{ "Event": { "published": true, "date": "2023-11-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-14", "timestamp": 1700006581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f9a0220c-6300-4684-83d3-d86276605d23", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428bc3df-82f1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699968321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968321, "uuid": "2bb1c61d-4e3f-4944-b964-7fd9e627c425", "comment": "Malware payload", "value": "c815422490c5475535fa3a10c258fb67", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968321, "uuid": "6c1607b8-32b7-4f4b-9524-92d29d794a44", "comment": "Malware payload", "value": "0259975a0674bd03f1293281ee6d4b01be43929f3d505b3f8d243332ab3b1cca", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968321, "uuid": "0ef266ed-12ea-463f-a121-1aea760cfea9", "comment": "Malware payload", "value": "761bf59af3cde6f54e60e6e6e494972681c84b7b", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968321, "uuid": "85af2327-0b14-49b7-97e1-34b0d29dd9d5", "comment": "Malware payload", "value": "c49225fae28e629e961e0556a6ceb8ac1be5223bc0b665cfdec3f81f6aeaa778e96e43f075a164c9d8954ae23f3e66c2", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968321, "uuid": "5e668070-4000-4fb4-a0bc-8a5babfd5f76", "value": "T1C861AD932151B8EA414287BF398966FA807FC224954AA444F78C4F99F9DDE63398D2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968321, "uuid": "a7d20715-b5b1-42e6-a3c5-67e66165aac1", "value": "48:e+MTLimb7CQ2CHuKZ3WFNgQfBZL0HuQHQhFi5QsvuiBrVxqT/smv4Y:FGtSQ2CHuS3WFNgQfBZL0HwmAiBrVM15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699968321, "uuid": "2d215fbb-4102-49ec-9269-fd9b11235b57", "value": 3215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699968321, "uuid": "8a71c165-6bae-4750-ab81-18af9b295569", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968321, "uuid": "bce8fa53-95f4-4800-848a-c4b10588c86e", "value": "7zyFfu34.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441d3b8e-82b0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699940406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699940406, "uuid": "4f36a696-b2af-47a2-acf0-9a41220152f6", "comment": "Malware payload (Formbook)", "value": "c0392c789b89e8a4ec22b7e83af34944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699940406, "uuid": "3a714f64-a4e0-4a56-8a37-aa73b92e51bf", "comment": "Malware payload (Formbook)", "value": "03ff02d6d7a259734c8733614089ac81324a837102a6ae3484491cfe7eed975f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699940406, "uuid": "3d8677d0-dc51-424b-9c5b-4198f830e32e", "comment": "Malware payload (Formbook)", "value": "601a17250924a177e844dc28b61a338de20ed334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699940406, "uuid": "c0d62e75-6123-4d03-b18d-6e68017c6f8f", "comment": "Malware payload (Formbook)", "value": "67b5d3889ed48817b5bc5af87c503f8f8d367597283c9cefd022ca2ad07ab04478c267859629919a9a08995d455c3ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699940406, "uuid": "f1f25a14-2897-4659-b8e0-1b39e84a7d87", "value": "T10494121D76C58872EACA0776097A7F30D33E6C608836BA574391EE1FFA358CD86152D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699940406, "uuid": "a1c4da6d-cdbc-45da-abcc-7f299af13259", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699940406, "uuid": "4b854c1c-9667-4f4d-8ecc-28fb642cf870", "value": "6144:3BlL/j1tyLF9brD2YlcQxtCN9qo2ckEsQHMMKbqWsmmh1YjxgwcyrivP8p5Elb+b:xhHEXqRYU9b2TEVH+eX7JOeJSvqOS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699940406, "uuid": "2dfa8a6c-878a-408c-9bd6-47039485ca6f", "value": 423541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699940406, "uuid": "9fea89db-1d67-41d7-a299-e9b9714beaaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699940406, "uuid": "05a5778e-e7e4-4d78-9546-5557ed9882fb", "value": "VALVES INQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6d09f6-82b4-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699942222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699942222, "uuid": "3b8f6443-528f-4f54-a986-3496babef274", "comment": "Malware payload (Mirai)", "value": "d4bc13e225f0d5a05ad452ae66014874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699942222, "uuid": "63a6e9b1-ea43-4409-a909-5f43456f5ccc", "comment": "Malware payload (Mirai)", "value": "0433abed1161da8a9c18a8855f9a65d9dd2ce66392107e989e058e510033f26e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699942222, "uuid": "383fadb5-e4ec-43bf-a561-25f7d17b46a6", "comment": "Malware payload (Mirai)", "value": "a7e07cf7531864f193a32794e48c8978dc905529", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699942222, "uuid": "61375373-7518-468c-8917-6a249e399665", "comment": "Malware payload (Mirai)", "value": "dfaae5935730389f9c4b07118024429a849d0895f03914b793d402967502875b84f16f10d45f29820958de30b89855ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699942222, "uuid": "0b4d8d9f-afdd-4fd6-8699-a7dbb2592449", "value": "T1CCE2F10602E6480EE7B140BF419D39F52D75B1180D8B7F33BEFC6A637AB60959734A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699942222, "uuid": "1ac213ff-9c66-434b-90df-393920f24705", "value": "768:CevYysB+Aacd3vuOuOK/kqLfJ99qsulDlvVO4sMIOj6xTlnHYIF:CewyzAaM/uT/VmFgBR4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699942222, "uuid": "893bcad0-d2a3-4e00-ae3f-bdcd70e8982c", "value": 33048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699942222, "uuid": "fe739f71-b112-46da-a483-ee2f188bdc8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699942222, "uuid": "3ef8cdd6-4117-459f-b066-895108ac8f6c", "value": "d4bc13e225f0d5a05ad452ae66014874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90b45a0-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982693, "uuid": "d0e4173e-c65c-4e93-a475-9ab9e04ed701", "comment": "Malware payload", "value": "a52c40360d948127f1f9a40b239b2a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982693, "uuid": "77a486b5-1db1-46eb-8d48-40091b911b7a", "comment": "Malware payload", "value": "044058594de29392ad9bb466f082e9f276a19c7ebe6718f15be2075fd4351d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982693, "uuid": "a032036b-3b99-4f17-b00b-8f1425366bfa", "comment": "Malware payload", "value": "e5258cf81314fccf920998358311bf85cfadfb73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982693, "uuid": "ed8959da-07ac-473c-ba2d-2e8ee05291a4", "comment": "Malware payload", "value": "7823717fd3fd4b9d240dedcdf9bbeba8e51c528d3a3175e79d30e2b2ac7bd6d1a3a8c67950f9f673f072986c20ca0777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982693, "uuid": "30131c89-61db-4ae0-b191-1862aa77cc98", "value": "T125158E31B9E250B5C61955B0586B5F3AEA7BAF038B158FC3A364FF591D332806E23217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982693, "uuid": "e32d7aaa-0c42-4818-bf05-bbf61ce56af6", "value": "42341776ba18a71c737fdf750925de3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982693, "uuid": "19818a44-b467-4606-87fd-5097d84ebc79", "value": "12288:IpuMDNYJIiTdnQ3OcCH/dU9Tsy/m0/UiMDqn+l0/UiMDi:IRWIQdQ3OcCfdeH2jqcji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982693, "uuid": "72b8d227-8cac-404b-85d2-1818d2c81dbc", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982693, "uuid": "25713642-015f-4826-9cc0-1d7b93ea13e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982693, "uuid": "14e0f08a-8c4f-41f9-b933-4ba8c216cb1f", "value": "SecuriteInfo.com.FileRepMalware.22227.17134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac284087-8302-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699975799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975799, "uuid": "01de60b0-2a6f-4a94-8946-10e8d27bc760", "comment": "Malware payload (AgentTesla)", "value": "15a20641e58ddf1606e87998f4113a41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975799, "uuid": "7ec01f9c-d5a2-4bef-bf68-ca5c6feb4b1d", "comment": "Malware payload (AgentTesla)", "value": "047575bd81b3dc7b788d1f33b92ccd8e42804e7bb9b578246a1284d0e565a6b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975799, "uuid": "48746169-01a3-41d2-91ee-6daa27a9337f", "comment": "Malware payload (AgentTesla)", "value": "3ba642295b135dd7d2e741d0153810e67b27dbd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975799, "uuid": "49349bee-61a8-438d-9eab-82abe1df7649", "comment": "Malware payload (AgentTesla)", "value": "fada1c308b26aa597592e881817ce5c4d8e4580e77f4853872643b62a745648d77c07bd5f0c8d90a8fc8ef5d579c45c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975799, "uuid": "477cb021-03db-4a0b-9b97-a02444ceb27d", "value": "T103F4022632684923C27E12B1642610A51BF2FE13E551E39D4DEB3BED1BF6B9183017E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975799, "uuid": "f86821fb-203f-4b58-b67d-90df76ebace3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975799, "uuid": "f58d4b5b-2256-43f2-927a-c55f3158ebd3", "value": "12288:XJX4QtLaBlPCKjsQzWXGxFCXQQGPMER3jmIyvc9KTqDGkRtRlXXI8Jg+a4o+HAok:GMTXVE53yvEiYTXJg0pAol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699975799, "uuid": "049a91a6-d1c7-48cc-bfea-679e05ec0b7c", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699975799, "uuid": "285c5133-8aec-48b9-a261-874010644810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975799, "uuid": "15e2601d-3ffc-4455-bb68-a5ea61e02d33", "value": "SecuriteInfo.com.Win32.PWSX-gen.5587.31902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8e3b5d-82d3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699955509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955509, "uuid": "bc14b100-4837-4434-bc24-0abbdf246da8", "comment": "Malware payload (AgentTesla)", "value": "83646c55f7fb048e5c3fc6ff80c07034", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955509, "uuid": "1ac38a26-d22d-4e0b-831a-58f91698cd33", "comment": "Malware payload (AgentTesla)", "value": "04a69ab46c2e8bbdb13a2da0516d6caad98637405e6f7c580c18cd46b3b8094f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955509, "uuid": "05a7f2ad-b5bb-4d93-86dd-120a03be7b72", "comment": "Malware payload (AgentTesla)", "value": "98fb5bc71d73f8d5a0c072760d2e3af1760d0500", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955509, "uuid": "d35999c7-d28a-4e43-9866-1c985a98f0ad", "comment": "Malware payload (AgentTesla)", "value": "19a47e7163766525b23c62eeb98e29b06928e84f997550e0a1c1b6846f3104447278db9c126584b9d2237e81bed59281", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955509, "uuid": "40c0ec78-c129-419b-a1d2-755e86ec5fbd", "value": "T1EAD4239C751BD0C4BE73CD3897BA0B3D11C490A1D272482DAAB3C6B3DB965B219BD1B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955509, "uuid": "bfdc72e2-dea3-48d6-bb7d-6fe75c025fef", "value": "12288:bWkmTbv5vkFfDAaLHTkqszZXR0aLqq52psyhRf2Y0iLN:6TbOFf0aLHgzxRyq53yhReBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699955509, "uuid": "163adff8-604a-412c-941b-b0dfe2626494", "value": 633384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699955509, "uuid": "6b88739b-a34c-44fa-a540-cf31e3a3d591", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955509, "uuid": "ac9d65e9-edbe-45d0-a59f-0f756ec93430", "value": "payment confirmation\u202efdp.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc3ddcc-82f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699971802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971802, "uuid": "bd95f346-2b94-4c65-b890-866fa9e1bcfb", "comment": "Malware payload", "value": "0d66d350365b5dbf9a587b31b052defa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971802, "uuid": "a9fa2a3a-db80-482b-bf89-c5262ad93758", "comment": "Malware payload", "value": "0552f23284ed52e84060cdc66d242f9258bbe0555eab899355b9d848bbf70605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971802, "uuid": "2a849f73-6fc9-45e8-b6a5-417765aea7f4", "comment": "Malware payload", "value": "340e95b5c4cc66c1de7ae69cab5f8c6044cd5e12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971802, "uuid": "d9aeb780-d4f1-4740-b705-60ef6958e7d9", "comment": "Malware payload", "value": "4f3359f7882e709d031695892470f9406de29d3297bb061efd2b745dd1fc4b2c0efad564b43ace0fada40689754e51a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971802, "uuid": "cefa1753-7de7-4adf-a3ad-924bd3ccf417", "value": "T1AC14BF21B6E1C072F12345304A72C6716A27BCB28FA5D5CF2FD42AAE0E316D1DB79716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971802, "uuid": "9d9de81d-e77e-479e-b242-5eac924d2b5b", "value": "a7abf36a6b659d49138cb3d2e8a5f744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971802, "uuid": "b49e6d49-565c-4b82-bacd-13e58281c14d", "value": "3072:d+0HYeO0w76p8WiayDKwGJllF0nXH6mpCxic7LHaP0+PMH71uqc:seXO88BasKw+llF0DpuiCHO0+PMBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699971802, "uuid": "ec31933d-6371-430c-b159-63177f47acf8", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699971802, "uuid": "bcdc9a61-e62f-4acc-bd6e-7a0a9ed6f062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971802, "uuid": "8bb950ab-7087-43f6-aa74-f8ed7ce8c052", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde58977-82dc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699959508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699959508, "uuid": "fde4887d-a10e-4a89-af87-6ccb38e9d0c6", "comment": "Malware payload (AgentTesla)", "value": "df841f3d3d880591ed48f20ea7a09e8a", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699959508, "uuid": "a4de5449-3baf-4d82-ad8a-19b8549f67ae", "comment": "Malware payload (AgentTesla)", "value": "0598d24987b6a7a5421e7e34589b81a5f2ff9e8e1f176569d0f4d33783e93f57", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699959508, "uuid": "d32ae442-fcb4-43db-8069-9714840af57b", "comment": "Malware payload (AgentTesla)", "value": "387f8480f71033e19c3321cda204e0913c398897", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699959508, "uuid": "6600bd51-4cb2-48d7-b106-e3ecb66cb78a", "comment": "Malware payload (AgentTesla)", "value": "657ce5964792aa55045897bd1b6bff5b5f041b8f4a7080fd1abfe04c79c41008034957cf2f5b08743e68b44c038132b8", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699959508, "uuid": "2de094b1-6c7a-4340-b3f1-c01e82133885", "value": "T1505523B0E5E80549AA17F5E360A87378B872F31D3723F5BCAD94E85C7A93D460C886C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699959508, "uuid": "30004a30-b895-4420-86c9-f0f2e5f8432a", "value": "24576:WrplPNrnuKP7Tk5csnI5IJJ/WzJdsfCrplPNrnuKP7Tk5csnI5IJJ/WzJdsf+:ElP5u2/snNbUsolP5u2/snNbUsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699959508, "uuid": "197967d2-a1e8-446b-a39e-b2c95a28a662", "value": 1308638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699959508, "uuid": "5860272f-cc69-41ca-b98d-60e4b6dd7a78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699959508, "uuid": "dab8698e-fb60-484b-85d7-70491c4a7993", "value": "Wire Transfer & new doc 2023-11-13.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edfa344-82cd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699952799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952799, "uuid": "d02eba6d-d1b6-4252-8b3e-ce29c1329504", "comment": "Malware payload", "value": "1418cb4b22c17874118882a905fe3261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952799, "uuid": "60dd00fb-f61c-45b0-b778-ad9fb42ad9a5", "comment": "Malware payload", "value": "07df78604d9da2c127e1ab1b9dcf77cece0d2ba536746a7615c65d6689debeb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952799, "uuid": "dcfa9033-4ead-4b4f-b125-e379451b16ff", "comment": "Malware payload", "value": "206351bd9083c7401a7c839d7e2ec26347271007", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952799, "uuid": "f385633b-4476-483a-8307-68a1c9f3ae78", "comment": "Malware payload", "value": "7303b41f4adf8e53b04ff4ce684a51af8c9cd9c6dc153fddc5552f7623870cf446344cdb569a6e46fd1b97423e997c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952799, "uuid": "7c0a5adc-9638-464c-93c5-3977e6e2b429", "value": "T10924C46AE344551DE83E433DB41C38B09E70BC52E16FD32E55BA3EED693BB098A105D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952799, "uuid": "9bfbd8f1-56c5-4379-a951-c6eba99ec8d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952799, "uuid": "086903b0-95ad-409e-8359-39dd103fede2", "value": "6144:S+DXgP71Ngcthrfu8k0LO1SolmOiC1da:S+LuNgcthr/kzlmOiC1da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699952799, "uuid": "74630834-0827-434d-9949-520aa41cf8a7", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699952799, "uuid": "c9ed088d-3cb0-4030-be96-d3031faf3fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952799, "uuid": "440ab636-a68f-4ac3-b1af-7cdff4f524de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ec442a-82e2-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1699962041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962041, "uuid": "9eb7fc48-3f9e-475b-a6bc-b613a267a583", "comment": "Malware payload (DCRat)", "value": "1a030d2d68a966877a377cf8c888115c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962041, "uuid": "88e20acc-dd8d-4dc7-94d9-7ae1c4e86ba9", "comment": "Malware payload (DCRat)", "value": "07fa9ac4502b2a0ba83036450abbe28d6656c8941abf5180e81650550aa50a4e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962041, "uuid": "3aaa3dff-00d0-4135-8a90-8eb53c3b3e86", "comment": "Malware payload (DCRat)", "value": "b0d0fe9953ca03954fe6951d3fda35b08a045359", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962041, "uuid": "877c2b9d-2802-4370-876e-d1477829fac4", "comment": "Malware payload (DCRat)", "value": "9fda50cb74665ba6c9adb26679b05674f98ac5b160abbfe25b3d5609a14ee6fe9cecc34e9552c375196de4d3c6c49fc7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962041, "uuid": "cfde300c-9587-4ca1-a2ff-17f139f03739", "value": "T12F4549027F44DA11F0191633C2FF450487B4AC50AAA6E72B7EB9376E55123A77C4DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962041, "uuid": "472cbe50-9334-4d64-b940-38796b4e0aff", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962041, "uuid": "f2cbab58-339c-4a02-82f4-115fa7c78241", "value": "24576:U2G/nvxW3Ww0tKUVvRF5tWgTkvP0fA7HD56:UbA30KUVv+gwvsfA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699962041, "uuid": "71933148-10d9-42af-99fc-f914243b8481", "value": 1165964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699962041, "uuid": "6787b48f-feee-409e-bf56-0c73ab76d883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962041, "uuid": "cd75214f-0d3b-45ef-a7b0-8d2147cf64f1", "value": "1a030d2d68a966877a377cf8c888115c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69f56f9-82d7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699957456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957456, "uuid": "a0db078b-99af-4d58-8fcc-aee3aa2a8a96", "comment": "Malware payload (RedLineStealer)", "value": "570b7141e07c47c67ec73c85179d1ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957456, "uuid": "b8c16444-0542-44dd-ac27-ed44dd7a7feb", "comment": "Malware payload (RedLineStealer)", "value": "0965997e1ccaef06f3bb54b93e0e7b3723bb9d99a0944f5550dc5c69cc9c42b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957456, "uuid": "66e313ed-c934-4323-8910-3b9e7d4e6a0e", "comment": "Malware payload (RedLineStealer)", "value": "88eff7c36c0882fcec895c7fcdd348c7993f36f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957456, "uuid": "e37fee2d-eaf2-484f-b013-9014fed8efb6", "comment": "Malware payload (RedLineStealer)", "value": "9eb9d82d9587edc0d9b35e90f0045ec78d9331aa800a475b6800c719701b350bc88848c4c81de8f8c9a6548676873c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957456, "uuid": "487fc471-255a-4026-8c70-88203f39f31d", "value": "T145E4E124F4D19473C97A043204E1AE79796EA8711F86D8AB1FEC0E1E4F283D16D7662F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957456, "uuid": "d3106703-be33-400c-9044-0d727d4f4a76", "value": "321e5e3951fac38d82c138eb99f56618", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957456, "uuid": "bee09ee3-6514-4982-933f-0bf9b5e0f9fd", "value": "6144:o6Jji2ssGJsERP1wfAO6e7Zo2ToApdM3wVEJ7AGsmzOcnVEY72WIdAUh3LU66JEB:jjiOEwfm8dIwVEJUITnpKvLrTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699957456, "uuid": "d6f2837e-5caa-4fa0-8bdc-32e7f84b1210", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699957456, "uuid": "4393736d-2dee-4392-bfb3-eb8bf900551e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957456, "uuid": "238b706c-5433-4f63-82d1-f85b81aa4647", "value": "SecuriteInfo.com.Win32.CrypterX-gen.8926.894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07c375c-8333-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699996879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996879, "uuid": "2828bbec-fd17-4125-a26a-d1745eaee673", "comment": "Malware payload", "value": "c2ca9289d96aff9a0ccfcc41c25cd0f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996879, "uuid": "71186c47-77ec-4229-872d-b1d447bb42d4", "comment": "Malware payload", "value": "0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996879, "uuid": "8e92c3e6-d735-428b-a4ff-804e5e6d6f01", "comment": "Malware payload", "value": "d8c956b87accabd4079f08908712c03a40f21644", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996879, "uuid": "ce3778f2-97e4-4b1c-bd6d-ca990e396f01", "comment": "Malware payload", "value": "c641c9bd4bf9dbd7fa9e95a1780b6c29fe3fdeac4cb8e09a16cc356874926a4a96c2c559ff8338f273f59437ce89c7c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996879, "uuid": "5afc9615-79af-4754-bce2-1d3174765a7e", "value": "T19A945C3F7BA1DC6BDAF1113702D6FB521537270102E38AEB6B901B18E562A9F0E7D521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996879, "uuid": "7502b0e2-b244-4d84-9b29-5d5fe42884dc", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996879, "uuid": "8fa8e442-5c50-4946-8913-66d931c00ca9", "value": "6144:wU5gUwlREXKMmn/P3dAOkXjjuJef8EFY5Abk8Tvrx1sgy3jU4DCH9:BgUKRE6Td2SJg48Cgy3e9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699996879, "uuid": "e3432966-4a37-401c-b179-1945c4793f53", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699996879, "uuid": "e2aaa9c4-0ed8-46dc-8d70-20facca22aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996879, "uuid": "944e3b5d-a372-470e-b54c-5f5d6aed863d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.2093.8621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0daac2c-82ce-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699953581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953581, "uuid": "ddb0f0f4-b92d-4abb-b90c-376a6588fd6e", "comment": "Malware payload (AgentTesla)", "value": "bbe458557807d462fc77c0714483f7fe", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953581, "uuid": "af0b5245-16da-4646-827c-f6b4cc819ed4", "comment": "Malware payload (AgentTesla)", "value": "0cd5170e76a77f05e8a6b02ee4177ef39aa0242057253aaeac822492a4a5830e", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953581, "uuid": "7e0e8e71-004c-4086-8f3a-0fa5c4beacb8", "comment": "Malware payload (AgentTesla)", "value": "e2d4aa618711500bc90107ae62053f9f51324687", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953581, "uuid": "9f9f7846-28c3-4972-88ff-9c06b7f3d4bd", "comment": "Malware payload (AgentTesla)", "value": "278afd2058f9e8739a71e2392b4799c5a41d88e7bb2234677b7337d43b54f30af4f49d5abdb00ef838e2747549b94882", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953581, "uuid": "1f2878a2-240e-4df7-8433-24e0ae00db47", "value": "T13CE4237DE4677C6405920A437758E795CDB599C7BCCADCE488863942ACF030D83A9EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953581, "uuid": "7b3097f8-0174-4099-bdff-6df4c4a84cb8", "value": "12288:2JV1h5vb3GVbmz0iMySUUJVBScaPdJS3guho5kQF4FYF70iT7/Ft4aI:gtVbqbmwiZiScsS3gVkQF4iF70iHoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953581, "uuid": "8250d981-b005-48b1-9f50-2441988f8586", "value": 702183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953581, "uuid": "23e42911-6292-4848-9b64-3775df31e4c0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953581, "uuid": "703dab2b-52bf-45cf-991c-5d88ded5e1a2", "value": "DATA.exe.gz.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b856d576-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982692, "uuid": "33c17786-77f7-4803-834e-ebd6fc72e071", "comment": "Malware payload", "value": "374298fcd7ecebd4283fe6a6b115dff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982692, "uuid": "70fb8f50-aba1-4f39-8c7e-ed161bdae8c0", "comment": "Malware payload", "value": "0f49b20d665b676b9747fb999382df30f011d8d70284898338b27b80cba3ff1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982692, "uuid": "517b49ad-0798-4e8e-89a8-f9c640c5870d", "comment": "Malware payload", "value": "ed825c35f052af9c19d460a58f89c25e0fd7595c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982692, "uuid": "ed4c5f7d-0c78-4a6d-87b5-3121203ba4b0", "comment": "Malware payload", "value": "37667096e25cf91068c6ef6d9b110271247c63bca84ed71e0611c6fbf766a7779d7fb273d303e422a1379cc3b5fdd489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982692, "uuid": "a220d8f2-55fc-4159-8066-545ebc25183f", "value": "T1CF356C32F2905476C1ABD6349D17BD6D4432FEC2DEE4A44A7BF43E8C6E36A407D21286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982692, "uuid": "5ca3a777-7b4f-4f60-926e-1828ea884edd", "value": "24576:SPD8LJcgxDG+RHh5NvG7gYOiLegxnXFe:SPs2go+Faha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982692, "uuid": "d2eaef07-b3b3-403f-98b2-f3e64127b37e", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982692, "uuid": "c904ee2c-f74a-406c-9afd-b6902f01c694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982692, "uuid": "cce5ff01-c776-4373-aabb-39b4d980d4e8", "value": "SecuriteInfo.com.BackDoor.Pigeon1.12841.16252.25262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961d8d4c-82e2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699962018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962018, "uuid": "e7c9430f-1cd1-417a-b1c6-5cafecab9fa9", "comment": "Malware payload (RedLineStealer)", "value": "fda7efe159818020483ea176cd15bcb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962018, "uuid": "c634e6c0-235c-416b-a161-b604b8440d5e", "comment": "Malware payload (RedLineStealer)", "value": "1114fd06909159c440fadc3bdb3ce6a5fc1c2ac3bcac48dc3a6b4402eb245fcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962018, "uuid": "4e29db5c-567b-4247-a596-cef200739039", "comment": "Malware payload (RedLineStealer)", "value": "6971a6a05b1f2b7c14ec31731c87d86285a0da47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962018, "uuid": "f5090504-3c70-43d2-81ac-49d5420d8c87", "comment": "Malware payload (RedLineStealer)", "value": "d599993a564de19e0bf65461e0b280b0ec12694fab970192e9709a62d9099caaa74e4c6a94c3e2eb1772046dac3d83de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962018, "uuid": "7e6b9d37-a87d-45bb-9324-48ddf22d1de0", "value": "T194452357E7D48676E8F0B7B028F206931B367C526C3A072B2B5A590E0D73AD0B479727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962018, "uuid": "fe406aa0-10b7-4fd0-a195-d7bd52cc6e26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962018, "uuid": "9273076e-0fe9-4fbf-920d-5e2f4c08f249", "value": "24576:ayK9Hsbp4uOqaRtBpXsQs9bedbzaPwZJkIH5lvdcwIB2WH64Uuqc:hesbK3tHe9bkrD9cNkWH6Hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699962018, "uuid": "1c2a8f74-138f-49d4-ace8-42815520aac7", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699962018, "uuid": "8dfade94-d6d1-45cd-b36d-936a1b822d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962018, "uuid": "71a5410c-beb4-4472-8a9c-5421e2c16228", "value": "fda7efe159818020483ea176cd15bcb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa83cf4-82d5-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1699956308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956308, "uuid": "5b069e19-70f6-4e80-b6da-46dae5f4ceaf", "comment": "Malware payload (RecordBreaker)", "value": "ebcb7a9dec526cd8b55b99d0f84fd347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956308, "uuid": "c8b679a8-513c-425e-bf91-f9c930e9b858", "comment": "Malware payload (RecordBreaker)", "value": "114e74be49ed1e1bc90c85a74aaf60fbc8d766d0e8755c100ffab51a43d71404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956308, "uuid": "9ffb4f6f-56ad-4c5f-990e-2ab01fd0661c", "comment": "Malware payload (RecordBreaker)", "value": "81f4eeef14e5ae84f7701c6bbce9eef242ef0d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956308, "uuid": "52f1c152-d3f3-4787-9432-5bb5e6d6f4b4", "comment": "Malware payload (RecordBreaker)", "value": "a03b5c8786d824f6c82f589ac67bb787d949f774dea8d44bee5a4046630bea493e1b7aa3c55727b717968ad37c121c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956308, "uuid": "78278b35-7926-47cd-ac79-cddab0276069", "value": "T16345231796E4A033E8B15B71AAFB07831632BCA6693147273780B84F5972BE1D935733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956308, "uuid": "436ef449-a60e-428e-b228-319c5743a433", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956308, "uuid": "ae573446-e285-4d91-89ae-c6577d1d1a5f", "value": "24576:fyHKl0poLQOa9XkMvPC15OO69UkfaLH3p3g1l+s8Jxc:qHKl0poLQPC/OnwH532HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699956308, "uuid": "b7107424-3629-41ff-bcc0-bf78ca72cc1a", "value": 1268736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699956308, "uuid": "69452654-7937-45d6-9eed-fff10ea1ddc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956308, "uuid": "70d28dd4-174d-49ad-9c37-1503870eb6fc", "value": "ebcb7a9dec526cd8b55b99d0f84fd347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8e2a2b-82cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699953815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953815, "uuid": "18033fdc-0f5a-4de6-bf70-f98cac6d77fa", "comment": "Malware payload", "value": "7843b5628b8ee40296fb9e3147666f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953815, "uuid": "819a22b6-3f87-4455-9a78-4bc3780c5594", "comment": "Malware payload", "value": "1263a6f6ffb8706a7785cc11b08c4a9c6609a3823ca758dbc4777b4639ebd2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953815, "uuid": "4ce313cd-8095-48e7-beed-7f1aa5892eb2", "comment": "Malware payload", "value": "f0a4a10aa9f1fba0d5cdd71f84cac6c4a5bc6742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953815, "uuid": "0657f9a6-6633-4c02-9266-be0ab1912029", "comment": "Malware payload", "value": "d3165161ebe1eaf4a19c3b7be751e9b3a847b80cbaeefe76ad53d627becb9609f0f3a385ccac07094390d20dab50d59b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953815, "uuid": "b6af415a-229a-462c-869e-eac534d5ccab", "value": "T1DC448D0074918032E9B715334DBD9A79EA3DB8500B146AEFA3D85D3FDF706D1BA30A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953815, "uuid": "27c05ac1-15c9-419b-878c-927be4501829", "value": "3bd21c073e321959019ea60d6d842ed8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953815, "uuid": "42c165ea-ea5e-4fa1-8272-405bb403fa78", "value": "3072:M7Za0z7upXz788zprae2pcKjkUUosipJHUbwRAtjP9OkBMF4C2l6p1WUeAg0Fujk:ga0iz788NapfcosGHUbHtjbMBUAOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953815, "uuid": "8d08ae8a-5752-4bd5-a682-22595a33cc50", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953815, "uuid": "b01f11cb-8670-45fd-baca-c23456115ad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953815, "uuid": "01975f9c-bccc-482d-8781-382b1ab6bf47", "value": "SecuriteInfo.com.Win32.TrojanX-gen.5552.6136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1aae36-82e5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699963072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963072, "uuid": "5997afd5-02a7-4bd6-8b78-dd3d7ac48ef2", "comment": "Malware payload", "value": "d808cd8fbdec3ca188d1e7dc8af93857", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip url", "colour": "#FE3A8A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963072, "uuid": "da729c97-9ca7-41fd-b812-1f2f5f188066", "comment": "Malware payload", "value": "12b615a29aa38f8084b6e23828007897953c887037a8ebea8828c62cfb396831", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip url", "colour": "#FE3A8A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963072, "uuid": "ba7080cf-796e-471d-95cc-3c8195af4215", "comment": "Malware payload", "value": "6ffda922281134b0c922f7e654253486b6b907c9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip url", "colour": "#FE3A8A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963072, "uuid": "a162f2ee-4e7e-4f42-8c72-7f673f05c451", "comment": "Malware payload", "value": "d3bf2ad9dedc03950b1a68608015563ab7425fa1a15524df12bd96fc3bc9e173856358f0372aee811c1e22bd7f24b511", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip url", "colour": "#FE3A8A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963072, "uuid": "03af236a-9a11-4ee5-a1ce-4a06c6030480", "value": "T12FE07D02CF341756E00340748043DE3A676200190CC6D9B3844C223E29049CD0E4B5C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963072, "uuid": "f851cb9e-fe77-4b15-8c3e-127a30e67bf6", "value": "6:5jIpEW00kOPmUjY9LyVntv3A1Gr5Gxi9irtQpEpd0kZtmszs17t+l7:5jIpEHDO+6eLCt3QGMo9iapErDZtmv7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699963072, "uuid": "fa4e83bd-eb33-4d6f-9312-95c0b290ce7a", "value": 339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699963072, "uuid": "bc81ff0b-ed42-4a06-8d57-cff7d5a3ef76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963072, "uuid": "dd1f063e-c63a-4769-9d49-061d272c4837", "value": "Agenzia_Entrate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27545ef-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (Netsky)", "timestamp": 1699964616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964616, "uuid": "ce2cdcb6-a922-40bb-be1d-2efbb71ad482", "comment": "Malware payload (Netsky)", "value": "1c39d3fdd56ec8cef89f60d71aa6e459", "object_relation": "md5", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964616, "uuid": "ef6607d3-32ff-4207-8d3b-c998a8750f34", "comment": "Malware payload (Netsky)", "value": "13b7d1449daae56c1d9e61b2b877a1f06cb1889eb2e7adb895a7af5695bf9eed", "object_relation": "sha256", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964616, "uuid": "f3f16b9b-f6b7-4331-b9d8-8f0ab86cabee", "comment": "Malware payload (Netsky)", "value": "58c4daf68eb1ca2933efd3139b188c6342a5c218", "object_relation": "sha1", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964616, "uuid": "00baf69a-0070-456a-b728-0b61858f05b5", "comment": "Malware payload (Netsky)", "value": "f59b66cc042d79abe236943f423f8132fbffd9cb00ebf513358e6680184a9c6e1ebaad892091d8a6e8003eaa18f22971", "object_relation": "sha3-384", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964616, "uuid": "9c696277-8a77-4390-84dd-aafc8fa99132", "value": "T1ADD2D016FA075828CE590F3A406F6E35E43675054F2B019ABC2E22E53F616F49D3ACBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964616, "uuid": "b50b9f43-36bc-42de-bcf9-e5c47678ce0a", "value": "768:xWkliAnUQYkYKzqbjC5RqHjrYReyZx+l0oKriCPRDLJ:YySsz6jGeyZx+l0TRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964616, "uuid": "0c362430-f3a4-4acf-8098-15368d3ace99", "value": 29832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964616, "uuid": "19d1df64-b919-4259-a94a-aed23258ee2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964616, "uuid": "f0b18391-4fcb-463c-827c-21f0425f8ccb", "value": "bill.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f4bb27-8343-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700003780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700003780, "uuid": "5746af87-2b38-4888-b7a0-d236497df99c", "comment": "Malware payload", "value": "0829902376be5df7fc4f0ba9cb41ff5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700003780, "uuid": "487266c0-3331-4a8d-baf2-53fad259c7ca", "comment": "Malware payload", "value": "16a1c64a64c741f354cfa13e4640e2c10917a6968dc0ac075d0c3c13270a87cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700003780, "uuid": "b77b1bfc-d38c-4839-937f-e6d80efe534a", "comment": "Malware payload", "value": "02eccba7af1a2d00119e35b0768baa9892829fbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700003780, "uuid": "16bdc648-2b3c-4f42-b64a-6f9723edcea1", "comment": "Malware payload", "value": "d907e6de142767441f6f410fab4ee54c5d77c0f71e52b9fb13130aa3e4d1a6a75ee476be6412db98aac88d94ea9de0e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700003780, "uuid": "dbde0cf5-9e03-472d-b88f-6a581b128849", "value": "T16C945B1C7A629463D5D39BF140BA616914BE780213D307D7277C3F352B337A3626AAE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700003780, "uuid": "d779f269-a111-4541-b555-e84eaecf9147", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700003780, "uuid": "b427c144-14ac-42ba-84da-b4cb59e6cdd8", "value": "6144:/IUnkAlR2SaOmUPvbeAOgT9RFEjosHzGBX2wb69WnEfzlrnl:XnkaR2VkeqmgEfzlrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700003780, "uuid": "61c7b2ca-ae44-48b1-b2da-226fd7a11115", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700003780, "uuid": "54c796ec-0adf-4528-ad84-59de9b8d94ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700003780, "uuid": "e4834d33-776f-439c-870c-9322a34de1ac", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30462.3819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85276eb6-82ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1699944810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699944810, "uuid": "38d31a6a-1a4f-43a7-8287-f109f0fbb918", "comment": "Malware payload (Loki)", "value": "290e4a2e26a532c427c3881c383bbcdd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699944810, "uuid": "0257ebd0-12fe-4140-847d-6399c0c5e636", "comment": "Malware payload (Loki)", "value": "174489d70aa181c2994b063518b349b1b23eabd988f192b37ea3112241d93f44", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699944810, "uuid": "69a0a7f5-be54-4792-8691-389597808a5a", "comment": "Malware payload (Loki)", "value": "3b664f1c48eec08ce78801ec5a9fefb28fdc8ce6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699944810, "uuid": "9639dc80-02b4-45a8-bb7b-a32014bdae3e", "comment": "Malware payload (Loki)", "value": "f619508d116b5ebca99ed34193e34ecc9b9c21a34c534ade0fad98dfd6ec6e755715fd44e6b3c7be6d545907cdc62ae5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699944810, "uuid": "32d8b2c8-900e-4f0f-abbe-3b59b97823f9", "value": "T1D355C003E940CB83D41C43F46EE34EE91B16BF04EA965ACB215ABF4F3E706621D5B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699944810, "uuid": "1226426d-e554-446b-8289-1f71d136e836", "value": "24576:uuBSw6/uZyj3bV9w6/WZyo3bVBE4ToRgLpcJX2gdEyX0LLB+dKwIx:V6/4K3bVO6/AP3bVBjTZdGX2gfkL9zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699944810, "uuid": "84efb2aa-d652-45b9-86a7-ec6d1156f28d", "value": 1301504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699944810, "uuid": "42ce8a5f-f416-4b80-a010-175a780f182d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699944810, "uuid": "ed3a94df-7c3f-4186-94cc-19d0bea6de2a", "value": "Spare part list.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582a4f1e-82c4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699949029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949029, "uuid": "67561b29-264e-4d7e-b774-e96858b92814", "comment": "Malware payload (RedLineStealer)", "value": "1acb669d142d2c53ca52ed5eb5a2450a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949029, "uuid": "df75d363-c8b0-4cac-8f65-53060d686506", "comment": "Malware payload (RedLineStealer)", "value": "19034212e12ba3c5087a21641121a70f9067a5621e5d03761e91aca63d20d993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949029, "uuid": "fe7702c6-3df9-4001-adbc-c10797b18f0c", "comment": "Malware payload (RedLineStealer)", "value": "37ee49090cfb6f262beefb86d721e2557651402c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949029, "uuid": "1fd72e62-3a6e-4635-b722-7210986a222d", "comment": "Malware payload (RedLineStealer)", "value": "6e3ca84ccadaa7841a7f62f988368a983bfd71f24710aa6ce2db0c29fa18927da8a07b652571789e6b52c226d374e4aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949029, "uuid": "f5e8d03a-27ea-467a-8ec0-5c7e76ba9f5c", "value": "T1AC7417C1338454DDCC4FC9F261251D658670CA4AA69BBB537C8BA8F73C6A358EB811E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949029, "uuid": "9df6f2d1-803f-4bb8-a19b-caa3de774754", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949029, "uuid": "e51c8321-feb8-4cfb-a548-c1e4c719ee60", "value": "6144:W2JluLmqW6lYoQDczh6alE4TanAOjpbrvnFgitiN1KfTi:W2lLqRYSh5aLpbrvnFgitM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699949029, "uuid": "efc56760-4293-401c-b5d9-6c7bf5a0e682", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699949029, "uuid": "3f5fdd54-d94e-403d-b212-76542817b1d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949029, "uuid": "45818d16-2e88-4e03-b050-e0990590ddbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fdaac8-833b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700000220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700000220, "uuid": "1dad0c74-0c19-4b88-84b6-bd959a765cf8", "comment": "Malware payload", "value": "82c0215e000b9fb857bafe55e85f6b3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700000220, "uuid": "0ffe3803-c2e6-40aa-aff8-8eab0dd5dcb3", "comment": "Malware payload", "value": "195256a242e1a4f2a1833194d97951ebb74ac0091b0cd6be50a3e2f01691b421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700000220, "uuid": "d8faa198-0b67-4515-b733-51db0fa9eaf7", "comment": "Malware payload", "value": "91a9f7c8afc15b90d529705b55d9782a87095f7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700000220, "uuid": "b6ec7ad1-e68b-4b1a-ac9d-2ed141c43471", "comment": "Malware payload", "value": "1bae519275de50551a82abdad1bd0383dda40a709a9538b7ee812e132abeba7ca6b9fc0408bbf515bf90424c4a0d24dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700000220, "uuid": "69437d56-8518-452b-abd0-1dad3bd5d0bd", "value": "T11E9449B8F8C086BDC4F6177746A096F54EBBF31BD751689B1793266DAE102810333B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700000220, "uuid": "625b8979-83ee-4894-849a-ea53037368ec", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700000220, "uuid": "66714c5b-4600-4695-a3a4-ebc8591df48d", "value": "6144:1hnttntG3PuxBHhbOsAOni+VQabylCVMI58jIRPNEISfFOk+ITjd:/ttntGfkOsM0AlCVMI58jIRPNEMUjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700000220, "uuid": "ad4d2b87-e3c6-4eb1-b066-2cd5dbcad3a5", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700000220, "uuid": "736b070d-3169-4f2e-8213-b8997ae5f2f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700000220, "uuid": "d5dd988d-f758-43bc-bed5-5054d1227c6d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.349.29746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451b05a5-82ea-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1699965318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965318, "uuid": "5a328d67-8810-4291-9a09-89de7568a072", "comment": "Malware payload (RecordBreaker)", "value": "026d75800260dad32ccddaa057686c6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965318, "uuid": "b993d72b-ba5a-4cd4-b0be-5b1cb59b3ed9", "comment": "Malware payload (RecordBreaker)", "value": "1abb8e978cc50ac436946ba779cfc8bdd5022a6251aca2d761b09b5a6433fbee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965318, "uuid": "d4f4212c-825d-4b4e-9a8e-e25c56709f8d", "comment": "Malware payload (RecordBreaker)", "value": "8fba7d5454baa53ecd75dbfb27c14943ce545083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965318, "uuid": "d321f5f3-f779-4b28-b2da-37b3f81dd191", "comment": "Malware payload (RecordBreaker)", "value": "f1793e0369c776d97a69a42d3aa9ad1f96a696a0941735ccf94b9e69f0777ba2414859d7e71e46e4eab1377f2e4c5b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965318, "uuid": "601c1656-385c-4c53-92d3-346cb0dcd93b", "value": "T1C2652352B3E68536D8F0177014F611B31F31BD508D78A3277A8229EA2DB3285BB7573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965318, "uuid": "4abef5ce-acf6-4a0b-8c2e-2b8ee1975201", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965318, "uuid": "5764cd37-7bd0-428e-8ca9-6822b547463e", "value": "24576:eyJ3a1T6mx5FyKAH7KqcKnSYuZVzcwTTWkeMG:tda56YIKkRG/QA6k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699965318, "uuid": "f344435a-091f-4947-a95a-76421a032cac", "value": 1440256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699965318, "uuid": "e940c941-2756-424c-a3c9-00e036b5d8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965318, "uuid": "dcf692c1-5c84-44fe-a311-818acf6b6ad6", "value": "026d75800260dad32ccddaa057686c6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa92b5c1-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699964630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964630, "uuid": "f1801082-ad1f-4d1c-84d8-9050f74c7e2d", "comment": "Malware payload (AgentTesla)", "value": "355666f37f1ffd9d6382c7e0fab1b882", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964630, "uuid": "10432802-2b0c-49e4-9a2d-75255103cbcb", "comment": "Malware payload (AgentTesla)", "value": "1bc363ba8df6cc044fe7eea73aab1ec7276ee28afa716b19e5681335189aa070", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964630, "uuid": "8b156563-600f-4dcb-9227-600370ae5add", "comment": "Malware payload (AgentTesla)", "value": "32ae4cbcbaaf4bdebaafa4e01f34d4d17e29013b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964630, "uuid": "5aceaf86-a78f-4756-97bf-d286f6cece54", "comment": "Malware payload (AgentTesla)", "value": "5546f49d0f2e875a68aa1bd805caf91ee92854409d59ce7b065f8a2f29144e6c43491625ccb660f30826e81f98cde623", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964630, "uuid": "776d6a27-f404-4721-b6ed-f2b20968a03d", "value": "T19AC43371A6E87963423CCD7B09A4298A71D441FB95F1F49C18E5C807A3AF8399BDE00D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964630, "uuid": "9a703487-1457-41e4-8598-f82830e27b3c", "value": "12288:vXtCBFjjcnyKQmvCMc3+LCIaHyrzDYC7lSonCcJ0ilwTgIXAOF+SyDc:eIpQECM/Ov6PYC7lxCcJnlwECyDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964630, "uuid": "a7e408dc-be45-4b80-8d1b-28d64371130a", "value": 585927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964630, "uuid": "ff20ae5e-0021-47a4-a72b-5c9678128ff7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964630, "uuid": "f3c78b38-67c4-436a-85de-8567ffb96c1f", "value": "Inquiry of mt gaocheng 5 dischagre_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34b4e9a-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982710, "uuid": "adb96c8e-c2aa-4dde-8fd4-c21d70190acb", "comment": "Malware payload", "value": "66c5e0c64ddf6ad48c7269660e882ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982710, "uuid": "a4f30fb4-d54d-4c2e-8cb3-f98dd23184ab", "comment": "Malware payload", "value": "1ded59a79c592a70a138f44b71118e2a7f86663902557cf6b8a109989ea53c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982710, "uuid": "50197c95-5aa5-4c3f-8db1-762e1121d818", "comment": "Malware payload", "value": "2e80f3bc2aa7ea33ac4c2c64ef6f9c8351c295af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982710, "uuid": "f84a992f-cf74-4f69-b87f-78ff39c025d3", "comment": "Malware payload", "value": "cbf033e3b27b8f3d8abb02a571abc7eaf5efa3b0cfa7d71bb172e26a17beda464c2ba4da92137e75723b5d489e32eeb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982710, "uuid": "16d0eb64-64ea-49fb-92ac-bfe1cba5382a", "value": "T108652342E45096F5D5A85034DCA2E93E17174E3D8CC42D0A3AED3EDFB976E53630AE28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982710, "uuid": "0ff2a598-8540-4b13-b8c3-4b7964edbc39", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982710, "uuid": "ca7a40c6-3529-4003-b775-d996d176aa4b", "value": "24576:pJH9HJUilcVG7HGKKGPlsVGqcMxEnw899/Dnz/aiQ+62D3Rq6L80onSLV:D9H+W4EHJKaI1fEB9/XjSW46L1wSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982710, "uuid": "b1a40e4f-d429-47cc-870c-47491cac0bbf", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982710, "uuid": "b149c032-3dca-480b-ad02-5c3f5d2df956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982710, "uuid": "f594a773-02e0-4a50-9890-c7663d61c124", "value": "SecuriteInfo.com.FileRepMetagen.29915.13790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df0ca04-82ca-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699951616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951616, "uuid": "be864670-f96b-45f4-95d9-b847abea052f", "comment": "Malware payload", "value": "ae0f1248405709a1da5d1d3865c246fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951616, "uuid": "c69bffc8-2763-41ef-a0db-c03a7b59e8c7", "comment": "Malware payload", "value": "1e1a3828028401c6052fd951935347159121c19c01e7dc47fa2d4620a60c720d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951616, "uuid": "bb0c8d99-0796-4f5e-8cc3-eea8383cf3d0", "comment": "Malware payload", "value": "0c4bb214dbd2c1266e91567cc9ca05679e36a94c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951616, "uuid": "9a052bfb-ecf1-46e9-b256-4ad3749f9c93", "comment": "Malware payload", "value": "f080be48a8067610346de9fcb86c89b32ee649962cbf536c56c13eac9f0dab4becf260bbc347cd57600a2f2028941396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951616, "uuid": "0f746c82-dd7a-4cf1-8661-822c898906f6", "value": "T10D25DF81EA8456A0ED1CABB16A37CC3542337DBD6834E51D29CE7E673BFB3935021462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951616, "uuid": "3f430f18-f363-47e7-964e-8f0658b0332c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951616, "uuid": "9b05b870-0ce1-41c4-891c-0ac609df7dff", "value": "24576:Ygo5sjO8KFSrnYpABkmHDtP1gS+bLgbOu+73w9WMUQ1q:Po5sjJ3rYiBtZ9X+b7ua2FUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699951616, "uuid": "5ac44421-aa76-46dc-accf-8d9ea7123136", "value": 1050112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699951616, "uuid": "879d4bff-bbe0-4d89-9834-be936560dde2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951616, "uuid": "f2fc43d6-ca4a-4b37-8b37-a97b70405f8e", "value": "SOA OCT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1cf7af-82cf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699953683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953683, "uuid": "6cd4d94f-db7e-40ff-ae28-5ee059767b68", "comment": "Malware payload (AgentTesla)", "value": "14b113f3a81cb3d3e896601fe247c31c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953683, "uuid": "b474dcca-b422-4f0d-9557-bd439b8bc514", "comment": "Malware payload (AgentTesla)", "value": "1e6327a5456f3aac77ec28cc80c9f9f8cff8a157a25a8a2f597764dcbccce3ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953683, "uuid": "8d9d1f46-bdc3-4926-adf5-60101b235a9e", "comment": "Malware payload (AgentTesla)", "value": "5021223cb23d9a5d5598b2438ee08194d42edaf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953683, "uuid": "5544ca92-a498-423a-8ab5-73ab013dd5a8", "comment": "Malware payload (AgentTesla)", "value": "cdd2b45d9d80d441b104b9ba489635c151428d9b71ac3c96f603ca8f5830768d254350576b1cb2e6bc486fc7065ba8c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953683, "uuid": "1eb5d129-4256-4b6f-810f-191da966b1d3", "value": "T11DE4CF0EA3204393F0182B75DA6D7E290360187C75D1E7D8F9A57757EEE6BA6183302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953683, "uuid": "ce81807d-e924-4201-b659-e7e715e1f3ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953683, "uuid": "8fce5144-4f42-4cb9-9dfd-49ef2fdeb587", "value": "12288:07AFnSTJ0TmqUmY/G6C7PgSMuE/5pTsKc/Q8VwNUmVGS:MqSTJ0TmrmY/VCB21C/Q8S3VGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953683, "uuid": "3e6b1cb6-1b90-417c-a1f9-4ca8b306bf36", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953683, "uuid": "ba68fc62-5d50-4440-a7fc-4727b8b381d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953683, "uuid": "43eb58cc-1725-4388-be2e-46f7f6967a7c", "value": "Confirmation!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41248788-82b0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699940401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699940401, "uuid": "59fc60af-3642-4af8-b049-d56437f483a0", "comment": "Malware payload", "value": "81b0265e0d9eb6dc94bffe1f2c160164", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699940401, "uuid": "98a63f24-9521-456d-96ee-958894191ee8", "comment": "Malware payload", "value": "1ed5c56ddef3fd5df0e6eb9fe0898d05f0944f85cac6d71bf9dbc346fe791fd6", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699940401, "uuid": "b6892a62-7891-44f4-8dad-f64dba8571bb", "comment": "Malware payload", "value": "9928cce8e6c4274f17a697928a2933d92cae3eed", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699940401, "uuid": "ed697dbb-be27-40b0-9edb-64d1351bcaa8", "comment": "Malware payload", "value": "bd9a288a37a5e9649f2f0ab2982c7dc16125cbc47ccb02bd6f3699e98951e04fd5e04bfd51d46656868f04826bc87e95", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699940401, "uuid": "16ee4c91-de02-4c9c-a3dd-6964313e36c9", "value": "T17584231AA87C045498C974F4E6B24A0FD7C59B318F42FC1639DCBE92DAA0E7F5A5E060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699940401, "uuid": "52c856d9-9bac-4b37-9a2a-068d2b3c3329", "value": "6144:rooNTErr5dNV5izmP+eg1pujm/XLZBc3dK+uNq5phpti1m3KjhaqQhCOFcU:LitP2XWjKz68dqptiE3Kjh0tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699940401, "uuid": "11a27ec8-12e7-472b-a11e-ac4c7f8a5c84", "value": 400220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699940401, "uuid": "733ad47b-47ab-4996-900b-caef024bdba6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699940401, "uuid": "d123cef6-6b5d-4700-8c48-3060f7bd1d2e", "value": "VALVES INQ.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1310f99-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982706, "uuid": "cfe0f7e8-71c3-4633-a6af-dba45572ba18", "comment": "Malware payload", "value": "6368cb73213be4810369b93534fc7dac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982706, "uuid": "dfa829d1-ae45-4c2d-be04-b200484dc344", "comment": "Malware payload", "value": "1f9a4fa0a9cb98637bf34cf919c0f964551b79abcce5621d7b165720aa45988c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982706, "uuid": "1b183572-f101-4e3e-b64e-165372df30f1", "comment": "Malware payload", "value": "2b59a74c494bf7468647acfd2d50886c03757456", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982706, "uuid": "5c1f03ca-925c-4849-887d-0745351df586", "comment": "Malware payload", "value": "30982a9d3d0c276bdf22a34f008b466247a927d4e17d6370386b69b4f2ece053659c22553554c73002b2951c29ab5087", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982706, "uuid": "074a560b-4ca1-4b2b-9742-8094a5b827ee", "value": "T1134533F0D52E9BBCC1FB443E70A63B1186BC1214A58A3066ED594C7EB7532442BE5D3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982706, "uuid": "eed89332-8e73-4ebe-bb7f-4408ffa933b0", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982706, "uuid": "d6e63ccd-0a30-429c-a18a-d20b0a3a35f2", "value": "24576:8biNxds3Je8nHM//oucDF8RT+YfrCJ22rs5u:8WNxyeUA/o9x8RT+aJzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982706, "uuid": "4c38e62e-63d2-4e8b-b00c-d61bc84aa533", "value": 1184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982706, "uuid": "f5785435-b794-4e1b-a32b-d47b648ebedd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982706, "uuid": "6839efd0-9ddc-4c02-be2d-055e963ef323", "value": "SecuriteInfo.com.Trojan.Heur.PT.iD4ab8CTqsfi.22136.10717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f0f5f4-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982689, "uuid": "a662db76-8596-4489-8545-35a3174a028f", "comment": "Malware payload", "value": "9f561130545acfe0b7531870187effa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982689, "uuid": "8a0ad9e9-2bb2-48fa-9dbb-fb767a8bd118", "comment": "Malware payload", "value": "2018c59cb48d035db9403e9a6c647c8054369fdaff3fc8bf2284607a6a792e97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982689, "uuid": "9d6fdebe-7b9f-410e-b789-8dfacfbe9251", "comment": "Malware payload", "value": "d0f176e2a4aaccbe5dbd28bb8555a02df47fa03a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982689, "uuid": "5ea1d2b3-b385-438f-a2ce-d8d40ffb7db7", "comment": "Malware payload", "value": "ab33f5811b57d21e065b3799216f07ea07b25f8221a5847db279b5caacdf04c8759acf378c66a3cfd6a4c120409bba2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982689, "uuid": "264eb489-75d0-46df-b729-383306af6d9c", "value": "T13A357C0732915033E6B279364A1B42ADC826FE261D78345A6BF99C483D35643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982689, "uuid": "b549c875-7fc5-46a0-a2f0-978680fca716", "value": "12288:PGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3k:PKvzcrnyaLO+3Yb/wQeAh/7R/lgun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982689, "uuid": "e1848165-c40c-46c4-80da-702d5407541c", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982689, "uuid": "0022851b-85b2-4670-b1cb-e811392b19ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982689, "uuid": "598facfb-8a30-4559-979f-b51ec67987be", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16837.16721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f25994e-82fc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699973039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973039, "uuid": "891db7d0-67bc-4cd0-a4a4-96b03ce1c3dd", "comment": "Malware payload", "value": "3a44f87dcaea438f12b9c2d2a4117c2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973039, "uuid": "33122ac8-a73b-4d29-9f0b-b3dd262119ac", "comment": "Malware payload", "value": "22f1911d81e0e2feaf26b7b28208b5cbb68be45c39d5a6630c40047de2446f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973039, "uuid": "ab4f6f9e-7432-46e8-aaca-363811081e88", "comment": "Malware payload", "value": "d8ab9e45a3249ce9dc4e949b69388d8283971343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973039, "uuid": "ecbbd7f5-044d-4076-8d6a-d06f7dcd2e30", "comment": "Malware payload", "value": "54b38596d565ea8cfa7c26ccf57f1c5e451c93a75a2f25c449e7ab079dff1b627201af22b4d338bb1fc2fc1f41607682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973039, "uuid": "f0924951-79ee-47ad-b969-390e23942c84", "value": "T1F914BF2177F5C072F22749344AB286B19A277C724B7298CF2BC01BBE4E356D1DB69316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973039, "uuid": "2e4c6005-8ed0-4523-bea9-036d31661dd7", "value": "934ec125307f845a986ee85bb76bb1de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973039, "uuid": "315ad667-8a91-42d6-8c5f-514385445ec6", "value": "3072:byJI8i/mk4ItMOjn8Rhxka8B2JZmsDDP8uxGn8yV7gSVTpN+c:V/fFtMIn8RHp8BQdP8uknLg+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699973039, "uuid": "a27c6969-d647-42d8-baa6-bb944e5f795c", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699973039, "uuid": "05c4646a-ce0b-43db-8d89-9cc799809ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973039, "uuid": "13757d08-efa7-4094-ae1c-c6d27a6359c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98da441d-831a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699986075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986075, "uuid": "b421538f-20d3-4431-82c9-e376e466b4da", "comment": "Malware payload", "value": "3f2cc6d3aa0687d8055707bde2ceb02f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986075, "uuid": "1e0e243a-a209-4a21-a4b8-0f0eb0d14767", "comment": "Malware payload", "value": "23943b3d6938425abb71b4e82e9b8d3e93979091c175128c9f167dfc67118968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986075, "uuid": "9f1f1d7c-e54b-4196-98b4-cf799dd8356a", "comment": "Malware payload", "value": "5aa16044bd3c72d7ca6e394c75abd2b250842962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986075, "uuid": "ffd13170-1740-4c70-a6f1-39d80236e605", "comment": "Malware payload", "value": "acf120dd76ccd7e68f92f497e7ef1797c9b4de3d2a86fa3824a1d6bff4e138a4c22a6ccbad818ec031bd07f1cde0f23b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986075, "uuid": "a87634d1-28b1-4429-bf39-1055595257cb", "value": "T1F5946C1074D46071F67790F3D3E8EC658BFABA453789B2D712EA5B2E8F51EB63020912", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986075, "uuid": "bc9d64ec-111a-4ba0-a6af-1dfa38256b22", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986075, "uuid": "13527de4-1711-4ac4-9790-d85af4e6af52", "value": "6144:VTUnkAlR2SaOmUPvbeAOkTbAuAKcLgese4NZykZKvlN9pCl:+nkaR2VkeAAovykZKvlNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699986075, "uuid": "3c7b8fe1-2dac-4a2f-abe1-0beb534ce69d", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699986075, "uuid": "c56e378c-fbc7-4951-a7db-e2e1f5a090bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986075, "uuid": "29191e0d-b341-4893-91e5-2ac3eaca1739", "value": "SecuriteInfo.com.Win32.TrojanX-gen.23748.30617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f94b746-82b7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699943405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943405, "uuid": "49ac7fdc-9058-42a2-97f6-4d951f77322e", "comment": "Malware payload", "value": "3520764ae6ee89d4f99cf57aa1b57e1d", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943405, "uuid": "fcb7125d-30b1-4eb8-b5a4-13a6de2478f7", "comment": "Malware payload", "value": "24e7e2dcb6102224d489081a32b1aee6c1ea035295d58fbce7f85c7f22c543fe", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943405, "uuid": "aba50bbb-e299-4222-be7b-2536f6f534f3", "comment": "Malware payload", "value": "371694797572bfc26f76818b2e11a6f6234d2a17", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943405, "uuid": "3f921445-067a-4feb-91d9-181086b10ce8", "comment": "Malware payload", "value": "a694d30a0f51ddf23d471325cfb48e5f42ec296f90489a69d1b1bbdb839c47a7359d4cd0473737b0646a7045104ffae5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943405, "uuid": "d2a905a3-cae0-4b88-8034-e9b40e5556de", "value": "T1C8E5E01275C2C532D5BA06701A29EB7A417EBE200FB099DB63DC5F2E1F728C15632F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943405, "uuid": "823d0498-1549-451a-9544-245498a52097", "value": "49152:7d8YP5T68otYLN4iFvr/7RaKAcXGQt56YK1JeXl2ahGeCArKOdqXljTkNhwCqgY2:OY6YLAXefjGRaUqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699943405, "uuid": "53904293-b1b2-4851-a969-de7e09482f62", "value": 3155456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699943405, "uuid": "f9f126cd-2474-44e3-8a04-1ae9bd43b505", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943405, "uuid": "1a32f9ff-6598-49b4-adf9-f88f0bdea265", "value": "5f161.