payload (AgentTesla)", "value": "794dc763ca693288850d9a8ab73848d8146e19a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665026, "uuid": "237b8232-adae-4e44-a98a-d31c4ca9150a", "comment": "Malware payload (AgentTesla)", "value": "ca7373a89ac04190f18d52009605aa578acb84d091f52e65fd7820e09692b487433ead1625f3e972101079c9a0fc9ddf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665026, "uuid": "b4886e9a-d665-4953-b5e1-9dc1c84c1b73", "value": "T13CF4F110B1F80F22E6BA57FD6570518407B67DA96520E38E1CD17CDB36B1F918A82F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665026, "uuid": "41c4b5f3-b751-4a0f-9475-fccfb2b96f03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665026, "uuid": "f8dc2aef-7118-4b8a-ad7a-82fc478f1a00", "value": "12288:ui782P9bHoAUgvqVBgbAj/ExhYs6sQ9szP+x1gGvZZtKIMolhR8rf7oHUdvp8+Ki:ht1bHoHgbAj/Exhb6v9szM11vZZ0IM6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665026, "uuid": "621886e2-4134-4199-8dae-5983d6d55a02", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665026, "uuid": "871bfe1e-e916-4c03-b9bf-c1bf9710c312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665026, "uuid": "d2137ce6-a457-47fe-8981-8d550eaf66e8", "value": "DHL - OVERDUE ACCOUNT - 130115482244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5513c0-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653665021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665021, "uuid": "eb84569c-4b9d-42a8-ae81-11f5d3559f81", "comment": "Malware payload (AgentTesla)", "value": "420273f8012dc23eff9195fa55f878d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665021, "uuid": "ceec87a8-832d-449a-ac2c-5b9509fd8373", "comment": "Malware payload (AgentTesla)", "value": "da1c892564b950627b9643b9bacb000a6b79f500a75faef4f76c81b974319c83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665021, "uuid": "f5260863-eb0e-4d4c-887a-75e0864e357f", "comment": "Malware payload (AgentTesla)", "value": "3927ab6547e261c3f12592210bad348a8a0e0d95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665021, "uuid": "3c6481bb-f880-49c1-8e64-b97b61f82bfa", "comment": "Malware payload (AgentTesla)", "value": "280a99a824f09912e041f3721fccf13e464a6197de88f72b1f6a1625c28735845f1c23348cbc028c28921b2becbc6952", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665021, "uuid": "33bfbb41-1b52-4372-a889-82e9083e155e", "value": "T182F4F104B2F84B22F67A53FE9574518007B6BD596920E34E1CC278DB3A72F528E85F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665021, "uuid": "7604ee5f-c09d-4c73-a6e0-a7d144379d36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665021, "uuid": "25d4fe07-7f67-4d16-8217-8a706381d37d", "value": "12288:5C8F2j9bHoAUzvqVb0eeDr4ctdzV0iyWuQ3k27axxrz7lmpEsqXs6St:w8shbHoSeD0ctJV/ZR3vOxxraqXs6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665021, "uuid": "4fa4ad34-bb82-4cc4-ae3c-8a3e143e6164", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665021, "uuid": "4f127cb2-7c19-4029-9ae6-079906b4cebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665021, "uuid": "d0b700cd-c777-4465-b188-079a461f70bc", "value": "DHL - OVERDUE ACCOUNT - 1301154822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bda2d0c-dda3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653645369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645369, "uuid": "7c385786-5f2c-4074-9d93-9d17afb18b4e", "comment": "Malware payload", "value": "f8a40821b8f4970438f2b06195bc9860", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645369, "uuid": "e27ce8d7-91e9-4425-a078-e328b17eae38", "comment": "Malware payload", "value": "dbf3f31b178e2ee0b41cde323391baf12ea524abc36e9d39461aa677294c0a65", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645369, "uuid": "7db4a7cd-558a-4e85-9f02-032f36d502f5", "comment": "Malware payload", "value": "86744e87a4010833c29fed5b754b0563912b230e", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653645369, "uuid": "c427b94a-0718-4dff-9fa5-eda650dba38a", "comment": "Malware payload", "value": "c8c68dd85398f19ddb8a705d565f68332c632c08eb02ba4c3a4c68a3a6c3d5adda3162997b7428b4de11246a4845be1c", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645369, "uuid": "bc1515c0-a5d3-4888-95e5-4f6fa6ef050e", "value": "T15C45E3E505844B32E2A4CB7D1B315157B36F47D43127F381BA9A39E58E81E058ACFBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645369, "uuid": "7196f8f6-325e-49d5-8767-5ac247ae4393", "value": "768:xteQeQeQeQeQeQeQexeQeQeQeQeQeQeQeUeQeQeQeQeQeQeQe:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653645369, "uuid": "88764b51-ce35-4566-ad56-0b50aac2aea0", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653645369, "uuid": "e2a96b0f-5c0c-4199-be1b-8932474ae409", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653645369, "uuid": "37cff25b-3831-42c7-89d9-3a50e1beeb21", "value": "009NUEVA+ORDEN+DE+COMPRA+80107.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551c38ef-dd9b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653641975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641975, "uuid": "c1c59430-b998-4bd1-be85-6b70645b2cab", "comment": "Malware payload (Formbook)", "value": "976a815660086ec01d659eb30ad53288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641975, "uuid": "61130be6-bdc8-4a50-8a76-97cd0b223657", "comment": "Malware payload (Formbook)", "value": "dd60e55c229563801df128c29f52b21bc1cf22625c8b4b9442b2d7839c9175a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641975, "uuid": "1b02961e-d411-49b5-9db9-a46e906528af", "comment": "Malware payload (Formbook)", "value": "cf7fad3596ddac9e7becc7da2726a08aae29b383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641975, "uuid": "b0be563c-eceb-4ef7-ba12-2300422c0b21", "comment": "Malware payload (Formbook)", "value": "040ffe3937ed8a5d21aeabfdd7d2bf2ff4d961f76e26ca47f6bb37ebfe5394e57c006b57ace76b524787f82a81f53fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641975, "uuid": "036a4d58-3f74-4274-ba7a-215632ee470f", "value": "T107F4F110B2F81B12E2B6ABF955B451C00BB6BC996520E34D1CC27CDB3A71F558E86F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641975, "uuid": "58a29429-b2e7-4541-8dda-6db31668ff29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641975, "uuid": "b3616041-d1a6-419a-a385-2a69722cef5e", "value": "12288:K4652I9bHoAUdvqVp5kRrUYAtKpIcI5Zq/xqRWqHH4sI1kT1RQ0HbAoZclN0iQ:B6YcbHoiihCKpJKq/xsWuFI1k3zHbIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653641975, "uuid": "f13c18fe-6697-4385-92f9-6059c06c00ee", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653641975, "uuid": "b9dc80da-6f47-4ce1-9111-ce47603b8d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641975, "uuid": "61a501cf-cfd2-4510-b0a3-e3fcb542df9a", "value": "Payment Receipt_0095759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4538c408-ddcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653663424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663424, "uuid": "47199043-de12-44ed-b411-a216a21ed50c", "comment": "Malware payload (SnakeKeylogger)", "value": "db4b015f56342704e8b88ba5ac753116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663424, "uuid": "2355b875-4b34-4e43-8e56-a5d884b30ad5", "comment": "Malware payload (SnakeKeylogger)", "value": "dd8397817060d60b60429fc0351e01ea17cb7fdcd363c53b4fc038bb445397dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663424, "uuid": "8ecad35a-a9dd-46d5-9489-f11135c8acd5", "comment": "Malware payload (SnakeKeylogger)", "value": "18f0574d6bfdbf68149bfb222d6132cb4c35198a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663424, "uuid": "a47cc20d-676d-4ac5-9c4f-a0085e3e3f25", "comment": "Malware payload (SnakeKeylogger)", "value": "aceb5acf19bf0dc76791cab935108a6689a5f5d6ea02390f2cf8e6cc21b7a128dbfc3d5438fe8090a3e4151783c2ee3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663424, "uuid": "d9930908-7497-4cda-9328-f9b1928609b9", "value": "T1EBC4A010160ED515F299F6F2406381F46BB93C0F7D62D89E3AAA385B01697C3AF13B6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663424, "uuid": "68e82348-c2af-412a-815b-94061203d90a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663424, "uuid": "1bcd91d0-8db5-4eaa-863c-27d684219a15", "value": "12288:hYctO0EgMp0jPqHSzdlAFIuzVoVzIu7D08cUr:h5t3E6jPqyzdlAFIuzVoiL8cUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663424, "uuid": "0d020aaf-e4d4-4c61-868d-33c1f80ca984", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663424, "uuid": "321727a7-a16a-4984-8959-40580be47f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663424, "uuid": "03912383-77b3-4e2f-aeb7-ce94beaf032b", "value": "FINAL DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8cdb44-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664810, "uuid": "d7d26c4b-3936-4e3c-ba47-30f50d786568", "comment": "Malware payload", "value": "522eeaaf79ccf9f594d04678bf110450", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664810, "uuid": "1c49b8b8-b471-4d2a-bd49-97fcb2da4724", "comment": "Malware payload", "value": "de24acc58eb3600772729db5a852b59c353b835fa81c4e8c65a0ec49ab47f626", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664810, "uuid": "579b6775-92a1-44ba-a01f-62b56ba3567d", "comment": "Malware payload", "value": "b837b0f1df7dc3faf554dbf40a8a6cad8ba6ed01", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664810, "uuid": "4421cb5f-7a1d-4b77-9393-5c6e41e63e6a", "comment": "Malware payload", "value": "b60f80c7a82feabd49a5a8639664fbeb5163a4a810d226a0ca926790ec844c5cde50278a41db4089f706cbb2ccb25a8f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664810, "uuid": "2781b5d4-b182-4144-b214-8dff657d5601", "value": "T122A3C58EBA6E46D0A57E40B3B06AB449F63092C40EE74CFE712BE89743B3C1A5DDD154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664810, "uuid": "02396065-88dc-4bfe-9ce8-1a54bebc0777", "value": "3072:8xlv2kadk1H63DLvOfijHKcm5LwKTM9ktrAAq:8sk1EDLvOfizKTL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664810, "uuid": "a968ab46-489e-479b-8c6a-fe8f32a68cb4", "value": 105377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664810, "uuid": "8156202b-4a70-4a42-be18-04c4518b25dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664810, "uuid": "31f89614-34ff-4f1f-a78d-9894b0d8d563", "value": "PO-RT222641(pdf).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5463b84-ddce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664095, "uuid": "e993d88f-842e-4089-ada5-55b2fcfd2966", "comment": "Malware payload", "value": "c5e0cbf924c2d4275069b62b84af4c75", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664095, "uuid": "6c0ffdea-c818-4f34-8735-84445fe228c1", "comment": "Malware payload", "value": "de480cc38d5f38631f57cc6215a4df5b5121a5f8697ee4bd58324236aff894f3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664095, "uuid": "558bd84b-5deb-4196-877b-b316d86d6173", "comment": "Malware payload", "value": "c88596168011bd876dd8d19f19d4dcaeaba77df8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664095, "uuid": "186a65ee-6168-4acf-bca0-37a6d1079bf7", "comment": "Malware payload", "value": "8c59701976c8f100c7a138b7052a0bca5fa29de7462403d16a28360a8139d8515cfc248f755cd4a8d5d87195d9c85f21", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664095, "uuid": "9650c9c5-4fb9-431a-890d-20381040ee64", "value": "T108F57D1BB284653ED0AF0A3A8537D358993BBA7166228C9B17F0084CCF365506BBF757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664095, "uuid": "1d9c022a-393e-4f52-9d92-d12fd6e28f5c", "value": "49152:oTvOYpXaLDg0bVoNSdJQWzypkCC60EL7JTyL+1KE1VtJA:MOYtuDgpl0EL7ljtJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664095, "uuid": "b2dd861d-67db-48ae-b364-6fd8a6bdca2e", "value": 3503104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664095, "uuid": "deff95cd-88e3-42fe-962e-ae023c504ffe", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664095, "uuid": "09e6b90b-aeb9-44d0-96ff-c7a8d07d14b4", "value": "FactnopagoEndesadigital.