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0874cd-8304-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699976416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976416, "uuid": "12b5d519-24b7-4dde-9748-47233a5334f1", "comment": "Malware payload", "value": "29920ce4f056ec19528f711519d6321c", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976416, "uuid": "05b360ba-ac79-49fe-9e6d-a9f3cd06ad0f", "comment": "Malware payload", "value": "253c97514805ad5ee0dab272a842169a639faccdd38ce24bf08054b49e2c9fe9", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976416, "uuid": "37f9d3fb-bc86-4026-a97f-e56431a63cb1", "comment": "Malware payload", "value": "a5a755d54197f37cd47238accd359efa6d70e78f", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976416, "uuid": "859711ac-ba6e-4cf0-9b21-eb97e5b95cc2", "comment": "Malware payload", "value": "542690e65f4ac280cfbaeaee009684e9a41802215e014acf93939e57a7fc6e8aa8f384a1c559ed5654a00aa2eddab68c", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976416, "uuid": "5d496d56-4cb4-48df-af89-af10bae24ff5", "value": "T143F52374BA214E85C6F150B677976A83DF752C2F8502562DD722FACECECB0612DAE0D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976416, "uuid": "44c1b705-bbb8-4f23-98c2-824abbbd3bc4", "value": "98304:GwJezv8Skec2go9hDP98c/DJujGPWRVqW9Mzxj:G9r8SkecrIl9tFupR0Wazd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699976416, "uuid": "e9b0c46b-cb57-4d69-83fc-1713d20be1b2", "value": 3332194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699976416, "uuid": "87929a03-9862-4a36-99d5-0f4c2da2a499", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976416, "uuid": "176d1a70-19c1-4ba7-bfbd-329184864274", "value": "ID3630FA_C25595793_6499.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b630b952-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699964649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964649, "uuid": "73bbd551-0738-4fc4-b620-cbde2fd54fb2", "comment": "Malware payload", "value": "138d7d8a55bef05ac6368488b3c9630d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964649, "uuid": "1ff94eba-f8e8-4df6-85a4-3627161bf0a7", "comment": "Malware payload", "value": "25e7a5ff8ca830bccda9a6617b31fb3992d4f780444cf3adc8cfb8056f26dd58", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964649, "uuid": "2adcbcb4-c538-46af-8a8b-362f167c1e13", "comment": "Malware payload", "value": "f9e93ed382d3005a7575443369207f2c3339309b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964649, "uuid": "df1194f8-1c51-47a1-8d9b-e4b51e791ad9", "comment": "Malware payload", "value": "ea9e617065a2a2d20f41ac89fb616e71b4a964d4c3cea27e62ab57c610250cb1d18767c59bc60f696c311d95187a636d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964649, "uuid": "c196f395-706d-4d83-8412-d041b044c92a", "value": "T10D4533A1D3AD958F6BA4C06426E45AC6212FFD9C95A339BD12B0E8C758093C7DF3F160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964649, "uuid": "ff8e64d6-a27e-414e-a67f-c6715e13be88", "value": "12288:YWdBCwo3NVvUP/hkRQFTvW7HKReRSR0H8CK/+d5NUzsChpgUWxt7HCZoUPYG0hmL:YgtI/u/httvKaey0cgzobrhPEm+RlDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964649, "uuid": "649430b4-3682-4a36-9081-2993aaf8336e", "value": 1228030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964649, "uuid": "bc8ca400-975b-4a39-a8db-d59fbc8c98be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964649, "uuid": "216fbde4-544c-4db1-b061-b0b2c1721972", "value": "RFQ-T56797W_1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e4e059-8332-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699996399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996399, "uuid": "33c0d1ed-1d10-4d3a-bda6-925d22b8f6c1", "comment": "Malware payload", "value": "27137cb3cc5b6b3ef3a28ed8daf55ba7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996399, "uuid": "22e92885-c5c1-4f9b-9416-550265d9997b", "comment": "Malware payload", "value": "26bb80ea94240a03b487cb1f62459d06a8ba4f9abc207cb5372a49609bfbabcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996399, "uuid": "39760933-ac70-4036-966a-a89cd1309fb8", "comment": "Malware payload", "value": "bad5145cac4800db949a9bab321419300388b028", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996399, "uuid": "0ed8733d-15bf-4525-91ba-f9b6dfa95ca0", "comment": "Malware payload", "value": "c3afd20727a81303c108f7cabb9fab2500920cce2b5b727fb059f7a85fd664044f29bbcaab46a64660e51da21c6c30c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996399, "uuid": "40aeb2a8-5825-4d1f-b185-e902dd77b1d3", "value": "T1885409D03EB34CB3CEDFB5364BB4604498E93425658E3764286385A637762B8BD08D7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996399, "uuid": "679a1db6-8269-4b5e-b88c-1cb83f73a226", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996399, "uuid": "cc32c4e5-6c42-4414-8fe2-01ceb627dfcd", "value": "6144:hNLj5wYTGkIdf487tQi2iklho8Jixi0N:h5j5wCCj3kr1f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699996399, "uuid": "06204704-fe48-4cd5-8c11-8d8562830841", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699996399, "uuid": "115510d4-120d-4ad4-b6dc-9774804de8b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996399, "uuid": "0f35cd90-aa87-4e71-85e4-425da506673b", "value": "27137cb3cc5b6b3ef3a28ed8daf55ba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fa985e-832b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699993187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993187, "uuid": "b2d5b79c-46b5-4185-a019-9d85e9303321", "comment": "Malware payload", "value": "474044a79d44f035c3e866964440a7a3", "object_relation": "md5", "Tag": [ { "name": "PythonDiscordStealer", "colour": "#23A3AC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993187, "uuid": "65e7523d-68af-4218-819b-cea0ad414055", "comment": "Malware payload", "value": "26df783504b42d856126e4db9a25fcd2bdba62b000b1561736ca251e537aff3e", "object_relation": "sha256", "Tag": [ { "name": "PythonDiscordStealer", "colour": "#23A3AC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993187, "uuid": "8879ba30-06e8-43f3-9887-ee1b79955238", "comment": "Malware payload", "value": "bf33a00a6a837283e0e2e20922df6fa6a3657c78", "object_relation": "sha1", "Tag": [ { "name": "PythonDiscordStealer", "colour": "#23A3AC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993187, "uuid": "4378a936-f4be-4917-917d-2957eb55f3fb", "comment": "Malware payload", "value": "64e686527bea4e6fb6c2d27d7c9f944642480febf0a537b0794df0428bc2d6cbcfca34e7ec3b18f732785ec0c8353b18", "object_relation": "sha3-384", "Tag": [ { "name": "PythonDiscordStealer", "colour": "#23A3AC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993187, "uuid": "b4dfea37-6b55-4bc6-a2a0-c97f2099c662", "value": "T166F2B6159D2A501691B3C79D6D42C993FB4887438B331812BEFC92147F39AA0D3F8EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993187, "uuid": "90bde0b2-215a-4089-851d-fcff81e9bafb", "value": "768:GiJBL2iugOv5raYr7SyHaaXlIAVcnaaU5ufqIh7zZQ5PbNio:GCL2iuVr26aaXlIAVcnaaU5ufqI/O5Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699993187, "uuid": "fcee63f3-5aeb-464a-a6e0-fc2962cea4e7", "value": 37125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699993187, "uuid": "d5ca286e-513e-4f70-9ce3-50031f1e4640", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993187, "uuid": "f98a982c-5cea-4490-9771-97ae8aea451f", "value": "5qqX9YUL.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6026bc60-82ec-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699966223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966223, "uuid": "800a9b04-0fc7-4675-81c2-cc70749c0413", "comment": "Malware payload (AgentTesla)", "value": "6ebc404852633cc1aae728aac1bc2865", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966223, "uuid": "8b1cf3d4-68b4-4585-a5e5-770f97925279", "comment": "Malware payload (AgentTesla)", "value": "2772267437ac2a4a39e1c4893788b420e3eafd75c0517c3d8bb58516c8e2b196", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966223, "uuid": "7ab250ae-bce0-401d-b2d1-265040d46439", "comment": "Malware payload (AgentTesla)", "value": "7c410644f26506dfaca68094be0b4e01d40f0a60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966223, "uuid": "cb359b6c-1fd2-46d0-94c3-1538011f278b", "comment": "Malware payload (AgentTesla)", "value": "2791638533b03b3114ca86364d98e7e8a24b3b55f47c8918408e5f0ebb3e4ab244044eac2c7f647623179b7fc4faa19d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966223, "uuid": "8cf918f4-c078-45ae-9de4-8c8cf8570f0f", "value": "T197F4012536288C23D69D02F86817098413F4CEE36C61E3ED9CD77BA917F7B9146626CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966223, "uuid": "8bb313ff-8b5c-4601-8ba8-1ecb52cf1eb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966223, "uuid": "fb1bd7c8-a039-4e0b-8b29-5f9e19dc81bb", "value": "12288:457DOWXGBSGQJzeP9MjqNFbTwrxGBgg+9VUf0GqCQ+TCuKzTxE:SNpzePbVw9G2gU2f0txE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699966223, "uuid": "82c317a3-de6b-4885-a834-8d13b6e35e84", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699966223, "uuid": "3b0973e6-1a9d-484d-afad-affe84415f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966223, "uuid": "f7b93d7b-cd0c-4349-8152-ef81da9870cd", "value": "SecuriteInfo.com.Win32.PWSX-gen.11963.14482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702dd3ec-82e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699961525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961525, "uuid": "0681316b-235a-4193-a3bb-8a43c1d9c237", "comment": "Malware payload", "value": "e8e03b91b2802891c978c8a67999bd10", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961525, "uuid": "5dddbf81-be64-407b-bdd9-ce891a4c52e1", "comment": "Malware payload", "value": "285a563c4e37ac89fafa49aed8e5bedb5dcb2a310860c2daf7c3fdffc094cccf", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961525, "uuid": "beab1c65-78c9-4b49-b5f3-7321ef728789", "comment": "Malware payload", "value": "af767e90f1017c588451f6019a199876349e4f7c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961525, "uuid": "bec89e59-8076-47a3-aff9-96822d5e9667", "comment": "Malware payload", "value": "5fa387fdd3eb7c10109c8a462745b5d7d07487b6d0a4a57fb371346f0361694b6ff73d64a62d509c04dceac28bc3d994", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961525, "uuid": "5348974f-4aa3-4562-9837-b79bb07726c7", "value": "T181D022188A4CC2B2D082241B8058FC8CAC0EF04428E2C89893C4DACA9C824E0ED08AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961525, "uuid": "d11b0cb1-4323-4556-a1d6-fc37d9cc70e2", "value": "6:HRYFJb/5sZOMNJu/Qvyc1yc54vVG/4xHn:HRYFJDpAk/Qvhy3VW4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699961525, "uuid": "295a3684-8a04-43e4-a26d-a868b3853ac8", "value": 200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699961525, "uuid": "44859ac5-4074-42a8-9c46-865b8ea53c9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961525, "uuid": "4da9881c-dccd-4886-8735-4aa4359b8a6a", "value": "Agenzia url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e4d632-8303-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699976221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976221, "uuid": "b3a5fc9c-1a4c-4ba4-be7f-5f2d9f2642fb", "comment": "Malware payload", "value": "0b6bbab5cf10fb86d65dac3232559d43", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976221, "uuid": "4939fdd1-797b-44b3-b4b1-ec99d9ae6e68", "comment": "Malware payload", "value": "28ff7609b497e21969d07367cb1fd2cb786c7572cd86d2487e1838ce05208fb5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976221, "uuid": "71bab1f8-782f-469d-80b8-facbdf50d1ba", "comment": "Malware payload", "value": "18f456128375b673e6a4174a87054ea046157c6e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976221, "uuid": "a9f54fcf-bb20-4a98-bbb7-5d5935763278", "comment": "Malware payload", "value": "abbd7d7e678f0152dc048e3fa9d9a181e0e6e1e39cae4f8e0aa2f2b78175a4efccc5f8c4ada917c57e71eebe05e7bdf7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976221, "uuid": "07d0064e-34b7-4fd2-a3c8-f48f71787589", "value": "T1ECA002E694546825751D55196AE401A05C555C7F1D5C780415424971C38578A5125751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976221, "uuid": "3b9eca65-05b6-4c8d-a4c4-cd2657dbe60e", "value": "3:TKH/QWI6VAcFpLu0QS:P6VAcFpLunS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699976221, "uuid": "ae376f02-1b67-48d3-8f22-b3920fbe1c4c", "value": 58, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699976221, "uuid": "7cecd4ef-8f0b-48c9-be18-a3f72e83f987", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976221, "uuid": "b9e2e51c-f58a-40ae-97d2-91854e652faf", "value": "encrypt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f203797e-82ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699953583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953583, "uuid": "49658cf6-1209-46cf-9b44-fa9d7e9845d3", "comment": "Malware payload", "value": "9c65c31fa60a7490db9ac229f88aeaec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953583, "uuid": "56c3bfbb-19ce-4994-ba1e-5fea5b6a9e75", "comment": "Malware payload", "value": "2a318235a7908da2cfacd1711becc3c0da7a23359a98628f6d1fe14a7dd97b70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953583, "uuid": "05971ad4-6b67-4695-89d6-489280a642bc", "comment": "Malware payload", "value": "1165267dfffa7ac1443002fb331fd573d34132ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953583, "uuid": "8250c9ef-eacb-41cc-bec6-212636b7b931", "comment": "Malware payload", "value": "f6768df81663d15dcd870b01aaaf99ca7d1773e2ecef3c339410ab6312db3491643153f03cb043c7516ad7dc536f0f24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953583, "uuid": "db37763f-f551-43f6-8bb8-86f571371fcd", "value": "T136535B003398C965E1AD4AF8BCF2560106B5D5772102DB5EBCC815DBAB9FFC64A122FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953583, "uuid": "b8d68104-e414-4e2c-9587-f431049311b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953583, "uuid": "9aeb0504-cde7-4dcc-bc6a-6abb037ee7bb", "value": "1536:ZnQpg/GiDABXOUcbbKwPoGoGfDpqKmY7:Zj/GiDu/cbbKEHgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953583, "uuid": "7a27cd13-08ca-4151-a48f-84abe68ac135", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953583, "uuid": "0c694f87-94c5-4303-8c6a-6736fd5cfb12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953583, "uuid": "e0d140ef-1238-488e-9089-d8def5a1e930", "value": "9c65c31fa60a7490db9ac229f88aeaec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3850ad-82cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699953818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953818, "uuid": "8d869df7-eedc-4e0b-9062-ebdfb1d54c58", "comment": "Malware payload", "value": "75ab3e51c23bdcbed0b3d61cfe34e115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953818, "uuid": "6b2352cf-66f1-45b7-b163-b28c25e5d0df", "comment": "Malware payload", "value": "2afbb69db67785267646cd46ee8c3ea7f2c5f7d423d08f28634f8b3c8b5c8c88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953818, "uuid": "964c334f-ea16-4d6e-bc9d-42d9a2d2dbb2", "comment": "Malware payload", "value": "496246604ce44e424a83a30a520cf30cb3b39358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953818, "uuid": "dd9d738d-ce3b-440b-90ac-ae78f866d7bd", "comment": "Malware payload", "value": "d4df2f3add0a9bd1b520ebda038d1f2941cfabf0cc47d8143280bd6d8efc8ddfc0a7ae9b2b5eabd228244197877561dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953818, "uuid": "f70197e5-1103-460e-8a72-f9f1b5fe5077", "value": "T124466D05B9504D56CF4D11F3DC9243DC9A13DC4E2E05A39F2EEBB8EE6B392DA540A389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953818, "uuid": "0b90557d-3f67-493e-84ac-40a42d4ebc7e", "value": "49152:JK6pbuPFj8aV1lk1eXt1f9MK8OHReUxVItG5thFNg8IdTfXxlZqabY/48Xd6f/FD:bcj9kAAJv9f9Dgocby7kUsw9QhEqN1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953818, "uuid": "88be511f-fe6b-407a-aea5-087377b1e711", "value": 5664928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953818, "uuid": "b4f12a31-cca6-4d0b-b97a-7f92982088f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953818, "uuid": "f8743c78-0768-4990-8dfa-ba48da17353d", "value": "SecuriteInfo.com.Trojan.PackedNET.2228.30736.18744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b703254b-82c8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699950907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950907, "uuid": "fabaacac-7d44-42a3-be7b-420f07dfc935", "comment": "Malware payload (RedLineStealer)", "value": "24420ef6433c1b0a907056208c3c12a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950907, "uuid": "022d7efd-5b31-4984-8434-5b1e3078df76", "comment": "Malware payload (RedLineStealer)", "value": "2bccfd325ef0ae6b5522b4be977a4d25f81b42a2240c8a072773ef6ed6517900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950907, "uuid": "8ca7ac18-d7e1-4c92-9d5f-ca41fbab47c5", "comment": "Malware payload (RedLineStealer)", "value": "32b147ecd5f547e4473b446c32b03c761a3d4d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950907, "uuid": "95018279-eaf3-4252-aef8-71d8e3f95d6c", "comment": "Malware payload (RedLineStealer)", "value": "b3a6def95723802bc03c6bffeb9a435e0f24b42ad23e1a43b7feea9f27593b42082536127237830caa1808cc55159d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950907, "uuid": "8b627eef-fee5-4fe9-95ef-79a25cce2572", "value": "T1609439E23BB66DA2C943F7718B626844103215276D3B784DB8B30E252533798FA19D7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950907, "uuid": "0d4f20e0-2b13-49c9-aba1-0186d83f407c", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950907, "uuid": "5260f147-122a-4793-a0c2-968a9efd45b4", "value": "6144:iUctoP/9NK1hrg7lBOhRT0/dolaDANelB01Sj/zOV57SC8ozkzkrLrwaf:ReoPHyzeLOV5zts+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699950907, "uuid": "7db28d2b-d6bb-4543-bf74-578ab62a5eb3", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699950907, "uuid": "73da45c1-77c6-42bf-b019-15c5f6ee0181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950907, "uuid": "bab2477d-acd9-4abe-b787-a1c4a7fcdb6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc12aa0-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699964633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964633, "uuid": "a4079945-2d3b-4cfa-8b6d-1be0be34b85b", "comment": "Malware payload", "value": "1f580cc01d365bca5b1c51905f25792d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964633, "uuid": "3afc5559-6089-472b-b2d6-133656464c2b", "comment": "Malware payload", "value": "2c1ac1fdee3753349c582a5a518c301baee1144d0ab52827792919dcf3e4c7cd", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964633, "uuid": "8fe0afc0-cf4e-4fa4-9653-4b0029b11b6a", "comment": "Malware payload", "value": "64e659f50b73ca0a0b58981038a0a50a22e9b572", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964633, "uuid": "ce5b078f-4c89-407f-9230-a2f2273802e0", "comment": "Malware payload", "value": "7d3ce6b78e4b06c82c240edab16507dc98c4b2b03a30edd34005d032298397f462ad2d17b1f5cd7c4cbbf01dbf4e62aa", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964633, "uuid": "9d97b576-3f9e-4a37-ac98-e54f44bc1025", "value": "T1373633C4B3FFF4B74326849683FF1EBF9959421110EDB6E42396CE1451E60A3A9D5223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964633, "uuid": "254cd796-55b9-4545-a4a1-d9d6154c14c4", "value": "98304:xWaCIXG9LsW+V/wIjR1ZahwjaU/Y7omXVN06+gTI5vZrKsCTLNyhcX:xWlGWYW+uuzahY47omXkwT8xrhhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964633, "uuid": "6e16a429-e94c-4757-9169-993d7552230f", "value": 5220170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964633, "uuid": "ebbd5019-756b-4aa2-b391-406d194d5ea2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964633, "uuid": "7fd23955-bfa3-4d5a-9d45-554b0c98b6b1", "value": "PO31100045_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fe5f73-82c2-11ee-8907-42010a9c0042", "comment": "Malware payload (PrivateLoader)", "timestamp": 1699948382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948382, "uuid": "6b8ee87c-2e40-4049-aabe-42f757809307", "comment": "Malware payload (PrivateLoader)", "value": "f353a6519b5c64d48f798d91e5235848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948382, "uuid": "93edfbf2-9838-4537-8c84-f214c9954862", "comment": "Malware payload (PrivateLoader)", "value": "2cb5b2678054dd2f1b93d37a96b927830c4a7da699f061adee370807088257de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948382, "uuid": "1e03a1a6-1f81-4d8e-8650-b92681034e25", "comment": "Malware payload (PrivateLoader)", "value": "b39fccbe042023d3385cd35eec8d418c700a73f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948382, "uuid": "c98299dc-0b3d-4f68-81eb-682f1fc56a95", "comment": "Malware payload (PrivateLoader)", "value": "374cebc2e17dc706e69e27f94d679b28786f15747f5fc7e3b77f58f2652a7dba488353a5b777bad4c998ad06fd88ce95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948382, "uuid": "16c837fe-59a2-4088-ad97-34574b2fdb00", "value": "T1F006AD3235B4AFA7CC1DC5F9A9FD99481BBFFC14A721E71B19683258A8F1310C85648B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948382, "uuid": "39620c21-0fa8-4194-b05a-2753ae953c27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948382, "uuid": "17148fdb-5909-4ba1-9ed2-d86ee02dcf1a", "value": "49152:AzkFjR9Z9e5LSe70IVHxtWXq9/Z8UZMPq3/hBfcW:hMYgZHH+qEUW4BfcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699948382, "uuid": "2f53b60c-227b-454f-a396-b19aa5fc5818", "value": 3833600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699948382, "uuid": "6dbd9378-c56b-404a-ad26-480d622231d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948382, "uuid": "00428ce3-45ad-4cb4-a183-3d10cd3904c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203f682a-82cc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699952372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952372, "uuid": "a0cef0a7-cba5-4199-afc3-a9c6cff6374e", "comment": "Malware payload (AgentTesla)", "value": "9ff617c3b33f55feaa46c9373c018119", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952372, "uuid": "4f251d8c-25a3-48b4-bcdb-7b947c96029c", "comment": "Malware payload (AgentTesla)", "value": "2d0c195cad42c20024600cfa6643a66c7dfe17ec96cc5f36bddb3b48f53ba0ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952372, "uuid": "983e68bb-72e9-449b-a1b0-7040220d5847", "comment": "Malware payload (AgentTesla)", "value": "14f90b46e38eba59be48f2ca9f0a6d742999a9f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952372, "uuid": "09ee045a-b5f9-441f-96b7-0fdc3437c71f", "comment": "Malware payload (AgentTesla)", "value": "01687fecf9ed0cfc55477393fd4c2022e65501ad2674d23357bf4ee5a8b22446f7523bbc8b321c630f58d3234b7096fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952372, "uuid": "78d70287-3c9e-41f7-874a-f6d43bfae0bc", "value": "T15BB4237AFB4D84365137E8623F159FC4D95A4405AB4A2EB3CC076C692DC4E7FF288918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952372, "uuid": "32a5cf55-851b-4682-968d-93a68b5daead", "value": "12288:ggPMxE9oE6p7+wDr6jaGeb9COKGAdibs67Rj4S9OqgLY:guMx0f6R3Dr6jqpCmAAbl7RYLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699952372, "uuid": "e50c1be2-9dbb-49bc-bc5c-d2cd2dd30098", "value": 502648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699952372, "uuid": "c2e68ae5-cd90-4b55-9a5a-37f5c009e9f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952372, "uuid": "ecd0dafd-d546-4250-8530-2afd57652f13", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82aeaeb-832d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699994341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699994341, "uuid": "b2419de0-d7b7-43e1-a0fe-aab119010883", "comment": "Malware payload", "value": "22256e5e0955ca2ed13523f96fd71692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699994341, "uuid": "f85724e5-d0c2-4c0a-977d-cc2777409daa", "comment": "Malware payload", "value": "2d43530c81da22814e9debab6cc5dc8583d87b50c374e84c4ef153b0e51e4430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699994341, "uuid": "89a2f721-16c7-4f18-a2ce-8b89773a7421", "comment": "Malware payload", "value": "92c34885d6bd1ec93ee6731458e73b5ea7168605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699994341, "uuid": "8873c324-53b7-454f-b3a8-c99e011f6bce", "comment": "Malware payload", "value": "cc44006a92b026c0a9f30ee12eb25048a0fb4fdaaad26931fca21f65a50c2b71e26090ac97b9bfe415927354e3aa9e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699994341, "uuid": "d9d24f44-89fa-4b49-9068-22a4b87e7f63", "value": "T12075F165BAA18833D1231E388C2B57651C35BE113638F98B7BE52D8C6F3C6C179292D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699994341, "uuid": "19e385a2-1c5b-4899-bf06-3ea9a55debe2", "value": "cdc4911d356107aaeb7a6bbf11dc8b2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699994341, "uuid": "8b6aa4be-9b9f-4e90-8c82-11949b7a3b68", "value": "24576:y96OjVa87oVg8us01u7C1z5tRHjL9juYHqAcbUkoPudYxjMCDsC7C/Y:y2Kpp15bDL9LWdYxjMIvAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699994341, "uuid": "cd8fb6ad-81d5-48b8-bbfd-6d66fa62d93d", "value": 1692136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699994341, "uuid": "1090d33e-69ae-4b75-926a-d85bd296e547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699994341, "uuid": "1411de19-85ee-4461-974a-b98d009d45eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c370aa-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (Netsky)", "timestamp": 1699964613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964613, "uuid": "2ecaca1e-b129-4f5a-bd0a-28e619b25d7e", "comment": "Malware payload (Netsky)", "value": "003b36705279b27b72c0da98897c0b73", "object_relation": "md5", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964613, "uuid": "a4246d48-6932-4142-b589-80b80ca4e319", "comment": "Malware payload (Netsky)", "value": "2daaafa914c24ec2d2191907e05d92738f5bd0da020bf7c696d1a7664273e175", "object_relation": "sha256", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964613, "uuid": "83bc2a0d-1aa3-4273-9eb0-4443c3ef9ed0", "comment": "Malware payload (Netsky)", "value": "428314559080be8527aeac1d43e97a883ec92d2b", "object_relation": "sha1", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964613, "uuid": "9a47df1b-7060-4a58-9d9c-6927835486c5", "comment": "Malware payload (Netsky)", "value": "28a22de75c342b952ec72cc02e7edfb8a2204168a5fae2c8b5a207f66e1ebecf5450df101b30752de0423cb7367926b8", "object_relation": "sha3-384", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964613, "uuid": "f4fbba4c-6094-4d1e-b686-fdabe6158b0f", "value": "T1F3D2D016EA075828CE590F3A406F6E35E43675064F6B019EBC2E22E53F616F49D39CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964613, "uuid": "97959e31-c4ce-498a-a1cd-880f3d7e3b87", "value": "768:FWkliAnUQYkYKzqbjC5RqHjrYReyZx+l0oKriCPRDL1:0ySsz6jGeyZx+l0TRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964613, "uuid": "3efef622-8b74-46e5-9b20-a6f39507b20a", "value": 29840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964613, "uuid": "7e1a8811-86e6-4ca6-872b-8eb8082a83a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964613, "uuid": "7abc1274-7ce4-4d88-9dee-3af76c9b47ae", "value": "archive_jlandersen.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca09e009-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982721, "uuid": "e320f792-66e9-4d08-8d57-0c63769aeb03", "comment": "Malware payload", "value": "87150244daf600db0922142d0016af5a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982721, "uuid": "1fc29ded-261c-4922-adba-4a4258dfffb9", "comment": "Malware payload", "value": "2eef4b05700162c4b8b9f00d8ef7b0d11e1e273219d30130561293bb429f1850", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982721, "uuid": "e7a243b7-9b3d-4d0a-a7cb-0ba3ad79b132", "comment": "Malware payload", "value": "807a588329837dfd1807dbcfd5c9e1e2b9ffbd3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982721, "uuid": "2725fe2f-2d97-4e6f-8aaa-ca7254488f1b", "comment": "Malware payload", "value": "a3084d4e8df653051ca5fc92e915a628e2c1c5b1d768f48233336684d6bac683c97fc5a094ce83f9aa0da0afb00d92ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982721, "uuid": "5a2801c4-1b00-49f5-a9eb-926b1697e2ad", "value": "T12E94190DF9B1EA63C04E0F31487676F8A862AC164C528ACF279A575D6F322735D336B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982721, "uuid": "d8f90247-4a2d-4355-b753-cde6d188fbcb", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982721, "uuid": "4262f09c-8b5c-4b50-a4b6-d701276644d6", "value": "3072:0HDp7pRuKjsir5HZFQGrsUwF7hplPoutjg0QG0+GCPvaDW8:+RR5rhZFQGrsUwF7vlPoSmE6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982721, "uuid": "b62a643e-4e06-4ebb-b20b-3c204ae6718f", "value": 440484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982721, "uuid": "c1eb69e5-a298-4836-abb4-23012d044860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982721, "uuid": "ceb28e4c-0d77-4d4f-82dc-f72308bf1eb0", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.17783.22475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79e5158-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982690, "uuid": "e3aab761-c031-43ab-9e5f-cf9131317e29", "comment": "Malware payload", "value": "a95ce3ff10518911ba00a2054a4ba3b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982690, "uuid": "cf03db1f-534f-4edf-a43e-06e9469e8618", "comment": "Malware payload", "value": "2f9666700b7a72f77462a3bf62380c47989a0a47e80c544a91b46c3b39d023c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982690, "uuid": "427b913d-1f2c-4ed9-8538-35f03edfe840", "comment": "Malware payload", "value": "f929397d7eaf31be97ee165dbe3d7907e47760b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982690, "uuid": "084e90e7-aaaf-48fb-8855-d009700861e9", "comment": "Malware payload", "value": "97ad48f89b1d77ef925e0b8621a8ead1dd80b15736d251f713c5887e657c443986880e4a24304b63ac9b223408f34517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982690, "uuid": "c848bd3e-e32f-49f5-843e-764a934e3658", "value": "T191058D02B9C384F6D621153128EA6736FA75EA020B24CFCBD368DE7D5DB2150A97712F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982690, "uuid": "19df5d2a-f0fb-4833-ae3a-f9195f1c2277", "value": "38a12a1f2bd1a21fcb6403b353bdb756", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982690, "uuid": "c5c9a3fb-7a3f-41a9-b455-f9e0ffa7a5a8", "value": "12288:nqEerZ8UrsqZTJJsnzbWmIBylrTli+FRG3mu:nqEeyUrsmT/snnWm4ylrpi+FRG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982690, "uuid": "66d5c12d-49b8-4dd6-a9af-2fb3473550b0", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982690, "uuid": "37f71488-8349-493d-8f04-c05ace611048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982690, "uuid": "94f38ec6-1c43-481e-ab6e-26b25eeede38", "value": "SecuriteInfo.com.FileRepMetagen.11969.7679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8919219-82e4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699962908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962908, "uuid": "8ad08958-5752-4dae-83e7-e65c86a5e59c", "comment": "Malware payload", "value": "14b799dd88c59a208449617019d76b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962908, "uuid": "c0a5bf41-c0af-4f96-94e4-a547bd90f4b6", "comment": "Malware payload", "value": "320f28727f308f0af628c0c1caf800bcb1754bd14df74361d5cefbaa5e148a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962908, "uuid": "bc2632c7-bbb2-4889-b5ed-a5a438545602", "comment": "Malware payload", "value": "ea2d7aa7ddfa0b4bdadb10576300f7cd3a65f1b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962908, "uuid": "82e5bc45-31e5-4ece-abad-8dbf667564b1", "comment": "Malware payload", "value": "285b801590aadd87fbf0de2b546326b6cd716878fc681fac4b01954c9a7eadbd6daf546a184dd1fbb6e3aa2b7a352f5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962908, "uuid": "aee229c3-fcce-49ab-a866-0a538c445234", "value": "T19735D103E62190F5E9F381B441A2A73BBB347864631457CB93C4DAA65F336E0ED3971A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962908, "uuid": "52e2ec1a-0e6c-4fdd-9769-a45280c39aa8", "value": "24576:qDio6cRb+RLSI7BEy8294pBZEA3HOnPi09gdkWVL5E:qD56cBwSIH+GA3IiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699962908, "uuid": "4930e5ee-fda8-401c-b45d-40186d98c003", "value": 1151502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699962908, "uuid": "1ee12787-b48d-4621-9c94-0b07c793783a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962908, "uuid": "7adb0048-9ba2-4523-9cd6-71b5b9dc984f", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22837376-8325-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699990601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990601, "uuid": "fb95b5c4-546c-400d-bc64-606574e7580a", "comment": "Malware payload", "value": "be8bc5483da0c1f246eb0e57c72d20a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990601, "uuid": "292a82c9-56c8-463f-b288-498018a9aebb", "comment": "Malware payload", "value": "34254e7c3ec86e864cfc6f88a62bb25187cddefcfaaa6079926ef374fdb74b5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990601, "uuid": "ab095541-d424-41d4-b30a-0c9a4ddde9a0", "comment": "Malware payload", "value": "d102b141ac191c7547710f0d3367afaf9185c966", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990601, "uuid": "3bf9249f-333d-4c5c-9ca3-cb58d98a9b9b", "comment": "Malware payload", "value": "beaeb4f5d118b6e157bc0a53b3804214d2118aa73dfd3c2c55b83e0c913412c9484ac5b13e72e763a6f59e51284a777d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990601, "uuid": "9c851304-8a34-41a3-9675-09f1194e262b", "value": "T188833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990601, "uuid": "274cea7e-8d74-41c3-b111-61cd38421173", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCmdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JRBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699990601, "uuid": "b02eeb15-25e0-4cd1-982e-d8869a35a44b", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699990601, "uuid": "621ea365-2f04-48e7-af8e-9bc35b3f249a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990601, "uuid": "424496fe-cd11-433b-8d8e-497f12f266e1", "value": "be8bc5483da0c1f246eb0e57c72d20a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda6d6da-8303-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699976339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976339, "uuid": "789abd22-da96-4d17-bfa9-e71094a07b02", "comment": "Malware payload", "value": "179d6ab7a0382f44d4dd40ed80e40e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976339, "uuid": "42cae04f-022f-4600-ad8f-d6d244446623", "comment": "Malware payload", "value": "349f4ed12f7b4cd5d2cecc282f03ca70a28518094973e66749086920ec47fea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976339, "uuid": "d15bdb34-ab22-4b29-a1be-d98e1bcf8a9d", "comment": "Malware payload", "value": "be3c4dcc6fadf0d475c8cf6d4c1ca7d51bf607f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976339, "uuid": "173a8a7c-ec67-4b8a-b8f4-0dd5f5ed1fe3", "comment": "Malware payload", "value": "d518fb5afe7dab5bb32c410bad338b7bcb4f43e1c06103093254edf29c8e8c61464a219cc9da00fcb86d3b730f4019d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976339, "uuid": "9144069b-7b63-4c39-9104-abaea1e97322", "value": "T13514BE2137F1C073F12749344A72C671BA27BCA25BB189CF2BC45BAA4E316D1977532A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976339, "uuid": "9f251a7c-708a-4cf3-a1ef-9af27d8cab6a", "value": "934ec125307f845a986ee85bb76bb1de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976339, "uuid": "fc7e040f-c885-48d8-847b-77f33530f7b0", "value": "3072:Efy+L8iuHk4IcMOodiJyUvKVkFaakWhJZ/2cwdof5dztM9S7zsJXopN5Ac:WuEFcMjdiEkF3P/Edofac7gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699976339, "uuid": "82509ce3-a57e-475f-9657-a8dfe67660dd", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699976339, "uuid": "8934cd99-e248-4dce-884a-fb57b04fda2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976339, "uuid": "ffde8b85-ece4-4c3d-98d2-2cf1dc53a33d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0de063-82a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699933629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699933629, "uuid": "29ae166b-4ae2-4262-a9c6-e5f6701ce83e", "comment": "Malware payload (Glupteba)", "value": "4a160637f5d25483b11a823ca58c93a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699933629, "uuid": "682a4c2e-1567-4ffc-95f0-13d53bcd110d", "comment": "Malware payload (Glupteba)", "value": "3648e16fc4cff692d591d0074ce50481a5a3451153a875ddde85ee82dea63614", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699933629, "uuid": "25013701-6a4f-44ed-95b4-72dfab1ba5a1", "comment": "Malware payload (Glupteba)", "value": "33a200a5d4cfb7d8091c81577a288c8a51c0e836", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699933629, "uuid": "78118664-a1bb-4898-bd05-56e77ef1e619", "comment": "Malware payload (Glupteba)", "value": "69aa03384f8ff8e6e858010b71084d3fea887fb610ca3ecb51b1f2410a444ffffc417fdde5b3b17015b016fb500ac443", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699933629, "uuid": "ce89e706-23ee-4372-a90f-95d8423a4311", "value": "T1B7163301E2E1386AE5226F738B5EC4D5970FB8411F157AD326F4FA2F05712E1E2B7A18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699933629, "uuid": "3a2976e8-6202-48f7-9f84-c4c509d8dc5a", "value": "712435bb703a50bc9f31469ee9b68197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699933629, "uuid": "8174d269-6e1b-40b7-90ce-f43c61ae36a9", "value": "98304:w4l9x4SDKXuoqFbU6eEkouqgF0SeHydhPSuChdJUHO:P6uoHPlpF7ekh6uC/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699933629, "uuid": "37f7b539-df81-45c6-874f-00280a0f0b3e", "value": 4356504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699933629, "uuid": "5db6749a-bd28-48a9-a2ec-b4c334234f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699933629, "uuid": "0e5a6502-d70d-41e8-98e2-966c7490fc87", "value": "4a160637f5d25483b11a823ca58c93a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273d8787-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699964409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964409, "uuid": "7b81a943-3718-450b-9d7d-87f78090b299", "comment": "Malware payload (LummaStealer)", "value": "671f677114ca5a4015889185520ac4fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964409, "uuid": "706e8a97-ea29-4829-83eb-aab572c92d44", "comment": "Malware payload (LummaStealer)", "value": "371178f2c72748b41e33d1862f900e09d955f884f4b59857073c409e61b254ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964409, "uuid": "d5da7df6-d13f-446e-97ca-bcf86748ffa8", "comment": "Malware payload (LummaStealer)", "value": "ee6c0402d18d324f9ff5e108d2feea23368c7308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964409, "uuid": "a62cbdc3-528a-48a2-960d-7b98f5bda98a", "comment": "Malware payload (LummaStealer)", "value": "2ec4ea3646402432c370e7b8be652094f2d1d82fe1bb1d633b30e3839e55dd83fd2fc2838f13b34ef90fadfd6c0ccf7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964409, "uuid": "e96990cb-faa7-49be-af9e-101ee4eebabc", "value": "T1C6152203ABC85532D4B05B70ACFA03830A36BDF2D9B8835B72C59DA919B3994B531777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964409, "uuid": "7a275e7b-a77c-443d-bef9-fff3af227ce7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964409, "uuid": "48faf77f-416c-4f5d-bf9a-af319d51d9d6", "value": "24576:Iy415FlI4VNE1BhBy5JPBPkA8ArVo8BljJ+7568vW:Pu5FlT8P8JPydC1B9J+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964409, "uuid": "0ec0c129-726d-4434-a6f2-1ee8bc469899", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964409, "uuid": "a48f174c-34a3-44cf-87e8-cb419d20e918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964409, "uuid": "eb79dda6-a208-40f5-8587-b64df12de1f4", "value": "671f677114ca5a4015889185520ac4fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f657dbd-82a5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699935700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699935700, "uuid": "69cccf76-6f52-4453-acce-58c04512344a", "comment": "Malware payload", "value": "6ab47f37c4c0d4936569c4d0c8779c8c", "object_relation": "md5", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699935700, "uuid": "e4974bde-eca8-4f6a-b79d-6847bcf05bb4", "comment": "Malware payload", "value": "378a0fb9073a81918cdfc7a87508df39acfc751a9d646cab83cf7eee919081e0", "object_relation": "sha256", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699935700, "uuid": "0b29b83a-8bc0-4faa-a71c-416a4d771322", "comment": "Malware payload", "value": "2c581d3320eee5c4e3e27e22e338e145a74207fa", "object_relation": "sha1", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699935700, "uuid": "589c36ec-d7c3-4ef0-a8e2-cb810822f772", "comment": "Malware payload", "value": "944e93bf8f48700c36fb5988f0b20a888ec7af92d4da68906e16375b24ef38c3495350cdafa253d03171ba6ab630c0ff", "object_relation": "sha3-384", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699935700, "uuid": "f1f80209-dd13-410b-b8cb-e1e54c4d254e", "value": "T19F85A6EBE528C5F46C17EFAEC2A2336B4E426120D9ECB426DD4B429200DE9CFD1D556C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699935700, "uuid": "fce4b2e5-5672-490d-8204-e6b25008b4d7", "value": "12288:vbVyR4eq0CGjGHld/PcowO7dVDB5jRHAk51BQVEs2T4ylW0XDb53FWY3Imekjcew:vJyen0Jj8/Hf4U3gY+kjYp/jkA4Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699935700, "uuid": "fe35fb03-cf34-4a16-8b67-8b2a8357c28b", "value": 1710070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699935700, "uuid": "6e20095e-4202-4461-86f6-40e8f0520819", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699935700, "uuid": "184a628e-c8bd-4166-ae3b-f166bf945319", "value": "CFE26270ewpycLBkGEROrdewpycLBkGERPendienteewpycLBkGERClient2627029890.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3dc961-82c6-11ee-8907-42010a9c0042", "comment": "Malware payload (PrivateLoader)", "timestamp": 1699949974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949974, "uuid": "c51803b3-db71-4711-8f0e-918a17aefb4b", "comment": "Malware payload (PrivateLoader)", "value": "7e2bc6d413a3c4785c131b70bcd572a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949974, "uuid": "0d7117dc-1fad-45b2-9364-159e115f8dac", "comment": "Malware payload (PrivateLoader)", "value": "38981ca59bd6187df55f92af67932a165b44a30587be906232e42f87c160d523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949974, "uuid": "3ffebb2a-385a-47cb-945f-dea527b7fdfd", "comment": "Malware payload (PrivateLoader)", "value": "3055df4d8cba5c45d033f89db933bf3d9f6694ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949974, "uuid": "c1413f42-5dbb-4cf8-8b46-e1db5d451b70", "comment": "Malware payload (PrivateLoader)", "value": "6c50f9e96cf40b653004c3a0572e4c98584049092aa98575eb032bef464ac0c9c6ef4a0ddd27b1bee0e043057cdb779e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949974, "uuid": "0f6a6fb4-ae43-4543-8091-28fce13d6d61", "value": "T12156D0533690EE16D06D243A99CF951807FCE6D8B763DF3B2A4977A864923214C06CEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949974, "uuid": "2f2aad35-be52-4b2f-9ac5-fd443e627fda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949974, "uuid": "f46abe0a-c36b-4dd1-957d-82cecb35e4a1", "value": "98304:aJciUCYr5zKOTweFBUIL8ag+fHL0JxkwTKUweSi/8PyrOPxr:sarBKXer3LboxkHeO6rOPxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699949974, "uuid": "097654e9-2ead-4e79-b698-7cb0d259532f", "value": 6241128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699949974, "uuid": "d750ea4a-77c6-4fe6-99bc-ddad98cbcfce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949974, "uuid": "08d07e41-1cd1-4e28-8098-df863fc43710", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd65a0bc-82d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699957467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957467, "uuid": "cf9fcb89-e28e-498a-97d7-764dd5d1cb17", "comment": "Malware payload", "value": "5f411a87c53e1791a8f2ea9cb26fd3c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957467, "uuid": "fa7097d5-0a82-4bdb-8465-92b0824a39f9", "comment": "Malware payload", "value": "38d18a3ec97b64fa831a7521126687baa6cdbf0a859a92c500549fd25df7ebbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957467, "uuid": "e37a050b-c2dc-4591-89e5-a9bdcf4614ff", "comment": "Malware payload", "value": "5bec2e57680a3cdc66c9117c98d41c1e7d0d726c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957467, "uuid": "824440f6-c6ac-4600-bebe-2608c372d8d5", "comment": "Malware payload", "value": "b2a100c286fc86176f868a9c02b0a4cff81a79b5b2963cb0abee7cf6e4f61cd51a5fa0261f05125bacacd8b2a43d1314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957467, "uuid": "0be1ecdb-666a-4696-b95b-61ec18199283", "value": "T1E9E733A5F1106233E950527758AECFD79A4D37807B14CFAB7F88C3CA785B4888865B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957467, "uuid": "8f3d65f5-8c28-4cc4-8708-aa0ba8aa60c2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957467, "uuid": "26f3da98-44cd-48cc-bab3-7aead940d875", "value": "1572864:zm6uvCMsDeX9pTHbncKw+V9kulozpfHatc6FHQQWLP8J:a6CCJDetRHbcKw+UuOVStc4QQWLP8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699957467, "uuid": "7ab9ebce-536c-4843-9c3f-a166c9517a70", "value": 64532056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699957467, "uuid": "752b36a5-8fb2-414a-8611-f2751a0844d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957467, "uuid": "631280b1-ac99-4b58-a111-f9af155d584d", "value": "SecuriteInfo.com.Trojan-PSW.Win32.Stealer.bupg.7066.3502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8e9e9a-82e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699961516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961516, "uuid": "d15c0811-57f8-4adf-b71c-ba7cd1c7f3e4", "comment": "Malware payload", "value": "56f27fbf4a23fd14a13897446fe57e87", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip url", "colour": "#FE3A8A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961516, "uuid": "0b3e0db7-e45a-4e92-8b1b-8bea51061a49", "comment": "Malware payload", "value": "392624a0ee0d3c34ae9ad9607e9f8683156447379beac0ec8519c70dedbb74d0", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip url", "colour": "#FE3A8A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961516, "uuid": "e9ad10ed-7329-4265-9ac0-37bb1f1cc623", "comment": "Malware payload", "value": "eb25a10ccacec6edf9d08395f75aa93785721880", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip url", "colour": "#FE3A8A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961516, "uuid": "d7eccfb7-0f4f-4bed-bd3b-ffcdd566b812", "comment": "Malware payload", "value": "b09ec1ca8b76fa8ce8f6c4c4abd1b377a4894e98db358f5d96bee68e3e9acf19398a567c7757e1b67ff6c84550a99981", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip url", "colour": "#FE3A8A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961516, "uuid": "d7c2b411-dd1a-4037-b8dd-8304a893e321", "value": "T10BE0C206950F4816E9AFD0B8CC896335AA85056F1929B6A359004068AE870CDABA750F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961516, "uuid": "e983e3b4-9a7b-451c-a6b4-30a72e5c80f3", "value": "6:5j6NNYrnrnAnZBdBu3V/g7B5zTYTqPOydA5+tWlNn47t+lu:5j6NKrncnZBiu7fCqPOyOLll47tau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699961516, "uuid": "7b2accb9-8cbe-4458-93e7-270cd6d2509a", "value": 326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699961516, "uuid": "28a1aeb8-7783-4693-83c9-d8658db2c11f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961516, "uuid": "ced1bf97-8af4-4f43-bc8c-cd546f3be131", "value": "Agenzia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc262cbc-82ce-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699953546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953546, "uuid": "198babfc-fd85-4edd-b3e6-22ccf5cceb2e", "comment": "Malware payload (AgentTesla)", "value": "874a22cb4d674ae3012c7e164c8e1f4b", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953546, "uuid": "141e270d-e2c9-4439-a771-719ced7b9d15", "comment": "Malware payload (AgentTesla)", "value": "3a2f94ceb1020d3f8b4acc81ab39b2b665f07bca06cda87bcce8142f22f2a6ab", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953546, "uuid": "1e0b1522-8ab2-4d9b-a6a4-7044511cfec9", "comment": "Malware payload (AgentTesla)", "value": "fca5eb24a395a46180f17fff363049de197bc2dc", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953546, "uuid": "179d3f74-c0a2-457f-84c7-8496f5350d44", "comment": "Malware payload (AgentTesla)", "value": "467d01b7c901aa7168d7e94e3c0fccec212816704eb10375a97af0b9f9986a8e50903496c9cea700abd662a1be2e9a65", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953546, "uuid": "eb331895-bcdd-4baa-be16-fc22c90c9a44", "value": "T1A2E423B9E4677C6405920A437758E795CDF599C7BCCADCE488863942ACF030D83A9EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953546, "uuid": "7dba7161-f0f0-4eac-98b2-6c0b5abc4980", "value": "12288:WJV1h5vb3GVbmz0iMySUUJVBScaPdJS3guho5kQF4FYF70iT7/Ft4aI:AtVbqbmwiZiScsS3gVkQF4iF70iHoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953546, "uuid": "33e383b3-52b6-4edb-af21-44f9719d8d64", "value": 702200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953546, "uuid": "6ad65588-38d8-49e2-a2a8-5272dadf0b94", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953546, "uuid": "7cb59bde-7ea3-4bed-9ef4-4e243eb77321", "value": "050300933506_DRAFT BL.exe.gz.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ecb1f1-8321-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989153, "uuid": "46d229d1-bf87-41a4-b0ab-f8c50c07ee53", "comment": "Malware payload", "value": "26cddf73479495f6077a75045d8dc8ab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989153, "uuid": "f77cae6a-21b0-4b3b-ae30-3275ea01c24b", "comment": "Malware payload", "value": "3c7dfa7bd2bd84da4d5be3357806bbc792428bb82a5acb0f350c01affd1a7a8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989153, "uuid": "7e8fdd84-fa2f-4785-a4e3-865339aa2b7d", "comment": "Malware payload", "value": "c73b0a58aa6ce785061e56e34e82d7639bcad4c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989153, "uuid": "4808008c-1641-42fe-a85b-8dcc1c997f07", "comment": "Malware payload", "value": "ff1bf073245c21c0dbac92ac0972dadf35f4dd7194616a76bf8d6bd6e9503d7c84f1c8927b3d0f973c8f59016443c253", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989153, "uuid": "a540d35f-22c9-4bad-8898-f53212ef7d1d", "value": "T128B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989153, "uuid": "6665d434-208d-4aaa-a6fb-f50aa5e26fc1", "value": "3072:MSY+46m1qOzssJFPPKNy+AmkZrQAhPDCXFke:06mgOzJJFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989153, "uuid": "a8599df5-30fe-4196-89c6-518ebbbbbe19", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989153, "uuid": "f80b1574-28a8-4bce-8bdf-67c8dde53dbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989153, "uuid": "59604391-e0e6-49c0-a10d-37c97e207cbd", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df889afd-82ca-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699951834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951834, "uuid": "18bcbceb-acdd-448e-b7ed-4f0293948381", "comment": "Malware payload", "value": "0cf947c3d5ed2e3ac3bb3c091d2f6240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951834, "uuid": "ac88effe-801e-4dd4-9bd5-4043633bd9cf", "comment": "Malware payload", "value": "3e5d50f9256e94ff3a0e33bd30c01998a5cf299daf96808747729fb72650eab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951834, "uuid": "472d1a90-b64d-49f8-9539-fd71ac0bd3b9", "comment": "Malware payload", "value": "4866b28bee9d7cc5de63a9461329a313645e53b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951834, "uuid": "166aa652-bb90-4010-93fb-61f66648e719", "comment": "Malware payload", "value": "de73cde62ff833d60523a93d9d6eab4d0ec29b42f1f0a51bfd744eaceb351673562bfca9e75911e67f8488c9c4981c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951834, "uuid": "21d419bd-a479-442a-b92b-4dc6f6d3961a", "value": "T1BE945A30A4C08EBFF5C203B2C59AE974152875335BE86CBB97D6CA5E09662C21523DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951834, "uuid": "9ed19f81-ca2f-4f44-8979-bed05d79a5c1", "value": "1c7d0efed001e965dd9c0307904ea44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951834, "uuid": "92e31099-a1dd-465e-a4dd-dfa7ef601054", "value": "6144:8pIU/FKe4lNUq/Vr58AOD0HfL+YGhNIwXrTCMNHHiXlgdRTa8Ob5lP0:JU9KeIB58yj+YaNhr0KHwb5l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699951834, "uuid": "493e6cba-0f1d-4ae4-89cc-9b806e6629a4", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699951834, "uuid": "789e410e-9bb9-4359-9649-e755549f33b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951834, "uuid": "f778a521-6771-416c-bb65-4d31bd4bca4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5a3627-829c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699931989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699931989, "uuid": "c523446a-e424-4281-bed6-71f211f3bf62", "comment": "Malware payload (AgentTesla)", "value": "6b58a9946a5824fab92ae99e291e8b4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699931989, "uuid": "4785522d-82e3-484c-ac89-53282420346a", "comment": "Malware payload (AgentTesla)", "value": "3f0f2b7e3062679b5ba9559637eee1d3ab15dea790fbf3c85b69fcccb3edc8bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699931989, "uuid": "407a5cf3-8cc3-4fef-8311-97e3e8fecc57", "comment": "Malware payload (AgentTesla)", "value": "d7c29662479214bf18bd31e50d81496178f2fdb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699931989, "uuid": "0495f8a9-fa85-4bac-8249-35f74d8e5562", "comment": "Malware payload (AgentTesla)", "value": "a7f8ecb79a355e21a8a3dc506d86e02354d3bc013f9522f9aee2431a8b77ce2de0145bb4b112e2b9e45cb75572885615", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699931989, "uuid": "578c1439-1401-4d3a-bb83-1a4286aa3294", "value": "T105D4230836F4B712C1BBDBF11438296403B9A56E3059D3984EE471EB2767F871762B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699931989, "uuid": "658d29f9-3a61-4a95-b78f-f1bfed13bff4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699931989, "uuid": "bde96217-e8c0-4357-96dc-5e7ac25c75f0", "value": "12288:/VMcthmJQnvy7qLZf5thSDi4Y3tIup5bB6EcpMf76H2K1AFnS/:D/xWuIsbD76JqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699931989, "uuid": "f5d8bfed-e9aa-4f72-adb6-7e15bebe3964", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699931989, "uuid": "41021dcd-2ee4-4952-84e9-693c9c9397ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699931989, "uuid": "af985dcb-95ac-4a50-9691-2cdce2f9826f", "value": "SecuriteInfo.com.Win32.PWSX-gen.8541.19567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4880e74-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982685, "uuid": "9e628f99-c9f0-451a-86f7-172c8233915e", "comment": "Malware payload", "value": "3278371e727d3e2359e26d73a51f1612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982685, "uuid": "3be5b619-1ba2-4797-aa05-ecae87687f17", "comment": "Malware payload", "value": "3f5c81d5d3aedabfaf11533ea280b538a65b2f5dd9ee6129f38f1684399366f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982685, "uuid": "5a4bc84d-d68f-48b7-8bda-12b66064c9d6", "comment": "Malware payload", "value": "b7f3a4f1b36616c0baeed8344bd4a8836e3d271c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982685, "uuid": "5d82db56-0226-4681-a463-d62af3263a0e", "comment": "Malware payload", "value": "e74de52a0e99f5864e5779e31f19b33729cabd056b4fb7f77a6b3aedcab76b18dca473047d26a5d205713834ea555c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982685, "uuid": "91a124ca-7563-410a-acca-53d0778def34", "value": "T1B994D92D36F0E532C44C09724C72DFB99962F8D24D11874BA69CBBBE2D3E3516C226B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982685, "uuid": "15098aef-e9c1-4acc-a5b2-013057511f05", "value": "edf46b6a9aceeebc55eb9cb33ed4d508", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982685, "uuid": "b7103b56-5b27-43fc-84b5-36b43c2d005e", "value": "1536:wlZoMPWT6OCf5pULp88uWJGta3UV+Xxg+kbPH7MyNTK6SeZZaorQ055REVmS+pOi:wAMbXIVuWJGtUUV9bPH7MyP7r5HgSoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982685, "uuid": "693f830b-3f2f-48dd-84a4-b064ce76e34d", "value": 427232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982685, "uuid": "8853ad39-632b-4d35-a329-ac928d26949a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982685, "uuid": "980d8905-757f-4bfe-be6c-ee32fb368128", "value": "SecuriteInfo.com.Variant.Mikey.158453.24417.11601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de4ff04-8319-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699985600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699985600, "uuid": "f13848b9-b848-4041-8d31-3b8b5eeff86b", "comment": "Malware payload", "value": "2af059a1274721e90ce015d25c3a8ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699985600, "uuid": "1730be03-24b0-4f20-8069-3ebccfc9b744", "comment": "Malware payload", "value": "40870b8167513757fd7d369a7db8f32b828a0ba1540d88324ff19867f9045494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699985600, "uuid": "cb0b4ad9-c330-4d47-a548-99a75aa69415", "comment": "Malware