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83446d57-ddd5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653666964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666964, "uuid": "670bee88-65a4-47b0-81b7-808f84057918", "comment": "Malware payload (AveMariaRAT)", "value": "c010435f73b8e02b5fef5a14b9435806", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666964, "uuid": "97ae9229-beb4-4946-b9cd-42a2cdf63c3f", "comment": "Malware payload (AveMariaRAT)", "value": "dea5e99ef0a084f2e90ccef0663d5b93d738b6ba1f7f1c2070d57ed36c693070", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666964, "uuid": "a88cd01e-ffe9-4b49-b984-fb9c3f29db7a", "comment": "Malware payload (AveMariaRAT)", "value": "ed994e8731c1b66858e2a1808d05f86d94da2c38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653666964, "uuid": "1b4cc61a-a587-4827-bf5b-1a58b522371d", "comment": "Malware payload (AveMariaRAT)", "value": "ccaf8d15e9b66fb7406092fa23b5b662e0f2dbb3badfbd06136e1ca4bde8a82a93a5844623abd30d9441834677ce437d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666964, "uuid": "6362de7b-0ecd-496a-91ef-ae051ad1c680", "value": "T1F164C01176A0C831E4532E308466C7B8677BB83266746907F790AB7F2E733C1A6B5727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666964, "uuid": "d8084cbc-e0fc-47a8-a5fa-9d4added08bc", "value": "027c20825b6d7c7c9f75e8ef91b29677", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666964, "uuid": "051aef4b-3a0b-44a5-8559-884e51b29f0a", "value": "6144:RljGNKIanc75OyNcEE7g0tFfZmigavwVf:RlHcOyNcEEBX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653666964, "uuid": "fddab6f9-81f7-41b1-af92-9c155378225e", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653666964, "uuid": "561b0042-fbb0-4f2e-ba2d-61b7e6233211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653666964, "uuid": "9b74ba67-55b3-48bf-84e4-6f2f745e5e82", "value": "c010435f73b8e02b5fef5a14b9435806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228e1673-ddcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653662506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662506, "uuid": "7b0c871b-8f87-4646-911c-4609b32ad7ff", "comment": "Malware payload (SnakeKeylogger)", "value": "64b8f7888f18658aa49d3e90a193a5c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662506, "uuid": "3557edc4-0a62-4868-a4a9-2d7878a0cfd2", "comment": "Malware payload (SnakeKeylogger)", "value": "df7f8ca3eafd89a67bbd3842748f6f974eb043568a84984866c921eb5acf3923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662506, "uuid": "29e42d1f-2d3d-4acb-8245-edd7ad347765", "comment": "Malware payload (SnakeKeylogger)", "value": "16e1d05718c20b9f8cb57244d8478a2cb667c58c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653662506, "uuid": "b260e91f-94f1-4928-9fda-55eea98eb8b6", "comment": "Malware payload (SnakeKeylogger)", "value": "c62e3b4848c985a4fea55596a2cf35c66100b1c8a30f159137b8192513892bc43b324c395c0db5a9d4f736af7af04dfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662506, "uuid": "e8a5a0f8-ce21-4c8f-9b50-0e75a2fddb02", "value": "T156C4F10CF7A6AAD9E01D03BF3174681A3F629B67E5AED96CA5A130575C74383014BCCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662506, "uuid": "98eedffd-bffd-4e9b-bc3a-35b14c60ee85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662506, "uuid": "ee67cfbe-5af3-4181-8ba8-3d6ba8b4be64", "value": "12288:MTfbHo6UfJ4IKl6UZvSbWMzpyh9zG2MDK5YgrMH5rAq7N:MTfbHohsl6uv7Mzpyh9G2YVrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653662506, "uuid": "5932e9b3-a2bb-497e-bfd8-61f9a766a451", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653662506, "uuid": "42ee34db-5573-4e7b-8f24-93d69a462a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653662506, "uuid": "7399beb1-3e74-4db1-8e6c-1f19080a438b", "value": "orderSPP13SPP15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420d6679-ddae-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1653650104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650104, "uuid": "23030c7f-29ec-4411-820f-193a908387b7", "comment": "Malware payload (GuLoader)", "value": "4680729edca682d1b6de8cf875bbfdf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650104, "uuid": "6adc57a3-bf6f-4ce3-af56-af75db9ef5e5", "comment": "Malware payload (GuLoader)", "value": "e18032a74c8138c907ab2b6937ce66a4483a85e89b05a25153499efee4e85898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650104, "uuid": "fc489424-42b9-4b9e-9ae2-133fa1ecb6a9", "comment": "Malware payload (GuLoader)", "value": "debf5126050330ecbfc29582d979101cd557dd42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650104, "uuid": "a4cf1681-621e-4394-b36c-9c8b1643d8a2", "comment": "Malware payload (GuLoader)", "value": "6c8cddcbaa525b30bf878d13bb799b55029e4d59f68cc0e4f83108ca50e2729b464561b53acba516b1145de0e7adfe62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650104, "uuid": "68f8de61-4803-4970-8648-1145605e3611", "value": "T14FD4F154BAC8ECABD01691785476AF656AD3EE1218358903173E3E2FF772193343B81E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650104, "uuid": "59ca0c5f-7272-4e7a-94e7-506c73b0ccb7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650104, "uuid": "a62437e5-75c8-4f7c-a9ae-0cfd50f2e914", "value": "12288:5bspFskmgHwg9jXbgO1xzSs9IKTQWfsmuYUD:5bsLskmZc0k9IKTQWkmuZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653650104, "uuid": "c315a669-9aea-405a-b46d-6120e5526745", "value": 606778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653650104, "uuid": "2cb11d40-b381-42ff-af36-24fb42726c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650104, "uuid": "b04fff48-0526-481b-81bb-75ad9e99cfcd", "value": "recibo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835e5808-ddaa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653648495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648495, "uuid": "da827119-e9f3-4b15-9853-5ccbf764bf8b", "comment": "Malware payload", "value": "d4d651ccebc798213c748e4f094b0854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648495, "uuid": "3be94d1f-4eee-4763-b910-52e38b8ec7b4", "comment": "Malware payload", "value": "e2f406a64288fc869e73312835ddeaab6b70ceb8d02661eff96a7a98dc5f261a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648495, "uuid": "9137df68-4c44-480f-9874-40e16831cfad", "comment": "Malware payload", "value": "46a7ad48ace92bdf575c6ced4919b7c0121bb0b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653648495, "uuid": "a8063c3f-f086-4024-b96e-4f6f5bb51a20", "comment": "Malware payload", "value": "fc721aee700079051dd61a672b71791707444b7ac43e5c92a661c2877f91c2413dacb0719301f1f42518ed5f6d8d037e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648495, "uuid": "d19adcee-07f9-445c-a55b-82fbbe5a788c", "value": "T120163381BE3E7965C0A3DF356B3C0C88D931240BA2C5B9D7C565FDEA6AD846B0B25CD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648495, "uuid": "69efe0de-82a1-4f86-9ab1-a47e1300714c", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648495, "uuid": "491a1f4d-bdb1-4516-afee-03ceadeec5b2", "value": "98304:tCwfnDyo3WCSN1w8nSJwRTUGVsyIfkqoLmbsh84spdCNj:th/uoWJN1dSJOYGVsyLqosaspdCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653648495, "uuid": "667036f9-df69-4bf6-be6d-9a5993b3889e", "value": 4222464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653648495, "uuid": "7dff0152-8298-46b5-b234-5a61242c3f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653648495, "uuid": "bfed77eb-58c1-474f-bd90-ae78f6eedefe", "value": "d4d651ccebc798213c748e4f094b0854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346bb2fd-dddb-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1653669408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669408, "uuid": "c8d3ee1b-db11-49f2-a650-275daa999c6d", "comment": "Malware payload (BumbleBee)", "value": "24dec0a814f3d8af4de0cedcbcc4bcd3", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669408, "uuid": "9f653740-41ee-435b-aa09-52f1913a39c3", "comment": "Malware payload (BumbleBee)", "value": "e31d2240282b5657abe10bd2dcdf723f027f889abaef4458f259d6182d03d51d", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669408, "uuid": "abfd511e-e867-4482-90c7-623301f9eeeb", "comment": "Malware payload (BumbleBee)", "value": "9b3a7744215d888b62018b73760ea3e195b4a5d8", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669408, "uuid": "62ec2062-bf5c-43ab-8317-71bb7a28677d", "comment": "Malware payload (BumbleBee)", "value": "8637084ce4d3c6e5b0b5a75389186cc6f42dcba61a0ae11e6cac0377f324627eaa3b5e0c12f4c568e913d216dfd496bd", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669408, "uuid": "c079a7c4-6a89-4f5f-bf71-85b337931e00", "value": "T10255C0519998C566C2AB633EF1F70835837150C5C2EC6D4FA7926ECC2EDB700B62E69C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669408, "uuid": "e70b3c25-502d-420a-b9ef-2f4e03b46556", "value": "d59a180a746b7225ac2d791313d2c0b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669408, "uuid": "8abe5fb2-6017-4397-88ea-54541e5a2e22", "value": "24576:F4UxBZc0V8kStaqkABXXVJ6LmYzuujWX58Q+wRmA09:FxxTSLkuXXVJ2mkuujcnyA09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669408, "uuid": "db1d127b-aaa7-4f1a-8e0b-09cef4dd54b6", "value": 1378816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669408, "uuid": "32812853-f6bb-4b91-8a48-ed76dbf4cbd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669408, "uuid": "041cc2e4-b7e3-4766-9fcb-1112926e3f21", "value": "document.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d26a7b8-ddc2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653658766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658766, "uuid": "75e7e724-d3f1-4662-835b-9c8efbedaa34", "comment": "Malware payload (Loki)", "value": "449b5dd48dbf424c2390e414eff4b144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658766, "uuid": "2defec9b-a69e-42db-ae6b-c1e8dab5a5aa", "comment": "Malware payload (Loki)", "value": "e44f8de002dca1e0be09c6e43035f805e8796d15a3eb6b47e8f4751ee7f96e2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658766, "uuid": "742b4be6-21e3-4467-ad85-80a9a4947521", "comment": "Malware payload (Loki)", "value": "bcd91b885e02f141e74d5d0bd97af42b94a9adb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658766, "uuid": "db08ca3b-8172-4003-a46f-ba3bd4623702", "comment": "Malware payload (Loki)", "value": "8d0bccd2dd04bdc1a7ec94ff1e23d5693f72636f04d7b3912462db7549e96e63413a93ed7170d4c3e8af6c8522d3b5ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658766, "uuid": "3c85abb1-85d2-4bd0-a4b4-bc55ecafc69b", "value": "T1A5045CC2FB845A92D524873694E7CF312733EC659B425B0771C07B277DB3392AA2325A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658766, "uuid": "fc84442f-e50a-4749-9e98-102ababd4de3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658766, "uuid": "36d0ff6d-3f4c-428a-87bd-29c6b5d5310a", "value": "3072:6bH10ByhY4onItu+E/EsGz8tTo7z0b4mZ9MLxN4OY/Md:6bV+P4Ptu+E/YUToE2f1Y/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653658766, "uuid": "dfa5748c-7da8-4f97-96a2-91677a3b29ae", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653658766, "uuid": "f8592d73-c38d-4168-8a3e-763bba4bb28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658766, "uuid": "fcc8002d-e971-4a1c-8703-7211d880a03a", "value": "ENQ # 1220014088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514347e9-dde3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653672893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672893, "uuid": "fb1ce548-f910-4c9d-a3d3-4032a7311f16", "comment": "Malware payload (Formbook)", "value": "f5be926b8353b200b0d078b6bdbb2409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672893, "uuid": "6d79f907-beb7-42c3-a3ca-dd23ccdbc631", "comment": "Malware payload (Formbook)", "value": "e4769e3e2b77ecaf145799bbd14fc3ebe7b7032f12f34807c59f59cee8eb063d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672893, "uuid": "313b1e73-1bb6-4019-a048-dec53187dc06", "comment": "Malware payload (Formbook)", "value": "082c34d23a644ed820470c67e7ab3ba47c3929e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653672893, "uuid": "cad94ebe-1ffc-49fb-8b26-650d49f70638", "comment": "Malware payload (Formbook)", "value": "0596511b5d152fc7a1181f40a3d549c14ec2d9804d87ba4a348e5e6ad2b6f156cf9bd1a91417975eb7cdb21a2d1e0479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672893, "uuid": "16cc517b-3f09-495d-b6af-b87f161cf79f", "value": "T1D9F4DF3972A6AE23C1A843B4C0D7A41803F565479132D7C7BFC729C62A867E64DCDB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672893, "uuid": "1f21819c-7315-4945-afe9-0c74a5559438", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672893, "uuid": "6ba8d177-7206-441b-a7c0-375cefa7af29", "value": "12288:X9T+WDarHZNZS+r30hma4ubokv2LrEeGJNI6fWx4VWZo9twO0zEuqD:XZRGZdkhmMbok+LQVIQZUeCwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653672893, "uuid": "e101a6e3-a4d0-4e08-b55a-1bf240e70823", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653672893, "uuid": "5b523e8d-0558-4b78-959c-5f89e6addcb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653672893, "uuid": "042e828b-a5bf-41bc-ad73-a984af03ff32", "value": "SecuriteInfo.com.Heur.MSIL.Bladabindi.1.11302.30092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bddb54-ddaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653650758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650758, "uuid": "bbb362a3-f58e-4db2-b99b-24780fe58e44", "comment": "Malware payload (AveMariaRAT)", "value": "1ae9379c64c9c4720aacf3c51e1448b2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650758, "uuid": "66e848c6-8b25-43ba-826c-eedd33467455", "comment": "Malware payload (AveMariaRAT)", "value": "e5c00fe79b015685e64d6424bae88386a3af52d1c97bcce639576386a10bb67a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650758, "uuid": "d43ce746-19a4-4ae7-bef0-16b9ac1c084e", "comment": "Malware payload (AveMariaRAT)", "value": "1b1676a89476c6f1798508018166fae3975ad328", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653650758, "uuid": "151997b8-6fc8-4e6e-b374-9c6428404efe", "comment": "Malware payload (AveMariaRAT)", "value": "e645379810d02bca3d23afe75429641d53a16f3142631b8e087933fe147b1e2b2beb410326f524696a42da5e5f6cafee", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650758, "uuid": "24207850-dd06-485c-adc9-2403a6c8c530", "value": "T1B3F4D09C3290B1DFC5A7CD36D9A82C10AA3175AB5707D60BA057219CAD0EAEBCF115F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650758, "uuid": "cc1fa641-a1d3-4c7d-bd7c-599f5f6775c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650758, "uuid": "088a53c1-cca0-45b2-9136-6ce4404e744e", "value": "12288:k3SECuZbHoUXg3yQfhUR6tyBzuwAAl/nh0cakZY0Ra0mSVHlzOxhpT38st:YrFZbHoUXQywUEt+rblvicqEmiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653650758, "uuid": "3965d0d2-476a-45e3-80cd-797195cb7079", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653650758, "uuid": "1a0f9c3b-f83b-454a-9bbb-0dd01b8fe7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653650758, "uuid": "db7fd4a7-188b-40bc-a09d-8710a7e35d20", "value": "PO#1210900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9c74ed-ddcf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653664325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664325, "uuid": "69e40067-d5f9-4ee0-a74d-40b005d68c89", "comment": "Malware payload", "value": "8b42ff2b266ffa4664c03a8a46722c12", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664325, "uuid": "408235db-bd19-49d8-ae0f-fcefa9279420", "comment": "Malware payload", "value": "e77da0a27e93439e43f4896299b9a4374ece140583f7d651c2b7f66bf15c9b0d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664325, "uuid": "cc2d2f6d-6d2c-49ac-92f8-9add4328fd9a", "comment": "Malware payload", "value": "45b747e3d500e8be10de870f039a51e501486910", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664325, "uuid": "5bd4b9c3-29dd-4145-b66f-0c98d02d5555", "comment": "Malware payload", "value": "3a671334d6184fe80364149c67d4d4a9ffde31b66cba2f6c4351d35e0670077af70d9834a7bbc3ab53d102efb68f7d84", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664325, "uuid": "2239bffb-2d22-40a0-b9f8-8c04b201e177", "value": "T15C241202B9A54648D68571F5FADE27A8E0E3CFC103D7D0405E45708EF17BA8D9A2FB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664325, "uuid": "7260263f-2b51-45e2-8ee6-2e90199d7ea2", "value": "6144:S+t85JCaLMOoAdxffWQOUgVNTl4BXWFLCorDGBYkdBf:SU85JPvdxWlmXWRvqpd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664325, "uuid": "b065d044-9f5f-4260-9b03-25f603949223", "value": 228856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664325, "uuid": "f7da4d99-a1a4-4f22-8ee7-d12193524764", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664325, "uuid": "d232863f-ca4c-4993-81f6-e64490cde784", "value": "Purchase Order FG-20220525.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5905794-ddc2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653658914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658914, "uuid": "2fc87b61-24e0-47f2-86fd-d02e8f9623c8", "comment": "Malware payload (AgentTesla)", "value": "29b03eb0f987f638b99ef23c8e3681ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658914, "uuid": "9c22fd34-4987-4f43-8ff0-a96aab01670c", "comment": "Malware payload (AgentTesla)", "value": "e799a969eca8b72287a0b6a1b7015d6a47fa07e30d960b1a33b2e8178efd80a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658914, "uuid": "ed4f6bd7-30b0-4cae-8fe5-6f2a1f6fa7ee", "comment": "Malware payload (AgentTesla)", "value": "174069ad27d00891343e794167abf298cb5f3e5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658914, "uuid": "3e218123-a075-4611-8e99-c749fe0b9f68", "comment": "Malware payload (AgentTesla)", "value": "81d59820bee5192055cc1e820fc7d81bb3795ac4328b8a9d07dbc91a3e5d2ae033aa4b87e5bd780d426d2126213a6408", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658914, "uuid": "5662a317-2690-41a2-81d8-73abdc49db56", "value": "T133F4F10072F84B22E67A67FE9670518407B6BD986520E34E1DD27CDB3A71F528E81F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658914, "uuid": "b50eb9fe-f7be-4e75-897c-31ca5a2f2e90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658914, "uuid": "8a01d433-e30a-4103-9a05-5431f40b8b40", "value": "12288:A/sIP9M2S9bHoAUTvqVhe+TMAzsr4the/MNE/5xvI9TwDsRAbRdra6tpfmL1g3sG:SsIP99+bHo02Azhh8BqUIERaW+Bg3scT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653658914, "uuid": "ba7823f7-44fc-4c52-bb5a-9f742fa56778", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653658914, "uuid": "0f141712-ccc8-4540-b73a-0f3edd296704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658914, "uuid": "d41cb61e-db43-4f7e-af51-c9bc6eaa4fd6", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d512e0e-dddb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653669584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669584, "uuid": "d0b455bf-ca17-4a39-9732-9c7e221a6dcd", "comment": "Malware payload", "value": "a49fed8411f582ed6f16e68d6f457ab2", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669584, "uuid": "c77a55d1-284e-4599-bda4-a89f65067a16", "comment": "Malware payload", "value": "e840a3fec3de7b7a6198d90f14e5e86a9ab20f348877560a656b1c182d97546d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669584, "uuid": "1b3f5a7e-2cc6-46ba-9047-0eebe00781a2", "comment": "Malware payload", "value": "81d8f705fd1b0c23b3ee0d42092ff15479165284", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669584, "uuid": "590db637-c08e-487f-97e4-454c3d672ee3", "comment": "Malware payload", "value": "a5af3b22543fad8cb4a813d7525e9af05139c485bc57f429117e3a5bd039d7c731b52f96e2a1c3b38651dd01e3b71038", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669584, "uuid": "613013c1-ed03-411f-8d50-cfc208bb259d", "value": "T12B15C931F6D69E8DDE52C03F2AC8A8B0AE447B4969D73347705C70ACE9A21DB5B4709C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669584, "uuid": "0021418d-5114-403e-9117-13974f3715f9", "value": "12288:65E09V1ykUNNeTs53Edc8NQGGnxHGXX+6mEp2uhiyGq0/N6k:65E09V1ykUNNeTs50nsCX+Chpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669584, "uuid": "8bc26d81-9e85-4da9-bd0e-1f46eb854f58", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669584, "uuid": "5c3377f7-e4fa-4480-8f80-78647d363336", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669584, "uuid": "f0972144-fbea-4815-b3de-240210b03a40", "value": "SecuriteInfo.com.W97M.DownLoader.2730.14200.23350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c1ea20-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1653664599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664599, "uuid": "6eb38144-6ab4-43d3-9ad0-3544537bbef7", "comment": "Malware payload (Vjw0rm)", "value": "ebcb99f17238dde1ca4c12316ebce4a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664599, "uuid": "06655108-bf69-454a-9ee4-589aec9b748e", "comment": "Malware payload (Vjw0rm)", "value": "e873129006fb7f83c9bec9516fd3ce2e3737f79df1458606445e61926a844f4a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664599, "uuid": "0d6c4567-2d6c-4d8b-ae6b-95250c9c0801", "comment": "Malware payload (Vjw0rm)", "value": "1662814aa8638312144d7be033875b2365e89696", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664599, "uuid": "8dfe385f-5e74-4054-9739-639d95e4f203", "comment": "Malware payload (Vjw0rm)", "value": "110dca9246bbc9f74dce041fec9f2f2d6ca8ba33307c958574f577c225728c689feaba51d1b4308818eaa3e9a0224512", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664599, "uuid": "c42216c0-7b6c-4217-9559-5573b8e2e0eb", "value": "T15474AF308F805B9A9AA44D07D07E1A5F56F3172AD122B2CCB7D6390B3B7EE0D5A13C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664599, "uuid": "d7b5c2c9-f799-45a2-88e4-0df143e19127", "value": "6144:AyPIoEOSE6N8vpFCLi8DA7oqVdX+KK980AaDtu1G8Fgf521asfp+roYi72yrHKk:AyPIoEtpxDAkeX+KC803DOG0gRzrfov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664599, "uuid": "403ec754-46fa-439b-8307-2c7b7ce980a2", "value": 346670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664599, "uuid": "d9561f9e-528f-40ae-88ff-b5a6a7faaf6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664599, "uuid": "ff534478-9919-49e1-935b-92fb8769063e", "value": "CIQ-PO162688.