payload", "value": "d490ab573f29a46f9b6f90615123904306e23197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699985600, "uuid": "1f67b78d-177c-4268-b9ce-1c0058752efb", "comment": "Malware payload", "value": "69e0b33009f36fef493b85e5ab4af93456d6cdfc9a8edcd2e9fd26efb517d6654627ded54a4a5eaee8e272007aa7b5c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699985600, "uuid": "7e48011d-0fc3-48cd-9852-f69ed322262b", "value": "T176C50156B651C873E0373E304C07AB566839BE607C58B8466BFA6F785D385813A3D2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699985600, "uuid": "d6d74a48-3828-4e54-bfa6-febe952191de", "value": "810ddebb5441ef7b92d6977b1440799a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699985600, "uuid": "c051b59a-a7e7-4316-b80a-e58b27be4865", "value": "49152:tisGU/DDjqvOS6iy3iWOY+YLqaLOlTrrbs69V/QzO:tL3cy3im3L6zs69x8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699985600, "uuid": "d2316262-3305-41d8-94a3-d263451a01ca", "value": 2545664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699985600, "uuid": "8da714e2-e3bf-41b9-a9c3-7820a30f82c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699985600, "uuid": "26320eb8-ff58-4e74-8dd0-bd5bce4ac524", "value": "ONEYMESD04508907_draft_20231140130600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31efa9be-82f4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699969581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969581, "uuid": "7606fd17-8916-4cfe-91b7-9a737f5b1d18", "comment": "Malware payload (AgentTesla)", "value": "457ba217e61453ff1dc2225ce50d9246", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969581, "uuid": "6577ff5d-c091-4a86-8914-75e0e6a3d34f", "comment": "Malware payload (AgentTesla)", "value": "421bff513232de6adf60e78f45df28ed50b3897a27570596e12f661d2bb4e8d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969581, "uuid": "04686af3-7a10-4624-b52c-946042c960a1", "comment": "Malware payload (AgentTesla)", "value": "4f4c453b728a5c0de525d0be1f2c343c9a61e867", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969581, "uuid": "82a4f8ec-7305-402e-8eb5-36e7c5dafc40", "comment": "Malware payload (AgentTesla)", "value": "7cce2db16f2d28191926f275ff33310cb71f2263d3b0791cc973f329f53a5adc7f6354807796e48bf9696f6a98dbbb8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969581, "uuid": "e48ce495-49c3-4ecd-829b-36abef8b12df", "value": "T1C4D517787E4C1C36DD5DE5F381EB461C3A93C4462719C78A36C265EAA20D7D3A90E38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969581, "uuid": "a2d63d63-4f47-47b8-ae34-8519af4b8125", "value": "49152:lXpQhJ/LbeE1uiNzBR9wgBlCIxYKZiBUyYTEpSvybJZn36zul1GjPxqrF7U0Vk6f:lMykFwF34BEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699969581, "uuid": "177a0741-2721-4dac-9a52-915d0d9123b5", "value": 2922144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699969581, "uuid": "2b0a2716-a38b-405e-9519-19d236ba84c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969581, "uuid": "034e9c3d-9b2d-487b-a70e-2ab06a776d95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1575c3d6-82d0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699954071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699954071, "uuid": "0c0107a4-b92f-4ce4-a26c-aa95d3f66cc6", "comment": "Malware payload", "value": "ea49ef5a9b4de050a56c0dc7393e8058", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699954071, "uuid": "73848177-ad25-4455-91b2-b93e448c3083", "comment": "Malware payload", "value": "42296e0960cd2bebfb412cfe15f7bdf9f8d0fe2587afc0d09fb1f8655a273a87", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699954071, "uuid": "0367402e-44a0-4335-9d09-d9d538d5713d", "comment": "Malware payload", "value": "f8902459e6ec928c4a4688b9c782e8c4998feb15", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699954071, "uuid": "2bdd9390-585b-414e-938d-fd13b022fb18", "comment": "Malware payload", "value": "ef802f93cb9c94a50fd128c47efe0f8dd2a8cf81fff1b67f3dc29dcc950bccec982489956a022db3972100140fd68d68", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699954071, "uuid": "f9d7d392-c130-494c-b334-8cabd72fdded", "value": "T12CE4234D9F4E54E5D90849304B9E9F4F2C8D7A039C997A409D262648E4B27CBFF1CACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699954071, "uuid": "59b64036-a93e-4805-8b1c-c988f65ab1b2", "value": "12288:8DZp1R1nrTDOOotd+ptJcJ3ojnDJyojZ3RaFC8LIJS3cuRo5kQQbjGE5AZkBMmG3:GX7otdetKJ4LDJyojZhw8S3cfkQ4qaB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699954071, "uuid": "27d9b961-ba05-43de-81b9-db36e6c78a9e", "value": 676896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699954071, "uuid": "2d969db6-195f-4a30-999f-d2df06924280", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699954071, "uuid": "5158eb76-bddc-4ede-94d9-4c7eb51656de", "value": "SOA- OCT- Atlantic Container Line.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee42a2ef-82a6-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699936396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936396, "uuid": "42055cf0-fddb-44d2-869e-cebefeb87911", "comment": "Malware payload (RedLineStealer)", "value": "16ef8b5b3fe9fcca6b37396f264f74f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936396, "uuid": "4681ac89-a3e3-4781-b749-361f55a49186", "comment": "Malware payload (RedLineStealer)", "value": "443fecbe6006903b09fa090230b790dd28249f5b17927c4989bc8c8eaad3ea3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936396, "uuid": "fefb9a37-a1cd-42cd-ba5f-8de09c27741a", "comment": "Malware payload (RedLineStealer)", "value": "7b5800ded238777e73ddf4810c40096c601f6aeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936396, "uuid": "2bc0e671-5ef4-4d6c-84d3-4490ec635251", "comment": "Malware payload (RedLineStealer)", "value": "77f6191ceb30ae12fb3be1584d3842eef981c41ccce93fc72ef34be29803b99967462443358f119353acba14e6782775", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936396, "uuid": "c5eccb37-9d54-4220-a1c5-0e0f2608bcf8", "value": "T10CC47C8D73C29632C23C517126ECC27917AFEE2E1971ACBB335F6D688B4027353A1569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936396, "uuid": "adb409b9-5ad5-466d-95dc-33ef9c1991ee", "value": "321e5e3951fac38d82c138eb99f56618", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936396, "uuid": "f0a53b22-3896-4d4a-b456-6e9f20fe39e0", "value": "12288:wp5APy+55xLWmASQAIHDeAFyD0W2hsTnYwT:sTk8mA+ICiyD0W2hsTYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699936396, "uuid": "dccaea13-c62d-483c-923b-0cbf48e82291", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699936396, "uuid": "7991af4c-7a9e-454f-b34c-a5c43913e906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936396, "uuid": "12ac2eaf-2e4f-47f8-a2da-2194539b3e1d", "value": "16ef8b5b3fe9fcca6b37396f264f74f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab3d7eb-82e1-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699961409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961409, "uuid": "a50c3e0f-b2c4-4dae-8086-e55326183fc4", "comment": "Malware payload (LummaStealer)", "value": "9e289cbc351919484c3cd52c4bd31181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961409, "uuid": "6b4d6cb8-a5c2-462b-8989-e77a8afdf6b3", "comment": "Malware payload (LummaStealer)", "value": "4567eee3f0b37c6ce2e213d54820f1fcc2093f97743354bff6f98c57456c182f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961409, "uuid": "6ee51fca-72da-424a-bd25-f0a54eb7fb5a", "comment": "Malware payload (LummaStealer)", "value": "92e3175b769257cb551f443aa0c9f59cc731460c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961409, "uuid": "3bd95291-4d71-498b-8be9-2bd82e6cfb4e", "comment": "Malware payload (LummaStealer)", "value": "e273c25b12f85139fb517b81367c9ebaae2231b1bc1a50ed632bee614de495220409f2c011b50a1ba6ab0077973f5205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961409, "uuid": "00a1ab2a-c8be-4d61-a816-1419b865fea8", "value": "T11B452343BAD95133C8352FB42CFF06831C363D52A578E7772A46682E1C219D59A32B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961409, "uuid": "dbac58c1-0328-4ccf-86cf-f26da0dfe3b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961409, "uuid": "abdc818e-56b5-4d5b-8488-2a77ce797d7f", "value": "24576:kyBxzWrlqvpsAJI52s5Buf9k3qzTuCCbfKyYEjqX8XtvK:zBxSrljA3sPAEqzTuCsXjM8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699961409, "uuid": "239866f3-a406-477c-9710-e1cb0c9c8d19", "value": 1263104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699961409, "uuid": "68174b46-ae38-425c-b873-4ccac5a67b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961409, "uuid": "a81d9a90-f0e9-44be-87f2-01cd8824f02a", "value": "9e289cbc351919484c3cd52c4bd31181.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ff75b9-82d0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699954049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699954049, "uuid": "8303e51d-f63c-41f4-9cbb-d6a7c1c90ef3", "comment": "Malware payload", "value": "7eb57f92cb5e75450801eff7892ecaa8", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699954049, "uuid": "ca9c67b5-1994-4084-ae49-846ba380315f", "comment": "Malware payload", "value": "458f3af48bcb01ad84a623f56afa02b5bc4758b6e4b7c0c3cd1e0224254b1302", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699954049, "uuid": "cf1e1909-e250-4c63-a9e5-07cf387e0aaa", "comment": "Malware payload", "value": "a884039d3fb848a30909af2f0f39343b4e2ee657", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699954049, "uuid": "00b987ee-164e-43f7-9eed-4e9887806b49", "comment": "Malware payload", "value": "831784ae4086bab2461782db0402e676e2d8947901b4c50a8b559be8397e4a7dc57160706f28f3befe33e38b2cc4af22", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699954049, "uuid": "c9356f24-0186-4a25-bd9b-144f5c929375", "value": "T180E4234D9F4E94E5D90849304B9E9F4F2C8D7A039C997A409D262648E4B27CBFF1CACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699954049, "uuid": "50f370f8-232b-46e1-86de-b6103566f39c", "value": "12288:LDZp1R1nrTDOOotd+ptJcJ3ojnDJyojZ3RaFC8LIJS3cuRo5kQQbjGE5AZkBMmGo:BX7otdetKJ4LDJyojZhw8S3cfkQ4qaBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699954049, "uuid": "b34ea2c9-f3a3-4b0d-9dd2-7c73804bd9ed", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699954049, "uuid": "1ba1d805-a5dd-4430-ae00-65cca5699cf5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699954049, "uuid": "2f0a967a-e1af-4687-8676-a33da965f906", "value": "INV NO-2790056.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151901a3-8328-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699991867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699991867, "uuid": "189df729-f9f2-4f7c-8a6e-c6c39228b495", "comment": "Malware payload", "value": "6866617ecfdf7bcff4c2b8f2389da414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699991867, "uuid": "67fe6739-e9f5-45a4-92a2-8e6781dfeba5", "comment": "Malware payload", "value": "48e0956022211b6dde5b2f63169f3b1330bd010f61b19435faa54ad183709a48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699991867, "uuid": "7121866f-ebce-4266-b8c1-750ca5efae7e", "comment": "Malware payload", "value": "39dcecb8805184404eb66d286c2cff1dd919058c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699991867, "uuid": "fa12bae0-04b3-4cc8-bf4e-0a2e67727be9", "comment": "Malware payload", "value": "51c7987ae76ccd741422a8ec0cbfa114330ede47fcede5bf80d22965dcfca7882923e4d3c779a1118098bbf7a7c66ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699991867, "uuid": "c86d9ed4-60b4-430e-8eb3-1df27609a80f", "value": "T1FBC4D0017FA3C0E1D783EFB47610E02DD5E924361C1278AA697636A63CFB81538E8E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699991867, "uuid": "70d52297-7654-467b-a67c-4d6fdb13c4a5", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699991867, "uuid": "0a2a2d66-9e50-4ccc-bd74-7ae3d17f9071", "value": "12288:F9XBDXrNWe+MRCqeVSCd0pIARQYl175j1XIE9czx5RPYhnrQH8V:TRDpeoC6haPRPYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699991867, "uuid": "a0892c6a-737b-4293-a319-6bde5a937e79", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699991867, "uuid": "5b463d90-b784-4a6a-bd14-f0d26584a8f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699991867, "uuid": "082a068c-22aa-4bcf-bc8a-e6d4dc60228b", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c691d4d-8325-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699990590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990590, "uuid": "a2a202bc-f3d4-47a0-8d2d-0f3e605122a2", "comment": "Malware payload", "value": "64280fd51ce46b02ca2b40a9d653e945", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990590, "uuid": "2e557cc8-9f5e-4e11-bdcd-c328f964b1c9", "comment": "Malware payload", "value": "4a74258dd1dd503a07111074382b11f791c03e94dddc06d04680ae0d61f98de6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990590, "uuid": "23c825de-f1c4-4e88-be9e-50969a1eaea0", "comment": "Malware payload", "value": "56262ee8c42761ac73d78db837d4268f8c50a771", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990590, "uuid": "4f930b75-2ce5-4db8-8534-7d2ac4c42712", "comment": "Malware payload", "value": "1a662812d66bce89b358cc0bee215d0c2bdc200746dc05281b6c3c6308c42aff9c8e7ab489c8a96285aa4375ef2b8981", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990590, "uuid": "b0c05be5-889a-4707-8b14-2a907cd43ba0", "value": "T10BA3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990590, "uuid": "047b4678-e18b-42a2-ba8a-b8897830851c", "value": "3072:Vgdr2vIBAxMyAOLRcftDhOemuxVqDr78fz1e:Vgdr2vIRyAYclhOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699990590, "uuid": "040ddc0d-3af2-4066-8c29-8c9d6d3b3e30", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699990590, "uuid": "ba89b04f-8158-4916-bc6b-5ae673857b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990590, "uuid": "a16096be-0ae0-418b-858a-553f83ee5566", "value": "64280fd51ce46b02ca2b40a9d653e945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26adae6b-82c8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699950664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950664, "uuid": "4b5b8fca-b9c0-4a0a-9904-297065c14b77", "comment": "Malware payload (AgentTesla)", "value": "1bf654965b7ea20f86d0681bfc3bef2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950664, "uuid": "99c3b7cd-e616-4bfe-ab30-1b8e15a52c29", "comment": "Malware payload (AgentTesla)", "value": "4ae304d194dbeac326186c31c58bbf4f4c87791ddbb048efc34854e75dde91bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950664, "uuid": "04d41e60-6832-47cf-9b18-43fe329b2897", "comment": "Malware payload (AgentTesla)", "value": "0ffc108c58c0ffd2d93fc1cb031b37f30b2721cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950664, "uuid": "2fc91289-4658-4df9-9ab5-8fcb0aa6c3b7", "comment": "Malware payload (AgentTesla)", "value": "5384ab05b4c382565eb626d5403769d68f17156485e641fc8ff1dfe50645a9eab9252afc4b9551b7efcb5e14a2f74e13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950664, "uuid": "5aa1ef84-0002-421d-9275-f0b9c656d1a9", "value": "T14CF401263A2C89B3D22C01F9508A118457B1FF26A563D3844DD7BFE967F37C1EA06297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950664, "uuid": "3f33cc95-9b48-4989-bc24-23ebd7daa10f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950664, "uuid": "34bf087d-369a-4599-9595-7aac515a8b57", "value": "12288:weIplfmk5RRdzO97AVRRjfPndYkanOHZjbtmcSC/OdDrrCKdb:eOk5R/z9VRpPWUxJmcSCcDrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699950664, "uuid": "00436fa8-7ea1-4675-b29a-9f16200329ad", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699950664, "uuid": "bfed3cab-eda2-4cf5-816e-53675fa1d3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950664, "uuid": "f459658b-7239-4187-8264-ad915df1bf11", "value": "SecuriteInfo.com.Win32.PWSX-gen.21925.16666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0270054-832c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699993845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993845, "uuid": "80611673-b9e1-4b98-a332-e5a50376a1bb", "comment": "Malware payload", "value": "039ff5b2862f123da567b988989b9082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993845, "uuid": "035350b5-732d-4015-9fe5-ae3910b30060", "comment": "Malware payload", "value": "4c256301fb8f2014ab40834fb87c03223585c52a23cd5977ff8ba31b9218632e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993845, "uuid": "0546504e-9259-4c2e-a911-48bd05f5b718", "comment": "Malware payload", "value": "c0001c675a6a36c4a59c8f057b95c809a8a047d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993845, "uuid": "c439a9d0-b55d-4136-99fd-2432c7830b13", "comment": "Malware payload", "value": "b775071f7449d32df75a1381c79a4958210c7c39b42da35e34d6a475ecbde603eeb3ce45de8e55ca647de1190daac870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993845, "uuid": "33d2d4e0-6e86-4461-a14a-a88a8496b5f9", "value": "T144D4BE9239D971AFDC2F8674031FEAB22A755CE07391096E4F80761E4C3664A90EDEC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993845, "uuid": "6c7a64ef-b639-4545-9759-bb7ad6812128", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993845, "uuid": "be4beb40-5428-4cbf-bff8-a165dee45561", "value": "12288:1aC5nhe2e5xEYiLhwhndXxFiRexuTMZQSPqpivmX:T5henxEYi18hnBVJqpxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699993845, "uuid": "30ab96e8-e699-4963-8cf4-1cdc19f8fa4d", "value": 616304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699993845, "uuid": "5b30210b-bb24-4ef1-9dcd-2e31c456579e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993845, "uuid": "166be2e4-fb0e-48d3-9960-3d786466d30f", "value": "pedido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d0cf57-82d3-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699955708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955708, "uuid": "66f7117a-4997-4b97-a52f-d343901be7bb", "comment": "Malware payload (LummaStealer)", "value": "60b345feed921142d86737e3c6897b0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955708, "uuid": "4585fad1-1774-4e5c-bc25-131a676e8b6c", "comment": "Malware payload (LummaStealer)", "value": "4d201919a0ebca66c9444a66f9324fb870e4af25252f27aa405255cca0167379", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955708, "uuid": "60bbc6da-298f-4751-93fe-b7b4cc8ef4ee", "comment": "Malware payload (LummaStealer)", "value": "34956700dd049b0d91cad261f0053aa14a2c95a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955708, "uuid": "cf7a41fc-5d06-49c1-be22-b692d07213e5", "comment": "Malware payload (LummaStealer)", "value": "cb78f5b07bb9f5aac1c7eee42b942ebaecda357ec382618b16f48bd1fc151f5c824954e56df988df966db92dab962e9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955708, "uuid": "956d7ae4-7c3a-4e75-afc7-f7d9c09c2717", "value": "T146152203ABE8903AD9B53B7098FB56831E357DD15EB143DA2780695F09F1D94AA3033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955708, "uuid": "3eb3a14c-68b9-48a3-8f3b-7d05a21b94da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955708, "uuid": "bda64df1-f3e6-4c79-9272-184ca0654158", "value": "12288:+MrHy90LW8MrTI+xEBRju2M4iFA1ejxeeuzxQikhOEufTJlnGYJjr6bycGDTFyQs:5yFI+xmju2gO4KQ9hfqzHgy0Qpyo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699955708, "uuid": "68eae7af-9a61-471b-be5e-3c623a319039", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699955708, "uuid": "624bcc43-0051-4fc4-8cde-bc2f478b4313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955708, "uuid": "c9620d33-598d-4a8e-955f-e0601edb807c", "value": "60b345feed921142d86737e3c6897b0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6d370f-8286-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699922433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699922433, "uuid": "0904ba29-6d9d-4cc8-bd05-ee6ed846af6f", "comment": "Malware payload (AgentTesla)", "value": "4d8fabdb224a3485b2ebeb70383b958e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699922433, "uuid": "b59b8085-bbc8-413f-8d17-f2463e7c2141", "comment": "Malware