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c41b97-ddea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653675912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675912, "uuid": "432c7fd2-60bc-4159-983c-8920ec3de243", "comment": "Malware payload (Mirai)", "value": "a8fbc7563fe019ca689573d43d7797f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675912, "uuid": "bcada872-4a56-4bd3-b9ae-902e52a92982", "comment": "Malware payload (Mirai)", "value": "e92cdc162e5091c4916d12d2f4a5f7e7e9ffdb4dae8a18427d81f97ed08edcef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675912, "uuid": "8651e2d9-a03a-482d-aa8d-545dba99dd04", "comment": "Malware payload (Mirai)", "value": "d9842c2d31a7357d8c92414edbff9e60fce317b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675912, "uuid": "f44b6aa9-e824-4115-9cfd-3751d32b5211", "comment": "Malware payload (Mirai)", "value": "8f52a72bd4278637999c4256a778e2ae6692bfcd15b9714dac5e463a57bad7490d29d6ed4a8d753247e5a7f7144b2deb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675912, "uuid": "a5ab360c-4386-4e9c-b72d-1ac8c9bca7cf", "value": "T17F13F15640FDB4CFCCCEAD7A132819E5EE08588966EB135D6B04C589E8A8B5FF05E4B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675912, "uuid": "cf0de4d0-0cc7-4195-acd8-bf40aecaca39", "value": "768:vL2P9rDZe1V1zzXCgDugq7qovNFPmvKk4ywL7Eug+xwWD:vL2PdV6jzzXCgkPF9mSRywvzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653675912, "uuid": "0be85424-1945-4e4a-a930-8c04e0d751dc", "value": 42928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653675912, "uuid": "9d884dd2-8cc3-45a6-8b56-0ac8445936f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675912, "uuid": "189cec4a-f00e-4642-9c32-beb885e8bab2", "value": "a8fbc7563fe019ca689573d43d7797f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11903a17-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1653665055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665055, "uuid": "9bb0ef92-3a4e-4049-a171-b389d5c7766f", "comment": "Malware payload (Loki)", "value": "76e89e91da92d6026060b9f14c4bbab7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665055, "uuid": "664c1a42-13e7-4df7-9deb-3d70bc610547", "comment": "Malware payload (Loki)", "value": "e9587192eafdc1e8df9bcf41188482001fec2abdf220724e3421f7ccb210f1aa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665055, "uuid": "1d0f5efc-2a8b-4403-9dce-3d7498e4d165", "comment": "Malware payload (Loki)", "value": "3a06d5caa86518bf52af11644d8119164d4b80bd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665055, "uuid": "ef3efc11-29e1-4f10-b61e-2ae5b5235779", "comment": "Malware payload (Loki)", "value": "aca089820d1744603944fe1c82bf2bbcdc0d1c932a37c32ecf658f2d4296cb64ea41f8be1f60587ae629691efaef3f76", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665055, "uuid": "9fc2dbab-dc1c-4ecc-a543-6c2acb7dff24", "value": "T1A7D4123C22EC0624E7FE1BBA20B911004BBA674B6212D75D6EC974DD2CD3B554E13B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665055, "uuid": "e81be719-f7c7-4d72-8473-050848eb7e84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665055, "uuid": "1617400d-3c75-4dbb-94d4-dcf8ba4f37c1", "value": "12288:yM7lE+Dd6H8ZbHoXNRCSA5VKiO8Jb29JaDVinFszT/LxxbPoeZIx:yM7lrIcZbHoWPKiOHJ8EF6TDLbcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665055, "uuid": "9c3b9e99-6bfa-4410-82ca-d6fe0d93f11f", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665055, "uuid": "eea96b55-a97a-4614-89d8-7be3cbdce062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665055, "uuid": "9d1bc898-1700-4f74-bb96-bbd6bb665136", "value": "DHL Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2a9f1a-dd88-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653633884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633884, "uuid": "04388cbd-0725-4be4-93bb-828feb192bb9", "comment": "Malware payload", "value": "d889ab5249e7b9b3144742f260052e96", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633884, "uuid": "55745b22-b585-4817-9a84-3f700b6e26d5", "comment": "Malware payload", "value": "ea3071556bec7408741e04669f741689bf0154e990f1ce76794a2ab3cc5c28a5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633884, "uuid": "685a955d-138d-4cf4-af77-00f32f4840b7", "comment": "Malware payload", "value": "c15904d3d2a2daeb9ecceaca6790252287c662fa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633884, "uuid": "f9906416-38d9-4f24-8b36-62e3db2dcf47", "comment": "Malware payload", "value": "07bf42d0af51d5559112de331f46f7c5859aeb1474babcf68bb214da6ee14e0c92d3c982e203f9db077b5acb6e4c32a1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633884, "uuid": "453cd599-8ca0-4597-b621-05561998ffeb", "value": "T137272387E718E89BC4F72632CAB6922331575D610783ABF62D04B23819B36D18F59FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633884, "uuid": "210a960a-a484-4d59-b477-e9b3696cf1ac", "value": "393216:Clji2EPX011EZpPLnaO9NiR9Wgu5n/bJcgvxwBgclA6Znlpww1i9w/7CTbGjS6eH:6iI2pPg+rRNUAMniO7CTY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653633884, "uuid": "29c9503c-3153-4f00-9408-0cc45a5d0951", "value": 21603368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653633884, "uuid": "aa86cd81-85cf-4185-874f-96031d582329", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633884, "uuid": "97f1dde3-6c6d-4c39-9871-ee8c379050af", "value": "com.aooale.hisms.message.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de22bfa-de0d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653690819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690819, "uuid": "6b9d6828-65a0-4369-8dad-ca1597f923b3", "comment": "Malware payload", "value": "ade0a94183f3a689542febaccb660892", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690819, "uuid": "d22e8758-2c0e-44bd-a15c-f642645cfa05", "comment": "Malware payload", "value": "ec87338fa4fa336574c86ed0c877632f7a9cca242e5a996bc260707bbcfe2ad7", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690819, "uuid": "4f49c92c-7a99-46ca-8480-9eeb53e35ad7", "comment": "Malware payload", "value": "132d2a5a1236bf4a11f1ea7dfe27be63861e844e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690819, "uuid": "c8f82421-f95b-4e70-aafd-44ac7a0395f7", "comment": "Malware payload", "value": "ef913ea641788e24d791ecb65f920351a3ce242201a5ecac26c6eef4795047a49c0122aa3aee708b4ac50d07f8c14878", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690819, "uuid": "fd2faa0d-a0c4-404c-b66c-7db9c5ae66b4", "value": "T124634B59B76A885EE9198B3048F747D62323FD308F6F0A433259F3926FB9590670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690819, "uuid": "4038d5ba-a587-44c7-a421-f900eb37b827", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+4+hDcnTLiQrRTZws8EV:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653690819, "uuid": "252f6f0a-4336-4095-bd11-1f1ee0520e0f", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653690819, "uuid": "accb4126-d7a4-46c1-8257-c019dc2f72e9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690819, "uuid": "e67dbdf3-e370-4356-84ef-5a2f9366c138", "value": "SecuriteInfo.com.Exploit.Siggen3.32798.26796.27631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f5f1bf-dd6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Kutaki)", "timestamp": 1653622616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622616, "uuid": "a77e52c3-d225-4180-a008-f3a59c01ec40", "comment": "Malware payload (Kutaki)", "value": "b050af8aba3a07d5ef9a3de5ab9bc565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622616, "uuid": "43cc2990-fcab-4ef6-ad66-ec13a916700b", "comment": "Malware payload (Kutaki)", "value": "eccebeaa26e771fa679177b8a05aaec028218381007a10993b4dad939245f0e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622616, "uuid": "8dfb39ff-633d-40b8-9787-90637dd9eb11", "comment": "Malware payload (Kutaki)", "value": "8d9bc9ef9e929d7fdd6f88b0ecc19da91b07b2d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653622616, "uuid": "0d2fcb86-de61-4ad4-8aed-375c0039cb7d", "comment": "Malware payload (Kutaki)", "value": "f9be34b6cdaab1008f7883c47f4d1fa6b701e3ebed3bc4ae5a59bf3f911478554c3706737f30407a32bb39fa1d32a116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622616, "uuid": "be178824-769e-4e46-b2ce-f57dd7c8b754", "value": "T12425121BB7C24D62EC5929B06F9380E12767F8AB1F47024F7680727D68A6F416C19B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622616, "uuid": "a3557ecd-5d89-467e-83f5-091bdba18e4c", "value": "67f310695ece8f1856c07ea3008696c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622616, "uuid": "56c6dde9-17fc-46c1-8194-c05504657211", "value": "24576:he46D5tKERWpnhNjQlUPnGYI5aDMTfmP/UDMS08Ckn3O:E46lgEshNjQmuYMaoTfmP/SA8N+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653622616, "uuid": "05610bbd-ab06-4bd4-8f89-e395014431f2", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653622616, "uuid": "ebbf47b7-366f-43d4-8125-7b0d21def8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653622616, "uuid": "6f670be8-557b-445d-9650-3ee2f54e6524", "value": "SecuriteInfo.com.Variant.Midie.109118.23009.10772", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdc20b6-de0d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653690822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690822, "uuid": "dfb023e5-fb8d-48a8-a252-78ec5fa8dbd0", "comment": "Malware payload (AgentTesla)", "value": "13e9a9318c237795b7ee7b1d74af10de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690822, "uuid": "a2fbab3c-c942-4baf-89d8-fedd683c24a7", "comment": "Malware payload (AgentTesla)", "value": "ed30fe8e2c87f0ee1f3fec7d48347ab3faff44ba68d1ea5bcff2bf1e0867ad8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690822, "uuid": "1c6ca773-0b25-406f-9d4e-e348d4067f23", "comment": "Malware payload (AgentTesla)", "value": "db33a732660cb802ee261b0292487bf16cd30927", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690822, "uuid": "df694bdd-1c0c-40b9-aece-f3b2601ddd62", "comment": "Malware payload (AgentTesla)", "value": "dff27ec5ef53882cfd9e2515e86378cae0d57cf117c1a8ad9ad09975d55a5634948a9c71211dea18b5e3edf779605105", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690822, "uuid": "c1ad0813-536b-48b3-ac82-664d31e9d097", "value": "T11205E019B25B6E22C66903F681C6E06043F6644BE931D3CB2FC761D71B42BD98DC978B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690822, "uuid": "df51460f-4dd2-4211-b7e4-c7048b0e127a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690822, "uuid": "f32bf5e7-4a63-437c-9ff4-55461beab364", "value": "12288:irJhuNYyrv7KY7obQ+pj9YleLfenVEwrl0vFIF1RZnIajMh+6SgxLrqDZ:i9Mi47t7oxVileoevraFgID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653690822, "uuid": "0df74a09-7440-408d-8d38-8da196919f56", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653690822, "uuid": "702a8131-a8fe-4fbe-b637-68ba3b03890b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690822, "uuid": "8c728656-2541-4c0c-92c4-e66fe075ac31", "value": "SecuriteInfo.com.W32.AIDetectNet.01.28629.24209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2e4023-ddea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653675894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675894, "uuid": "29349503-1166-4f0c-aa68-922b772f6df3", "comment": "Malware payload (Mirai)", "value": "fcac3ae89100b2c3b42f37225fe02ade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675894, "uuid": "eae39360-c898-4c8c-bfec-402897eda9ae", "comment": "Malware payload (Mirai)", "value": "ed39d180e43e2288f1c191d794fc75cc6c433d36ea5ed7e2810f72be68193b02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675894, "uuid": "741d43d1-cd7d-437f-a69c-b2501b00d7a4", "comment": "Malware payload (Mirai)", "value": "148555f426b879e6e303a81c55830afded30bbc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675894, "uuid": "0cc66d74-006e-4558-b399-f3ac8047034c", "comment": "Malware payload (Mirai)", "value": "831c178a73110353ab1af6b761c5f9dca09d7faa13c6a18657cc57bce9e589da89115088706034536a772b4fe2fa0e65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675894, "uuid": "a8fb5531-b27d-4b09-a352-e341dcf3a548", "value": "T1CD13F1B0B258B880C76200B9DEB34987ADEA54F487E37371A55CD329EEE111137BD15B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675894, "uuid": "25d4535d-2c89-4e43-b82f-57ef67af7d33", "value": "768:Wutod6/lD5vJPPzkAZ3j/F616nfnqd9IUkQEzl9Wpf6HtQ/yY7B/ms9q3UELa:MsvJPPzkW3jYAnCtTxcHtQhlULa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653675894, "uuid": "2c1e7264-0a5c-4f7f-9af9-7ba9c64bed43", "value": 43612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653675894, "uuid": "b8d8b9a8-7d6b-4cd6-a3f3-db4f5b65cae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675894, "uuid": "770fc3a9-4c49-4901-8b80-11b4a42d2892", "value": "fcac3ae89100b2c3b42f37225fe02ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d180e08d-dda1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653644761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644761, "uuid": "13bfc24d-db9f-43e7-a7bf-b021f7cb5000", "comment": "Malware payload (AgentTesla)", "value": "4a16159604b822e309e60ca09698384f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644761, "uuid": "8741912a-742a-44e2-9f63-d1c98ee18f73", "comment": "Malware payload (AgentTesla)", "value": "edbb0bb9a8cca42999a4545bb8045d59201a9479cf979503a2835472fac7a18a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644761, "uuid": "6ca0a899-2845-4b35-b34e-2c6233c0d3be", "comment": "Malware payload (AgentTesla)", "value": "1e01ee05f97e9141b685277fcf866511aa53f7b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644761, "uuid": "4acedffe-5d08-4318-9fdd-ec3c68c9c0a1", "comment": "Malware payload (AgentTesla)", "value": "e2af2e7dbef2a310985df01964fbb624c5ef7eafd737f7f591dc36eee62f4af0ae78b8636e85c9fafee0bb4a07a3e0b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644761, "uuid": "b70bd6bd-9faa-4ee9-b329-0ddad85da260", "value": "T14894239599D1278BF6A7EF160D343A4E5782BA58C3D173EBE5B83960383C34805126EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644761, "uuid": "c609459f-17de-491e-ae89-3484bf35f8e9", "value": "6144:5dQ/97C4uTT4cyImWrEHtZSFkQT2Uy4yrtILVbOCQ8BL3Q06wP1aP8EBEI1D1Ej2:/W9T2MWmkcyTT2Vra51QQ7QA1a0Exkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644761, "uuid": "24bda144-8378-42e6-b9f2-8edcdbf5ca1a", "value": 411729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644761, "uuid": "7a3ca59a-b445-4fd3-b7cb-ef38b1b1165c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644761, "uuid": "753eb772-c92a-485c-b7df-9ab7bc0cdb5e", "value": "Statement of Account (SOA).r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad72b747-dd86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653633104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633104, "uuid": "547ba057-f806-499e-b637-db15d14e1695", "comment": "Malware payload (Formbook)", "value": "f6ef6813f25d00d4c8177a148af4205b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633104, "uuid": "3f24bae5-ccde-49a9-b6f9-7827b86d1198", "comment": "Malware payload (Formbook)", "value": "edcbff4e011d46b1c1918479985c8bb094d02cdf9494f87903df9faeb6555c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633104, "uuid": "b34ef5f9-7a9a-4a30-a1a2-ff2a1cda1190", "comment": "Malware payload (Formbook)", "value": "35a3012928563537c40c4a572e4ca1da82c042b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653633104, "uuid": "5c21f946-e946-4ff7-9c09-d06c34d4f63e", "comment": "Malware payload (Formbook)", "value": "9a3a46b191087073854ff92049f4de7976dd07d9f35323fedec0452435fcc72024b7d6fb0961b60c5cc8e539961ea2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633104, "uuid": "49869fbd-a3b5-4e84-bee1-81346aa23cc9", "value": "T1CBF4F104B2F80B22E6BA57FDA57461C007B27E942520E39D5DD278DB3672F518E82F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633104, "uuid": "d93b7f36-dba5-42d8-b40a-d472243ef1fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633104, "uuid": "3addd3f8-341e-415c-9983-40b41c8c18cf", "value": "12288:bzUuJ2l9bHoAUxvqV9qISIUsZGJcoZQWsTaFg4ay/ugKfi3PiiHuQL:XUZ7bHoyqUrZapZQWAadR/ugK6qiHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653633104, "uuid": "9ad58e54-4956-44ec-8d7c-6ec8d364ee83", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653633104, "uuid": "24836ee8-3d97-4c52-88dc-b3557cdbd118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653633104, "uuid": "34e6fd76-90e8-4fd7-b3ed-230539fba8ad", "value": "SecuriteInfo.com.W32.AIDetectNet.01.31153.16050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91747ef-ddd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653664933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664933, "uuid": "440bed62-6571-4da7-b1e1-aaa2d747d3af", "comment": "Malware payload (Formbook)", "value": "0204546cc8568a60d97947c5fd6ccd49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664933, "uuid": "a384fa69-7bf7-490c-80c2-90f0e99d8924", "comment": "Malware payload (Formbook)", "value": "eddc1ee1fafda4fe7cf6d114276c992806f33d7527d346464bad7033875fbd66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664933, "uuid": "ca0202d3-57b2-4a88-8b0c-bddf50cb3952", "comment": "Malware payload (Formbook)", "value": "ff7c492dd728279cd763af6fa525606431fc8db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653664933, "uuid": "f0f97fc0-1fec-4950-998a-67e7ded14bcc", "comment": "Malware payload (Formbook)", "value": "609a80a11fd16b94bca2d15fd2fc5896d4c6c2b53566e7c3def8ec38b3e0a5cb12f1d1dfa9255cff177250280c681363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664933, "uuid": "860ee660-eccc-4a84-b063-1b91573e802e", "value": "T1FB441247B7F054F7D1729E3215A3E699F232A34619A191C71FB0AEB9B03E9C1048B74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664933, "uuid": "343d823f-ef28-4b00-a76c-ec8c4f29ae3c", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664933, "uuid": "2188cefb-eafe-489b-bfb2-885013f93d8b", "value": "6144:B0YuB3ZgxdaCVG/RF5JUVu0dXet0ojX1nQcznQ:eB3AdaC8/RFYTQ0QDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653664933, "uuid": "4592f2c6-f419-4410-abb5-8a067224e8de", "value": 278482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653664933, "uuid": "7c5ac7c9-7a8d-4ac0-9849-28deb5c01be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653664933, "uuid": "d1ef7641-7e3d-458d-a01b-6639e563ae75", "value": "\u00d6DEME FORMU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112a0be1-dda7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647015, "uuid": "f83510a6-b180-45bc-b83e-84f73a95efd6", "comment": "Malware payload (Mirai)", "value": "6dfcca37a6b1468fcaf3addab827b850", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647015, "uuid": "469a8552-94bb-4b4b-acd3-11928b634dd5", "comment": "Malware payload (Mirai)", "value": "eed19f89eba4f0ca0b1f7ef5f02080b5839f076652aeb277c59e3b6e85f18c4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647015, "uuid": "b4eec276-ea55-4a9f-aadd-3d965f4f5d49", "comment": "Malware payload (Mirai)", "value": "d96baef8427ad98a42e418e49fbcf440b173fc3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647015, "uuid": "f33e12c5-4d73-4057-a9f8-f75ba108cf53", "comment": "Malware payload (Mirai)", "value": "e8c724ea2e0b607b1015177c8141233dc39e261f3b7b89117c5935cfbb3c87e12185c90ada0cc057522ceb4fefcee0cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647015, "uuid": "634fefb1-6a6f-4fa3-b54e-a8044a515397", "value": "T13BE33B86FA409E13C0C61776BAAF014A3322E755E3DB73068D185FF43F8AA5E4E57606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647015, "uuid": "b48f02ea-72fb-4250-8ee9-8df82132671f", "value": "3072:0rMrjDKMlbid2wnVMdO21MzcdTcLdVaTneYxbhAGpWyfa90tM/9V3Jnr:04rjDKybid2wnKbVUdVaTn7phAMfa9a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647015, "uuid": "d6c1955c-ed86-4e94-9dd0-44874193a9d2", "value": 150354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647015, "uuid": "30b316ec-4f26-4d13-944c-76e5505c1e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647015, "uuid": "b0cef042-0224-4d48-8f34-f97594f4dfb5", "value": "6dfcca37a6b1468fcaf3addab827b850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0106933-de17-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653695493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653695493, "uuid": "2bcb2430-0405-4612-a550-8d6f0614ae0b", "comment": "Malware payload", "value": "5ad6ab790c1bccd62fe85ca19187b126", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653695493, "uuid": "09c31001-b622-45c1-aec0-dc87766d96f1", "comment": "Malware payload", "value": "f01652fe12d0850692d2dd5e692b86f8339369d5bee43cf615a837216c5aa709", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653695493, "uuid": "cafbe988-ed5b-446f-a545-d6a8c2fd50c9", "comment": "Malware payload", "value": "047f59f44937e6c478fd5d783de29282eb0c124a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653695493, "uuid": "468ecfb4-3be0-4b48-84a3-1eb14a6f6c7c", "comment": "Malware payload", "value": "f81aa2c867c279a7ed761a1e3a7ed39f15f4d2e73222eff717eb4eb6aa49766e4238dfcebe216cdbba79007860060844", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653695493, "uuid": "2b91eee6-ebab-49db-b6e4-e8ba987227e2", "value": "T14195BFB8B2242CD2E66E0777C5D7BED927B32B228697E8C9417467D30DB3361ED06814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653695493, "uuid": "64030304-ed51-475e-bbd6-29eed8ff9e73", "value": "12288:z1SX/m9v0+d8MOXGU5I3hwUWflXzpbZY/4oRh9JfnLUk:Z/RFOWU5UhwU8XzxZZ8b5LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653695493, "uuid": "36012420-d27c-4d33-953d-07cac4c486fe", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653695493, "uuid": "53d8c002-6294-410b-9c9e-d912096fa799", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653695493, "uuid": "b357bf80-be90-4e28-ad8c-a529358eb8dc", "value": "StolenImages_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8929a416-ddd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653665256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665256, "uuid": "1cc55908-6061-4068-8b9a-e9d594201b20", "comment": "Malware payload (Formbook)", "value": "0ecb6ed891d173443fa3654c31e14320", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665256, "uuid": "7feb6d52-acc6-4271-ba03-6b6a76108f5a", "comment": "Malware payload (Formbook)", "value": "f080b3ba979f854761526f4bc6bd5b8210b48d5f91f15b1a1423849107775e11", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665256, "uuid": "b6ec97e5-7574-4d81-b5a9-b0eb9780288b", "comment": "Malware payload (Formbook)", "value": "6867f37817db501ce103813f791899f3cf1bc1e8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653665256, "uuid": "7c57c093-adb5-4853-ad8f-058488638154", "comment": "Malware payload (Formbook)", "value": "dbfe307e7bfcaa2d16e449d1caace3c5c16b98d7408a1636d58e6421c75b37453fc69b133de918238db81834203ce736", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665256, "uuid": "198c0558-5211-4c47-a9ce-5250c809d4cd", "value": "T11616A431B13439D7C21F0435565FBD89430ABD83A3C66F8C518EFAF91EA69E7630690A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665256, "uuid": "b43c8751-e558-4f85-8284-bf4f05908061", "value": "24576:Z+h5y9IA8yaw1fba/f84V6FXjhHavKVp7Ai4q0LD33bqJXCJIoYSUaJbjOpS/iqu:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653665256, "uuid": "ef43e3c5-17b1-4a02-9903-320e890f6ee7", "value": 4073082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653665256, "uuid": "4dd0bd2b-6040-4dc3-8426-227bebbaf4b7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653665256, "uuid": "4dd71c70-07f3-46e8-bfd3-aea24f0363a6", "value": "INVOICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580beaa8-ddb8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1653654436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654436, "uuid": "130b333f-b383-49db-afcc-cb08cbbf7dbb", "comment": "Malware payload (AsyncRAT)", "value": "ca0d504d89fbea69214e40b896079d8b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654436, "uuid": "08ab5906-1da4-4ad6-b34e-3d1f0ccf53c7", "comment": "Malware payload (AsyncRAT)", "value": "f0ba0fdaeb248b67341c740cb728b056516768bee672c4df22f38dbad3598bde", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654436, "uuid": "705bdb7f-d917-408e-8959-68a40913aa03", "comment": "Malware payload (AsyncRAT)", "value": "0c43265dd0448395cc3c88fd9dcc828dc95ec016", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653654436, "uuid": "0c8a9d3f-0101-4dbf-96c9-e553a06df586", "comment": "Malware payload (AsyncRAT)", "value": "1b4b1f2c08d10cd5a58ac4fa9fe2e9760218e8e3422126e2f0db536182d24c6bbb11a02fefefdc5136770157a5ee9571", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654436, "uuid": "925911b6-3a62-4c00-ab6f-d586a04b557d", "value": "T134940254ADFBFFCDF2D0217952AF3CEBEF0CC102A976194DAA4406B749A39140786DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654436, "uuid": "82a3c682-176e-48ad-aa86-8b43cba23f11", "value": "3072:MxXrxqAHh+Pat+LUacwdKZnQ0NLqbm6rw7Yia9p3VvP:MxXrY0h+YZZXfWw8iIvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653654436, "uuid": "f6aea408-32fa-41b6-b2a7-cccc00db6bb1", "value": 412118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653654436, "uuid": "d8caaa43-5ef3-43e7-abac-b24f4b5cd1d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653654436, "uuid": "bd5be6e3-9941-4901-b6fa-9324961a5c4e", "value": "#4029013.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149b447e-dda9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653647880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647880, "uuid": "ebc0e4f2-95b3-48b6-ac08-c9b5766f8bae", "comment": "Malware payload (Mirai)", "value": "e2501a4bed62e15c3cf59b781b2ab698", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647880, "uuid": "e5fd1496-f567-4289-beee-22c2a443cfb4", "comment": "Malware payload (Mirai)", "value": "f207c0abf680d783ddeb59dc245c4b4e84e471e44c4bb7703019bc2486fdd5d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647880, "uuid": "5c9c22a0-341e-490f-a178-25030510f247", "comment": "Malware payload (Mirai)", "value": "5ed9286b1b9d36a06dceac8bd0da8ba739ed68e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647880, "uuid": "3b9e7a54-f1b5-487b-bc70-f533655545d2", "comment": "Malware payload (Mirai)", "value": "a986a5695184cdf8a694e28110756551a8950a3a4059b943c1f355d64f726eadacc9db9c5cb09815253ec9f7c77e96d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647880, "uuid": "ec809eb5-ddb2-4762-97a5-37e68af209c7", "value": "T1256308967CC19A22C6E423BBF96E01CD332563A8D2DF321B9D212F5477CA81F0D67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647880, "uuid": "ba51e0fd-8d02-4ceb-976f-48e16a6b6b2d", "value": "1536:161Uv/15au1m7+tIVp5fm5tyWpRT0fN6cahWMUiU4g5X9/e35GZjOk:16+tRRYN6vhT9gi3Gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647880, "uuid": "b9a1daf4-725b-4be2-801c-f65ac50e7f26", "value": 72168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647880, "uuid": "0698033b-bd9c-47a7-a5e3-75e5980d6b7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647880, "uuid": "9f44478a-58d7-4420-a395-8ac076484be7", "value": "e2501a4bed62e15c3cf59b781b2ab698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b854fb-dd9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653641703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641703, "uuid": "8dd0e75a-8375-453a-849b-4f60b266d842", "comment": "Malware payload (AgentTesla)", "value": "7195998727c39bf6e71a7e74f4748f75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641703, "uuid": "893bca33-fc4f-4ef3-93aa-3e217ad754f0", "comment": "Malware payload (AgentTesla)", "value": "f2a4b83d6290fad49a2cd96d8cb8a7421a4518e134d9a9ae5f511f72f6720196", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641703, "uuid": "e912b204-0380-46bb-9b2a-eb06dd6d405f", "comment": "Malware payload (AgentTesla)", "value": "df9f23a5c2cd159f524b3d911f3190f0da85cde6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653641703, "uuid": "ed180c3f-a139-4d19-b55c-257be1fcfeed", "comment": "Malware payload (AgentTesla)", "value": "757089956fa7225c6dbba6b5318bdcfce6298d34c857dad6ff1c2c2950b0fa24c1d21b759a362b2bec37c4a6a3042251", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641703, "uuid": "311538f4-81fe-48cc-8014-63b70d603db0", "value": "T1FFF4D0A1BB8C2A03C4B7D9761091482105F39D5E7A13F2167FE3299F15E2B42D773A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641703, "uuid": "383862d7-9681-45e7-bec6-0c528c1688b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641703, "uuid": "1f1f6bd0-67e7-4c71-bb9a-49eb350439ab", "value": "12288:uZYiIpZHioyEhviMjkWGN1NzohdDDuUhWTBv3jbe:uRIjhvBjGETGUhWVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653641703, "uuid": "64be772d-ef1a-4999-aa06-5435ff06b352", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653641703, "uuid": "fd1562e1-5929-4f76-bf15-d4febc0d1127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653641703, "uuid": "5fdc31d9-517e-4550-85e7-7adfb7f0ecc3", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84f87c6-dda7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1653647350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647350, "uuid": "df791277-0c77-460d-ab30-06bcd833da7d", "comment": "Malware payload (Quakbot)", "value": "bbfecf2dd5a5f46ba24096a72f73c68a", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647350, "uuid": "d4dc5d4c-b90a-4907-8c0a-721d57ae5247", "comment": "Malware payload (Quakbot)", "value": "f2afc148973efeb8571d0953bc6d84dbe9352c6e9534c2e6571ea632d9faa1d8", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647350, "uuid": "c7418914-8582-4a40-9ff7-76b3d5eddd83", "comment": "Malware payload (Quakbot)", "value": "22ec955f426b00df1e3741b5a3e06cce8a4ecb7d", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653647350, "uuid": "bfb56199-4b1e-4fe9-a4c4-fd18f2a16a6d", "comment": "Malware payload (Quakbot)", "value": "97aa790929acb5619d6e19a8b6f08ba711567d028f090fb6294134d19eedef3f7cde93bf01ae19cd8f601f60121a00c2", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647350, "uuid": "ececd87c-0e40-4869-b5f8-4cae1405ab61", "value": "T1F25533A2CC0FA996C5B4C8F2948F5FBC2300999D15AC95345A44F4EE36C1B89E8D7DBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647350, "uuid": "b1b403e5-f15b-45b9-ad23-58091620d295", "value": "24576:sTHAAqnrgIPM0sTjK+sy/jO0MrPbQa8I3GNWuNPyCvUJVE7yLuKrasvKtdBVI7o2:ugAqnrgDD/xhy6WlCv2E2LuPP7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653647350, "uuid": "2c400cb2-297b-45f3-9042-a44f88c0fe49", "value": 1378141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653647350, "uuid": "783865ef-6f9d-4db0-a248-fd353b2cae55", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653647350, "uuid": "f5e4f599-bcde-47b7-999b-be07ffdaade4", "value": "RB-607106250-May-26.xltm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70395937-dde5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653673804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "43641a88-28ed-4674-941b-dc670409c37f", "comment": "Malware payload (Mirai)", "value": "b4f5bfac429ef2fbb401f4ed0dbf8e7f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "0eb1055d-1a2a-484c-a230-e8c2c3e4fee1", "comment": "Malware payload (Mirai)", "value": "f2dc452a7fe65c606976ec4eeb5c538ceb64211fd8082df785c3eb51745c1f2d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "36342055-ef27-4edd-ac5c-669d26eb9da8", "comment": "Malware payload (Mirai)", "value": "c3500ce1054bed52a5f9dcd44adfbbf5575cb673", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653673804, "uuid": "248af10f-9a87-41f4-a84d-7680d8c82713", "comment": "Malware payload (Mirai)", "value": "f59eee345dab8e7216d4a57b52785ad084329d971bfc8efcd99fe5843c199af0788623757b6e5090bef13a911b7e58ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "70a636c8-3903-4e42-8ac4-d70fb62f2119", "value": "T1DB93C604ED505737C2D23BFAF79A42CE77351F986B97334196283AF42BE5B982939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "8cc640b7-6e8a-4236-a5de-b42330da374c", "value": "1536:tqP2HwbRuW1i4sB9xQMOvA9dHB1WoAgqWhQfa34iBVf0RAA7WkP3rQ6+uRAFkqXu:DwbRuW1i4sB9xQMOvA9dHB1WoAgqWhQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653673804, "uuid": "3d427224-1ddd-45b6-b48a-4c6667bcad91", "value": 95129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653673804, "uuid": "31c18222-adb9-4176-8275-30bd63f48ad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653673804, "uuid": "198dc84f-db16-465b-87ca-57fc2c848fe8", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbc0ba9-dd95-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653639550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653639550, "uuid": "38842535-b225-46c1-a559-7b6a8a808650", "comment": "Malware payload (Formbook)", "value": "aac47b26622b7b112abb2cf4545409b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653639550, "uuid": "ec0313bc-6773-41a8-802b-507fceb07caf", "comment": "Malware payload (Formbook)", "value": "f46d6d7bf1c9f466498c2a11c9c96fcc594c3490db04e763f81e7552f7ae6764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653639550, "uuid": "f6cf70a8-2e6c-48fe-9172-e336df65caea", "comment": "Malware payload (Formbook)", "value": "a1878da3ea31f946527897a759ffb1c9393fe426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653639550, "uuid": "043e84f5-ca96-4e1e-8f29-d19dce48f9d8", "comment": "Malware payload (Formbook)", "value": "9f69757d6308ab41cc3fdfde9b889a1c786b46526e69c24da1b44de6f7a226c2ee78e6675420bc099e82f3849e2f3845", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653639550, "uuid": "ca7b5e78-de78-48a9-96e1-f15798cdabcd", "value": "T17264E01523EE7093ECC9C8B45E85C6B54A6FBF124C359087628C6AE9DD3F1AB80913D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653639550, "uuid": "f81341eb-7657-405c-821e-ffd602bf13ff", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653639550, "uuid": "b6986c90-370c-4b51-879c-b3aeba85d1aa", "value": "6144:T0YnOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOy:lOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653639550, "uuid": "5815c51f-3b54-4902-8dbc-c02b972b8e6c", "value": 330741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653639550, "uuid": "cd0ae9a6-6e12-4517-93e3-4d8e732b9d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653639550, "uuid": "e8c98c5b-c65a-4593-9273-962cea34a916", "value": "Swift Copy 05272022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2c62c4-dddb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653669587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669587, "uuid": "ab286db3-575b-48e0-bcd6-89508ea537c3", "comment": "Malware payload (AgentTesla)", "value": "d773da82f041dd37630e773240a97878", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669587, "uuid": "27527e38-5fca-4bcb-80bb-d30ef5c7fe0f", "comment": "Malware payload (AgentTesla)", "value": "f59af126d04f289707903724c3bfb87e50404154b89665b8f669649e3c24a503", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669587, "uuid": "d2cdcf84-5b6d-472a-9225-ed8d49c576b6", "comment": "Malware payload (AgentTesla)", "value": "1eb7d229a442c4c49a9e3d7994e72d2062f8be59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653669587, "uuid": "d13e8cc5-4ab6-40a9-bd21-600fa3c59792", "comment": "Malware payload (AgentTesla)", "value": "d351e7e0242e3c14c6ddccb0fed07ca3a6dbecc32adc42cd5ef187f1a9bf144f12d656bb2799f0e28bcb340bc21dd7a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669587, "uuid": "291f3fce-f272-46fa-ad61-0009b3fc1f0b", "value": "T10905E02876662F03C1A942F6C1DBA42803F15443A573D7C76FC631CA2B16BE95DC9B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669587, "uuid": "eb6db4ad-57b2-490b-a45d-8b9f9be4eeee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669587, "uuid": "091b0f34-adb7-4f09-b33e-0dcdb997f1b6", "value": "12288:IGPCzjEkC/cVfzktmrfGwVlT9CNPXLGL56D+sG7YFk9t08RNdHi5ug2PG:I2e6YGcdhcLGVDieG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653669587, "uuid": "1dace67b-e972-4cff-9dd9-9176fa7726f7", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653669587, "uuid": "6c7fb47e-e49e-451b-9f30-67059f39163f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653669587, "uuid": "4b904e87-58a0-42f4-90a8-b3064332f22d", "value": "SecuriteInfo.com.Heur.MSIL.Bladabindi.1.9100.12211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7eafd4-ddce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653663808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663808, "uuid": "5279a360-5197-4dc0-9584-63fddfce3de8", "comment": "Malware payload (Smoke Loader)", "value": "754ec19dd74855ff2e72e82fc0e0f118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663808, "uuid": "752030d6-a41c-4b20-b04d-b5a62c68157a", "comment": "Malware payload (Smoke Loader)", "value": "f5c4fbae15ef575faf0fc5680eaf3f676515665528df8ef865b42f9a788d23cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663808, "uuid": "99d2f42e-e0da-4a28-aa77-4bbd51fe4562", "comment": "Malware payload (Smoke Loader)", "value": "af70237513780312bd4b0a5d0bf14ab1a3b073f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653663808, "uuid": "0b474c65-c076-4677-95d8-53bb4ba653b5", "comment": "Malware payload (Smoke Loader)", "value": "9c82fc379dcd26ebf40f21d78adb1d931bc5e70bf5b894bd17e7a89fdca9dbe0f5aac866f6dbba5d701394ce1d093c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663808, "uuid": "e7596454-1daf-4021-ac41-823d9a8cf215", "value": "T10115BF22AEE188F6D7331A7D4CF652D75837BD8029E854CE37E41F8C4E297312B552A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663808, "uuid": "15aafa77-707e-423a-9b7b-660e95484e3f", "value": "12716ad638dd0616e73288078db7ab13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663808, "uuid": "8432892f-7459-45f2-b40b-f1fd256b24ac", "value": "12288:Tuu7KJtnhtGouNVsnmuW68zssmgdTiqENQWNa3zJkqw8C4To5FHzTG6ubZLINFJH:iLJJrGolDaR3dTSNSNC4T4Hz4sNFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653663808, "uuid": "324cc8f1-16a2-4152-a745-836f9b3048dc", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653663808, "uuid": "5c6a8d26-9ef9-4aea-a3ae-752d8b059ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653663808, "uuid": "40dac0d7-fc71-4b41-8598-b957efabf06b", "value": "754ec19dd74855ff2e72e82fc0e0f118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7efae92-ddd5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1653667159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667159, "uuid": "dec034f6-58e4-48c5-85cb-1f70922265e5", "comment": "Malware payload (Formbook)", "value": "5d8d3441e200c7b280309351a4789365", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667159, "uuid": "52c502f5-da09-4b5f-b82c-3c56a16cc2a7", "comment": "Malware payload (Formbook)", "value": "f6b976e82b1b830539413b6356f8f2d61432bc2f59d5dfa2833bcab6ed4b3885", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667159, "uuid": "90eb1bb9-1665-4cb3-b220-a4f586c4585f", "comment": "Malware payload (Formbook)", "value": "6300c6ea308cfa245bd4ea8f3af6b7b6c439fbd5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653667159, "uuid": "6b6d6e1e-f29b-48d0-8bc9-33323a32b2b3", "comment": "Malware payload (Formbook)", "value": "212ae078ed020b75cc696b56f16bccdd722d3e39d783c7f3ad1b4ea6a5c0c09574620050bd375175698293a6358785b6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667159, "uuid": "5abed90b-276b-4de1-bd61-528f2ed03023", "value": "T107A4E0E6E78048A5ED5207B548378C3A6293BE7DBCB0A60E765D78716F733D3006264B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667159, "uuid": "87136ca4-ddd7-4c0f-901a-630001070705", "value": "6144:y0YOG0SkOr1KCHtyOBumZ1JP0iMiBrOMSO0r28Wp+9mlTC39cm2HO7r:V9+gOYU1Nr+VrfW4JH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653667159, "uuid": "57526cb7-d12e-4387-b39d-302a0fd16ed9", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653667159, "uuid": "43a8c4da-4d4f-4fc0-8f34-fa887594977b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653667159, "uuid": "016d7060-2b96-4415-a00e-6260d0dec551", "value": "600000sqm_pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9048e3ad-ddc2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653658825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658825, "uuid": "b8aa4bcf-71cd-4463-acf2-b1c59306156e", "comment": "Malware payload", "value": "7dbabde507a9156c3d4c8f89792337da", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658825, "uuid": "6ce18d0d-0c6c-4a23-b939-99fc7586bce0", "comment": "Malware payload", "value": "f6eb904345c85830388c3572067b28e06ca4047f2eb7fd1f52a985a502d658f1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658825, "uuid": "9c967388-0319-403c-bc51-2033023d5257", "comment": "Malware payload", "value": "98e0598707041a06ab6c6f88db2c0e90a44bc702", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653658825, "uuid": "9902e4f6-edea-4d51-8430-ae3e3bc93982", "comment": "Malware payload", "value": "4da7687e1b51f3d0f126c047bf86ee73104516bf61f0458594066478a181e3be9dc78b0369ef0bda76aa13fd96084ff9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658825, "uuid": "5bf89fe2-8d67-4327-91d7-72410bb51233", "value": "T1A261956273B5C1E6993210F2440A8017E0FAC33725796884F2EDC287FF75690A89DF7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658825, "uuid": "f8d1ea9e-3795-4a9f-a29a-9b755e23d8d6", "value": "96:DTDCf5rkJc5e70NJHrUMnVJO8t6W1MG1MGlM6xlsrkOO5j:yVksLFnVJOmzeGeGu4l+kx5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653658825, "uuid": "146bfafa-c937-4acb-961a-ebe8b51c85ee", "value": 3460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653658825, "uuid": "803025b0-638c-428e-9f17-ba7c334d8162", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653658825, "uuid": "0a3dfd4a-6309-475c-a5a8-3b7926e5c4c9", "value": "download.dat.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3406aa1-dd8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653635745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635745, "uuid": "af332939-90fd-46e0-bd84-54813cfe0f4b", "comment": "Malware payload (RemcosRAT)", "value": "93d57a3c36ed814a8c6d3b29248fa702", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635745, "uuid": "58d8b0e0-d386-415a-adb9-a471e675f2b2", "comment": "Malware payload (RemcosRAT)", "value": "f839895e6200b830c6a35d9c9ae37bf128328967530f9278f45fd5195f9d3137", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635745, "uuid": "76dbad75-c14e-4612-8775-e78d2ac27953", "comment": "Malware payload (RemcosRAT)", "value": "ef5edeaf7508642283c29573fd7ca8c16637f8e6", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635745, "uuid": "fc3f6a15-1e8a-42c4-9f72-27e5d2f7c6d4", "comment": "Malware payload (RemcosRAT)", "value": "37bc0478c36d698f31dcbe556005cd47b6c867f0baaaf9b4fa5576a8b0f7da98b9b234a215ef8e532a35a9fca1295971", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635745, "uuid": "272f4bc5-a45a-4fab-b8f9-4ca62d4e69d1", "value": "T1BFD42356A2C417D03408B84D2A67A90F2266FEBE669C1EFC1F9F9C17051735B8F909BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635745, "uuid": "5293686b-7826-4889-86c3-74704fb07197", "value": "12288:5ZwUdn7/V5RRq6rzfObrNED85h9gYd6++79+fTfMPVTATuL88jnO/cn:bJbV5RRqECN3T7dtu4fMPKTcnIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653635745, "uuid": "0c7068da-4b5c-4b5d-9dee-9ed0cb4d42a4", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653635745, "uuid": "e9d81315-fbd1-42dc-9abd-ce2455a85ab0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635745, "uuid": "bcd8f534-fbe7-4c8d-af54-8cc66df84978", "value": "HBL+MBL SHPIING DOCS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580f358a-dd8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653635538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635538, "uuid": "2a6a11de-e4b1-4efc-8607-9c38088269b6", "comment": "Malware payload (AgentTesla)", "value": "7c1c5de98510b38b6ed9abf44deefb63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635538, "uuid": "fd8a0b16-fd60-41c6-808f-047d20c77164", "comment": "Malware payload (AgentTesla)", "value": "f94748a66884d8a8ce8796fd42653606f0ebdff58cca467d3e0aecc8d5f8fd66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635538, "uuid": "5275543b-d616-4f10-8506-c5429ee46513", "comment": "Malware payload (AgentTesla)", "value": "553f3671c5a0b43716efe042edd22083e463824f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653635538, "uuid": "df8d84fb-c04c-4fdd-8981-4ce0acfab0e9", "comment": "Malware payload (AgentTesla)", "value": "6c83fb8c794baa57ffd1096a65f265381c9a222824816eef3320507ff0dfc5560a84c35d8c78ab56f240887ac4e7444d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635538, "uuid": "be03e733-e2d4-4b4d-9686-48af8efed692", "value": "T189942337C22B4657BB47465D1396A6CF04A712FD83F0491902FE478346B47E99892F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635538, "uuid": "cf78abc4-1b01-48c4-a983-c70412446725", "value": "6144:pdeEctlo4ixiWcT3F23KzHPovP7d4CuY+QgydLSdsPaxZkA65yyh:XEBiYWcT3F2mHPQhb3gydLS2iZFKRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653635538, "uuid": "6b1bf181-fe56-4f7f-9f0b-344e77e0c057", "value": 410856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653635538, "uuid": "c66cc564-3017-490d-87a3-79601171a374", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653635538, "uuid": "53d4dfbd-5a70-4712-989c-7555d16496f1", "value": "bank details.