payload (AgentTesla)", "value": "4d305c7b6bd72d5b82c7d3610e3d361983ffda1060b240cde90ca7920bdef685", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699922433, "uuid": "3d2549f7-1bd6-41ef-a4a9-bf0f86f7fa2e", "comment": "Malware payload (AgentTesla)", "value": "36f2cc4d08aecba872e21a0e5600c99852f29893", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699922433, "uuid": "fd76558e-920e-405f-beb8-279dc8170ae7", "comment": "Malware payload (AgentTesla)", "value": "c12fabaac3a471fa31910a4e5a1e4c2968cd5c02983bfbd444d76faea47254cffb7b447352e4a19c2849e7b5a98f2b13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699922433, "uuid": "d6b9a76b-bf44-4b75-9ffa-159bf6d990dd", "value": "T16CD4235B21B4BBA5DA7A8FF904305A80137262CB6196F78C9EC436C72727B610F93717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699922433, "uuid": "27444878-1014-47df-93bf-37be3092b6b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699922433, "uuid": "52eb9798-cfd0-4f35-a7dc-4a52fd5d092a", "value": "12288:cVMcthmJQYdNbmHPcp4L5+mLwkdulluxwRWpm0LJJPjmBMAFnSs:9y8qkluxw+m0LPPjmCqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699922433, "uuid": "d0080a60-3770-4811-a2e8-f488632fe4e3", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699922433, "uuid": "bc5e770f-d35b-496c-9ad7-e6ef2e068810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699922433, "uuid": "7a5d7a4d-d00b-4552-bb73-fd5e28c549f8", "value": "SecuriteInfo.com.Win32.PWSX-gen.22036.22983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b54b5b5-82e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699961061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961061, "uuid": "dc9542d8-66d1-4779-abc0-c8d0a31522a6", "comment": "Malware payload", "value": "ca18c2fc430d73758ee4b12f5108e413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961061, "uuid": "cd04ea7f-0993-4ec6-a94a-610f7ff7c06c", "comment": "Malware payload", "value": "4f3d3b8e805a031fe8eeb47dca418fcbcade5d0190ecdee8930e942c9b4028ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961061, "uuid": "ee196182-33e8-4191-9ab9-37da22224f94", "comment": "Malware payload", "value": "797ae4efd35ca73e1666deda68b9d0abdfd085e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961061, "uuid": "944768ea-d617-4c15-9e75-4a0074e754b2", "comment": "Malware payload", "value": "5c7ab33769b223bd75e9750b50ab369c1de5e2b2e457b160b261335d4c5278dfb5212c256dc6abd168e3eae8690c63bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961061, "uuid": "2493fd95-6b4c-4d41-a23c-65e991a668c9", "value": "T168073987F86141E4C1EDD3348A729167BA703C9A5B2027D32B50FEB82E72BD46E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961061, "uuid": "795bb8f4-1e77-44d7-8081-afbcd8106f81", "value": "b2e121c8fb86c781c89c83ffff7fe337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961061, "uuid": "e7aceb7e-2f23-4643-8a7d-f4ffcec84770", "value": "98304:YcOtBNNniQV/NEGlDJjvbAZ/ZPAqA03ZVE6Nxahm9oc:ij/u69ILoqlZmQxaEWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699961061, "uuid": "2299c171-e2f8-45e9-9341-4274dafabea7", "value": 18351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699961061, "uuid": "4863f452-887e-4c4c-bc44-a7640567493c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961061, "uuid": "885a9305-df78-49d3-81f5-b03e7df18671", "value": "SecuriteInfo.com.Win64.Evo-gen.24822.25832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7058a376-82f1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699968397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968397, "uuid": "eb39a44c-9d82-414a-a765-6cb457794907", "comment": "Malware payload (AgentTesla)", "value": "b6e0bf513164cc7bfcecaff52be8b8c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968397, "uuid": "26dcb73c-923e-497c-bee8-cdb9b9c63705", "comment": "Malware payload (AgentTesla)", "value": "50174c869349bc2bbb082345c016fb75442f9858a91208180f5ca49ada8e9c5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968397, "uuid": "8bcd43c5-90fb-4afe-ae95-f03bd7418461", "comment": "Malware payload (AgentTesla)", "value": "6065fa151f15eddcb31a870f142ab2350ba3bdbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968397, "uuid": "4b398cc3-2813-4be7-98f9-5f9141f345e7", "comment": "Malware payload (AgentTesla)", "value": "34fcc1cce22ade5b4f7e38b576b4a7e9232f0aa4a5a10d264b9ae536739343398a0309b1812f78cef14c53c00a3c89e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968397, "uuid": "04f5466d-6f02-4c11-ab0a-9fa89a62ec26", "value": "T1CD751913B74B8BA6C1682337C697460C8B70DA816313EB0B798AB36D6DD337E6D45607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968397, "uuid": "d5cb0230-e9cf-4d7e-b839-cdde3a873c7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968397, "uuid": "ac5e514b-a061-43f2-a2ce-d05d3bf58bed", "value": "24576:t21fUJTAEZJtD7ddi9jZioDtt1gvnxJDH4:MsJMMX+jZioDLuxJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699968397, "uuid": "ad3b1346-86db-444e-b894-87b47c812b56", "value": 1612136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699968397, "uuid": "db6e009c-b5eb-4455-bb00-e3d38ca84fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968397, "uuid": "a2131106-b041-41f6-b519-bb9d98c02503", "value": "SecuriteInfo.com.Trojan.MSIL.Agent.14711.4148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4231c1-82d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699955561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955561, "uuid": "47f0c7a2-5d0b-4a27-8ca3-0cc908c226f2", "comment": "Malware payload", "value": "405d75031e7e3af597fca236414a144b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955561, "uuid": "039f8def-4470-495c-8b61-abdb81198306", "comment": "Malware payload", "value": "51024442ed796e4de733bbbc83457b1cc193ab447e428a2a58972ce338864b6a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955561, "uuid": "dbc43afb-11d5-4a59-a938-38bbc1ab50d1", "comment": "Malware payload", "value": "b9d0d0ad4e7013b9f44c1beda0d732c7665dd1e5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955561, "uuid": "09b5782d-7335-4b45-aa01-37e41c17fcd0", "comment": "Malware payload", "value": "6834f0d9530fe777f1f534f10179c40728e7af764d29434fdb4dd52e32e9260a4e6ed59b232220e9a9e1d8c3210bfda3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955561, "uuid": "9f75ed51-627c-46d7-9d19-d9f4bdd219b1", "value": "T1DFC423ACE622BB4757A04E974E26D04237336C7A1945CF9C97B013E63B2BDDE1912783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955561, "uuid": "c5cb842f-1ad8-42ad-8a8a-fe4d67409ac3", "value": "12288:8ucQk0Q664DmLza2lsVu4H624E0MVvh8sANKbU2Rz1lG74ASoN77Mhp:jssrSLuii62aMVpMYbU2h144ASoRMhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699955561, "uuid": "fd5dae92-e1f6-4309-a1df-d24b774dd634", "value": 584699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699955561, "uuid": "d91f4b62-3792-4f9b-af91-d5e9b76a2dfa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955561, "uuid": "5b7dd3b8-f4a5-4a13-84a3-9abd7bd263bc", "value": "shipment Inv.API23105073013565.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c635c030-8321-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989157, "uuid": "092db871-f678-41ed-8605-6a23cc676f66", "comment": "Malware payload", "value": "e01ec54432849c68da51c4fdcafbe9b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989157, "uuid": "b904066a-0443-4a1c-b457-65a0607ed8d1", "comment": "Malware payload", "value": "53d5d833fb1e0b2df11b1c33e696fb490576d1a54b9d509eafe19afa9ee67912", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989157, "uuid": "19d6cca2-0244-4e34-8619-c6fd63380a47", "comment": "Malware payload", "value": "bbb8f5b72d077fd1ad1443056af94de222dc4682", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989157, "uuid": "9aaa8e3f-279a-4189-9677-adf7e0f636a8", "comment": "Malware payload", "value": "37adf3bb170c53d0ba611346118e34ebf634f77e3e76ab39b09c5d4c48f9d1792c3d161328f8353a0cb5f879aeb44ecf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989157, "uuid": "bb2ee467-c519-43e0-a414-003e44070f7d", "value": "T174C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989157, "uuid": "002e2948-fa18-4650-9834-011f8987ee53", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBe3EdWfRZrmW+IFj:Ted0W0MZQHXd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989157, "uuid": "42abf506-be29-4778-8bca-b4fe7b86ec91", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989157, "uuid": "5bb7157b-c4a0-450d-a056-0387c0117e72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989157, "uuid": "2bf652cf-5e2c-4760-bafb-5c016e07dd14", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7344d66a-82ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1699944780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699944780, "uuid": "698bd659-8659-471b-9e58-508c3cb44cbf", "comment": "Malware payload (Loki)", "value": "3a410dd99563f02be72cb9e96b729429", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699944780, "uuid": "fd9bee69-a5fc-4034-a30e-df6abcfe0e09", "comment": "Malware payload (Loki)", "value": "542e4e849b04fa8953a08ecb6ddd300120855e69c9f5df0975ddf1935eacf408", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699944780, "uuid": "1b53f011-30bb-4e6b-ad98-20eaec79f57d", "comment": "Malware payload (Loki)", "value": "b6b509b4ebccdadc6b42fa7fed8524cc9db90e1b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699944780, "uuid": "a438bf5b-cefc-46c0-8aba-8a4189273cf7", "comment": "Malware payload (Loki)", "value": "826abf4e3d45af5a1ce931623820922b1a5f0479212f5c137a049d9941a4f0022f2bcbcaca86b7f1f9d48d538d371856", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699944780, "uuid": "2e927991-32af-474e-ab22-9bc334383e52", "value": "T1C035AE03E940CB87D40C83F46EE34ED91B1ABF04EA965ACB215ABF4F3E706611D5B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699944780, "uuid": "8a208d88-8fc4-4f37-8dec-d1de0b39cf29", "value": "24576:gBdw6/0ZyU3bVNw6/wZyc3bVrkATwx6ZxiJvWRT0lxO:b6/m93bV+6/CL3bVrLTrrAvWRTGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699944780, "uuid": "89710691-1942-4002-9475-6d111c4257ec", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699944780, "uuid": "b176c632-996c-4887-8f99-e3d4aedc923a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699944780, "uuid": "76475e81-5359-4227-8bcb-f55c9fbc3644", "value": "BL.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c8a419-8342-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700003036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700003036, "uuid": "fc53210f-1a8d-44b2-ace9-c1e22542ef5c", "comment": "Malware payload", "value": "eba7cc1d50adab9015ecee5ae3512fc5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700003036, "uuid": "596f07e0-ae36-4f9d-b60a-b40d65515a45", "comment": "Malware payload", "value": "54376ee15cca7c6cdecc27b701b85bdd2aa618fe8158a453d65030425154299a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700003036, "uuid": "49b75320-3af9-4372-8664-d6015fb27806", "comment": "Malware payload", "value": "6c90360abc9605eaa09a630217f14961c30ac70a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700003036, "uuid": "9a624935-958c-477b-b017-a4212b98823e", "comment": "Malware payload", "value": "d982707459d51c2675590e9764978c9c71dc2ac6ecca37ec75033ce31c63f99c65b1d3d3d64230e5819bb035fe90b065", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700003036, "uuid": "27785231-33bf-4d81-8b37-49166aadf970", "value": "T15514137C45650062C89B04F5C9B71EE5EA92BC6FC2F21B952E17DA49C4983CEFFAC025", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700003036, "uuid": "7325b024-ad9d-4583-b673-4dceede2a74b", "value": "3072:Jmqbr12nuy5pqp95wIsK7DnWTavz6+OV4Qaw03tklfy6d6sQMD7uiFFDtMHHnRYF:sqbr1Smn17Dr76+G4xw0C5d6ssaA3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700003036, "uuid": "0a8699dd-f0b3-4437-8b07-8209ad47aa48", "value": 196525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700003036, "uuid": "2e09fb19-2a29-4df8-9a1b-834ffc1b5a89", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700003036, "uuid": "f2656d8b-e8b7-4f98-ac2d-dde9d5f3a090", "value": "Lista de productos 2.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b060a3bb-82b1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699941017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699941017, "uuid": "eb09bfbb-b44d-4ac9-984b-a07e69d833ef", "comment": "Malware payload", "value": "ea4942fb0d963d4db2d2bb7d8fcaed40", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699941017, "uuid": "f9cdb7bc-5abb-4928-a35a-e9221fb0ac4c", "comment": "Malware payload", "value": "54991e3f6afe4b0c7f2d6d43dada59b2614ce28f0af811eadf2bf7a213b13b58", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699941017, "uuid": "6305503c-bd65-4bb9-8e6f-983697a35194", "comment": "Malware payload", "value": "34a1a556e312a4e11a0a488baccd3ab2cdc97baa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699941017, "uuid": "2faf9822-6ccf-48fc-820c-377e0702f346", "comment": "Malware payload", "value": "1ea0067db5bb3af2b154a454b53db67737e75150a1fae894289c48a8b42bb406c0aa34efb5b6ab819746b9f3935238ca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699941017, "uuid": "bbf00db0-ce1b-4ba0-8614-353b8dea2486", "value": "T14C8423BF0E3826EDDD00E5251A4E57972CE1DC7588425C5909A4B9BBFF1A7B201FD0C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699941017, "uuid": "26eb6e3f-bc01-42c9-aaa6-f5de04b19661", "value": "6144:VogvHRQ9DqQPXW9zBsgOaF/ELiN2a9J1Xiy0dfONuZODiGr/v4ka5+AyrFDbx8Oe:VogvuPm9Bf/EWEa9Jt6ccZUim/v4kuVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699941017, "uuid": "fdc4951a-0b57-43fe-b5db-0da9417ccd7a", "value": 386876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699941017, "uuid": "b396de28-5633-4caf-9138-a5a5e9aa37a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699941017, "uuid": "234edcd3-d73e-423c-92f0-89f355c361de", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cbe853-82c8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699950661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950661, "uuid": "4d68251e-e037-4263-a685-490ddef3a0da", "comment": "Malware payload (AgentTesla)", "value": "cc5fef3c5892d3d28b133d59b7e88e02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950661, "uuid": "8e56ad38-e066-4b94-8915-7779878df304", "comment": "Malware payload (AgentTesla)", "value": "57454ca5dffc314f665767b53dde6778afe2ef9b3470eadc71ada2130854ab2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950661, "uuid": "dfc0586e-cf8b-46c7-a447-a1eeec74ded0", "comment": "Malware payload (AgentTesla)", "value": "31030ec08e1869698ba1ddb6c48182cde933ae2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950661, "uuid": "19d8d592-5087-4318-bedc-0edc91a13a42", "comment": "Malware payload (AgentTesla)", "value": "6daf22733fe1534b8829192259547815308235631f6c599f33505b7e34ecd158242f9bdb9cf960a77a2400331c809f00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950661, "uuid": "ff74640a-187e-4cd8-8d4c-b967bcb7bd43", "value": "T175F4015636289927D7AC00F9544A52C517F2EE32A1A3E3C90CE77BDD27F2780EB06197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950661, "uuid": "0e749c3a-789f-484b-9450-e91b0fbfd5e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950661, "uuid": "1baea994-122a-4295-89c1-ad4181516a37", "value": "12288:Xis7lfhe7tk7A6rCMQSXfgCamv82duKLqc0rbPJHIXb:jwtkFrpxX7vZuEH03R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699950661, "uuid": "0f44859d-6704-402c-9e9b-7b0c65d036b8", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699950661, "uuid": "ad7b2d3b-e9bd-4443-9c48-b42a3d2a59c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950661, "uuid": "1a0b9e30-fc62-4ebf-b8c8-307a8c55cfcd", "value": "SecuriteInfo.com.Win32.PWSX-gen.12948.27651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1af6689-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (Netsky)", "timestamp": 1699964642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964642, "uuid": "f26620ce-75e8-4749-92b3-8d63ad5ded5e", "comment": "Malware payload (Netsky)", "value": "6e8d0f4667bbd98e14a133a0e62d4eb9", "object_relation": "md5", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964642, "uuid": "9fb20b2c-e559-4a40-9ab0-7cdeb18f72d9", "comment": "Malware payload (Netsky)", "value": "58a6efaa90c5ee105e520c14c687f9ebefd733dd7d0f9eb599631b650804eb41", "object_relation": "sha256", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964642, "uuid": "5ae22ab3-87c7-4086-b830-7f2ea3fd6ae7", "comment": "Malware payload (Netsky)", "value": "edfe1f136d992ac41baa7db6672dd0768b1cf271", "object_relation": "sha1", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964642, "uuid": "912c99b2-3b3f-422c-a3b2-4001e1fbd465", "comment": "Malware payload (Netsky)", "value": "3bf3377b316f7709ee8695e75a20b8dc9c4233245263101011feda01a408492185190af8da167bc7244d8ac25ae75bc7", "object_relation": "sha3-384", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964642, "uuid": "acdb3ceb-3874-47c7-955a-9b4a7d2a7b86", "value": "T165D2D016EA075828CE590F3A406F6E35E43675054F2B019ABC2E22E53F616F49D39CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964642, "uuid": "c5ec6ad0-c0b7-42ef-bccd-8ca1adba8ac2", "value": "768:bWkliAnUQYkYKzqbjC5RqHjrYReyZx+l0oKriCPRDLH:SySsz6jGeyZx+l0TRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964642, "uuid": "08502b75-69b4-4793-bdcf-8c61ddbe5525", "value": 29832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964642, "uuid": "b538772d-32b4-4c00-b0d3-7188e63f145b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964642, "uuid": "9759bb9a-5b6f-46b8-8fa2-d80ba93aa95f", "value": "product.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b8115e-830b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699979382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979382, "uuid": "f3d29257-e801-4ad9-89eb-30deb122ddee", "comment": "Malware payload", "value": "a5e011229a460fe28b1d5de73ca405d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979382, "uuid": "0c3c38a4-9672-4218-acdb-2ceed3fe0dc1", "comment": "Malware payload", "value": "5911b3af7d48ce74fc6644064f176990a34230786598cfd97b90cf5208be7f5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979382, "uuid": "df915874-d781-4aa8-ae38-2988b7bd0a77", "comment": "Malware payload", "value": "231c071f5ac17305d241515057d2f4a2ed0fff26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979382, "uuid": "9b79cfe5-26c4-43ed-a297-f64e0dd777b5", "comment": "Malware payload", "value": "331f30a3214d360c434310e1710fd395df06a0ac746ef5e7f2452d038b2e9355b2c50851b7fb5688cb1a24acbeecd373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979382, "uuid": "ddad7a14-3276-42e0-b832-7dedfd8fd96e", "value": "T1D4B4AE25B9C2C0F1D863243201F4E7769E787931C93689CBFBC46C78DA75690976A32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979382, "uuid": "62287b23-8bb4-4dcb-955b-58fbaa5646b2", "value": "1363911023188fdcc22c09b870728434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979382, "uuid": "bb15a115-f50c-483c-9047-0af743f65983", "value": "12288:gAr1pRE1bJay6OXZ6/gew5JBW2YItxdn:gAr67ayHc0Htx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699979382, "uuid": "e74d7150-43e7-4247-9a31-1d901a9548df", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699979382, "uuid": "f7d72977-8bbd-4108-8cdd-34628a4aa06c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979382, "uuid": "65d8d6a8-02cd-4f96-9541-8feb3a3805d3", "value": "a5e011229a460fe28b1d5de73ca405d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53c1487-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982686, "uuid": "95cf45aa-a953-4795-bef4-bd463ef46833", "comment": "Malware payload", "value": "c64d7563ec95faa0cd724cadc508e1a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982686, "uuid": "0099bbf7-cdb9-4f37-9d39-ab709271d67f", "comment": "Malware payload", "value": "591d2575c173f07028f37e371da17f7727c78