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633dc834-dda1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1653644576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644576, "uuid": "c2c795b1-8900-419c-9790-f8507f976250", "comment": "Malware payload (AsyncRAT)", "value": "0673e4480bbe1f18683da4e91dc443c0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644576, "uuid": "b98ff9eb-e7bc-488b-a685-f0adda3ffb25", "comment": "Malware payload (AsyncRAT)", "value": "fae5eeca675ddb88fe1a48717f6c01a12bc75c245ba8a9cecc72f0e6dcc3c92c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644576, "uuid": "83420fbe-066a-49ce-bf7e-ea4e7d9a6800", "comment": "Malware payload (AsyncRAT)", "value": "cd5dc7f9485319a7af80522ae1be95aa9b1d8b8b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653644576, "uuid": "61fe5a45-d2f6-4d13-8089-8223daadbd48", "comment": "Malware payload (AsyncRAT)", "value": "7754cedba78639acc71230ae37ce64f560d3aede4feca81f4c975ff7264c18817a4a3c88c0d32e51681372d74b559b64", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644576, "uuid": "0fd8388b-7c74-4e23-8b01-7f65373e16d2", "value": "T1DC524464AC4903102A770DAA590E409CE597236A7FB0BED07D8CF9D45841BDFF48EA97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644576, "uuid": "fe40192a-5bd6-44ef-b025-3ba952edf657", "value": "48:x9PFFGyepfiLryiJr7klPGZMDpbMdyCookle4e5AlupOcP2RnR+5Tafn3uSUiU6U:xxbMcaQfzr4M5GPAxhvpVjW1PL9l4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653644576, "uuid": "8049d9da-9965-4901-b083-6b2e4ec1c2c7", "value": 13607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653644576, "uuid": "edfdbbec-47f5-40f0-af6d-fd869c123777", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653644576, "uuid": "95f53f4b-e044-41b0-87d8-325175d4a7c7", "value": "Schedule Details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4316d5dd-ddeb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1653676305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676305, "uuid": "46bc5ad5-9f50-4f31-a761-9a50c0b1eaa2", "comment": "Malware payload (AgentTesla)", "value": "adec785f7cbaa5af9c8c7fa50cf91baa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676305, "uuid": "bfd3fb87-e497-44b4-8c60-c7773345bbdb", "comment": "Malware payload (AgentTesla)", "value": "fb6eb7efdf26e5f8eaab963dab6a7fb808724a4288d4df1fb8f146e13471e53d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676305, "uuid": "2afb3bde-c5f9-4cd9-9e88-69865c0e7354", "comment": "Malware payload (AgentTesla)", "value": "d55fc2f774a1728526a753284e350aea08e3b17d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653676305, "uuid": "adf24633-4fc0-404c-8420-13ef5fadafb6", "comment": "Malware payload (AgentTesla)", "value": "90f28ce8acc85be944c89c88596310bb93f869d4cb3994152ba89b5ac0193a1220f5a81dd203ce15687efecaaefa0bf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676305, "uuid": "582957cc-5e4b-4ba6-b723-e08d9b16b62a", "value": "T1B715C02876574E01C09D0BFE84C3642407E99E867865FB839D45BAD22B727D85FCBB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676305, "uuid": "0140d957-27fa-44a3-9e04-99ac6844c4f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676305, "uuid": "216e6038-8015-4c26-af5b-d08cd1e6cbaf", "value": "12288:j0pGjZ16ryOpqfE5Cg0iAgCBBKWcZL/Z7W3bFqrdlBgo0iVSJj1sGVJt1q0j:gpGjmpaE4gN2BXcZR7+IrFgRj1bVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653676305, "uuid": "9275db92-cc03-4818-8a37-947c611f9128", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653676305, "uuid": "10103826-d659-4224-ae5e-39277186dba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653676305, "uuid": "f6678253-9746-4f34-a543-22a9f490aede", "value": "SecuriteInfo.com.W32.AIDetectNet.01.20229.6203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce196eb0-dd5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1653615120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615120, "uuid": "1344621f-2321-44d8-9610-8433aeeb0bd6", "comment": "Malware payload (Heodo)", "value": "ca0c60af6bd18ef5b092c134cdfeb440", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615120, "uuid": "948c0278-fb82-4c5d-a279-f9f8bc2609de", "comment": "Malware payload (Heodo)", "value": "fc2b495c31d0e056fd8458ffcf8347e1e07b8cec74c5fb76b1d600ee430eda7b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615120, "uuid": "abccf80a-c469-4110-815e-b54ad43dc817", "comment": "Malware payload (Heodo)", "value": "344ec09f4f15a5e660267592e78f2484efeed3c0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653615120, "uuid": "13a89c6c-a717-41e0-9857-37c337e821f8", "comment": "Malware payload (Heodo)", "value": "0ec880a710595298a8eb74780329655b714a4b53dab00dc5cf0e1d3e2b0d773dc6f96f50ab2710152239ba90055d9d72", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615120, "uuid": "459b7649-4c6e-4776-bd4b-e399230ddf20", "value": "T16FE49D01F2AC80B2D06FD13989A34A4AE7B13C9497B593CB5251FB3A6F732E15D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615120, "uuid": "d9efa7e7-ed90-41b3-9007-d7eba5d14863", "value": "b7b90674fa6c5f9a16bdab0725f21bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615120, "uuid": "72b8e782-7a12-47ec-ae5a-5e51bfb2880f", "value": "12288:8nUIW4anSDGCH0fu1QJKw5be1gUK7wrnUfpE:kUITnGCH+u1QJKvCwrUfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653615120, "uuid": "8ac8532d-deab-44fa-a26c-0401d31c0825", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653615120, "uuid": "8e8702aa-b601-450c-902a-07eb16d1c34c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653615120, "uuid": "452361f1-e346-4ee3-b2c0-67a6abc4ee46", "value": "ca0c60af6bd18ef5b092c134cdfeb440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f2bebe-de05-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653687713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687713, "uuid": "8cb5eb06-4f8e-4d78-b3b6-75e2c0c3ab4f", "comment": "Malware payload (RedLineStealer)", "value": "ac442ef8fc44ebee5e316abe205ac7e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687713, "uuid": "ad519d8c-13dc-4418-a599-dd856b6f5750", "comment": "Malware payload (RedLineStealer)", "value": "fe18a2e3203038e39e9cb8937970e20d8647ffd400b192612f20f025a736b19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687713, "uuid": "29967323-87a4-43dc-b168-4083d2c6d473", "comment": "Malware payload (RedLineStealer)", "value": "3e0c2021758a9d8be6d0aa5875146c2e464e2248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653687713, "uuid": "b46ba5e9-1fde-4e04-b247-b8c6ed425f95", "comment": "Malware payload (RedLineStealer)", "value": "66c550d40389a659ee403afe1ce7f00ab654aae7e8061b912a62e2a65f62b21810e6573412f21bcd15e688da6b733098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687713, "uuid": "66ce1d2a-4e8b-4219-ba46-8ce267dc3377", "value": "T1B685D05B7E68D865D89358B54266EDA235B5BDB20F0FB8F75F89358B04330E0FB12902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687713, "uuid": "5ac15674-7e9d-48ea-9560-7f294743c5b4", "value": "37a87ba4c777dcd1db50684f6b029f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687713, "uuid": "52a8544d-97d9-4102-87de-68d4b9255551", "value": "49152:C+l9ylgWOEMUqD8xH6/6nW3kxHXMwng/2qKIqruKo:C+l9OgWOEMUqD8xH6/93kxHXMwnu2qKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653687713, "uuid": "7e0cea14-6349-4dcd-ba52-55bad61d4094", "value": 1760696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653687713, "uuid": "63d6a3da-f52f-4a87-8ebb-331393abb31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653687713, "uuid": "2b51d849-64ee-40e1-87fd-1ec615692a3f", "value": "ac442ef8fc44ebee5e316abe205ac7e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61deb6d4-ddea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1653675927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675927, "uuid": "0f6160a5-e587-4171-8516-46f281efc630", "comment": "Malware payload (Mirai)", "value": "214bc7a11120145241f962afdb35bab1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675927, "uuid": "51e15faa-1107-4c49-a81f-b45d92d645d5", "comment": "Malware payload (Mirai)", "value": "ff54b59b11d8a639c26411d069a74c6f9493bcff1226b0c7785f092c489fa7fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675927, "uuid": "4d83c77c-9d2c-49a8-9770-48b9cb1a58de", "comment": "Malware payload (Mirai)", "value": "bc997a8ce1456d17b56bbf3eede98a160d4b42f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653675927, "uuid": "a941e63b-8a4c-48fe-944e-d34d8d32074a", "comment": "Malware payload (Mirai)", "value": "7ab2dc6e8d9f2901ef639b31ebc001360cd18d0baf4b1fb146a35cf0636daf9ee99df290d31d5f2c8afb168e919ccebf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675927, "uuid": "1c1e94a7-70bb-494e-aeed-c793acd64054", "value": "T1FC03F224DB827D12CE705B35E616CB46E7F51AE4E4E9B37C2691E098E0C391E4D3530A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675927, "uuid": "21ad0353-4bf5-44ea-a0ff-3793f29895c1", "value": "768:kufCsecOTPyhmevGNpBJy2OZAXsGOjtoR5JwEzus3UozV:NCtcKBevGNpPy2OZAXsGKOR5JwuTzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653675927, "uuid": "0c7a0e4a-eedc-4109-aa2f-cdc78460c9c9", "value": 38440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653675927, "uuid": "6be1638d-7ee0-42a6-80ae-6fa8661ff962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653675927, "uuid": "4ac8b627-8ac5-437f-a8f2-8bfb658d9552", "value": "214bc7a11120145241f962afdb35bab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3d4a65-de0d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1653690817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690817, "uuid": "4f3d986b-1cb8-4ccf-8e85-9f9ef9784dca", "comment": "Malware payload", "value": "5599c93a7870ea2270452d6a39c69348", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690817, "uuid": "ebe6d9b6-6c5f-4477-8ae9-ab00fb71edd3", "comment": "Malware payload", "value": "ff6d5af8b24b7b230895ea480426cafbfddc0ebc1db440b741b2d740f7efd639", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690817, "uuid": "db32a094-3031-4a56-aba1-7748a4562626", "comment": "Malware payload", "value": "1b5e59fb283aba363dc3cda2221d9be1e4056b5a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653690817, "uuid": "cbcf8745-9576-464f-85a3-1b192a721c6f", "comment": "Malware payload", "value": "bf58e7b8062767859e2f2ea8fff14a92fe0b0fe49de96517a54d4cb7d0f9b5d7e0d007d39296a5cbb9ce155d289ce5ac", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690817, "uuid": "25b3cd09-3e34-4a6f-854c-10fbf97ce42a", "value": "T177634B59B76A885EE9198B3048F747D62323FD308F6F0A433259F3926FB9590670390B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690817, "uuid": "bea87b5b-3101-46c1-aa9f-11ddf9128f47", "value": "1536:OhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+4+hDcnTLiQrRTZws8EV:uKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653690817, "uuid": "a6f0140f-54fc-4052-b4f2-ed80691119b3", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653690817, "uuid": "e63ffe92-86db-4bd1-af3a-cb927ab29dc4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653690817, "uuid": "52b4e251-0503-44ea-b20f-a1771e664630", "value": "SecuriteInfo.com.Exploit.Siggen3.32798.32145.11943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8da85fc-ddbc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1653656424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656424, "uuid": "eec78fa3-ab78-4841-8111-a630a272f6e6", "comment": "Malware payload (Amadey)", "value": "a48835eb9808f95aabc57c88dcd92a58", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656424, "uuid": "0d123b86-fc6a-4c7f-9b36-8bb69bc03a83", "comment": "Malware payload (Amadey)", "value": "ffbad07fc76d01e1563c39da44266294f388a0fdbc3f11ccc6ea3f513747b33b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656424, "uuid": "792bdaa7-72b3-42a7-9f45-bea70a87edd0", "comment": "Malware payload (Amadey)", "value": "44404074dbbc5bf4009d9ac4abcd87a3ad1648bb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653656424, "uuid": "0f2c5102-6375-41fb-8377-07c76015193f", "comment": "Malware payload (Amadey)", "value": "cf9488f471763aeabdbdddee588d2cab24565459b949093d4541db2b7649535229dcf5e6a9e2e24cd9b589bdb73869e5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656424, "uuid": "aa1f9999-dbe0-4d07-a241-d0e74832cc8f", "value": "T180E512FE6F2791C6F308AAB5199A3DAD909655BCC28860B7B351367411CC3F892D9C33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656424, "uuid": "2957380f-2ebc-4531-bc41-e6436d3e091a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656424, "uuid": "37e09d80-88c6-47da-9098-0322981856cb", "value": "49152:eakukoWYOV3ORi2wii0VlI+OrAaUPUaEs63nCejTdoSZe1WO1HvbalGRXwkq9JOP:eVFYU3OgPElWAaUedxZe1WivbalxL7MP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653656424, "uuid": "b840c663-9a84-49f8-91ae-e3c6df194588", "value": 3026432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653656424, "uuid": "652df04b-a06f-4a8e-9799-d561a3d447dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653656424, "uuid": "10fb3620-2462-4ad2-b7fe-5a6be954d29c", "value": "a48835eb9808f95aabc57c88dcd92a58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }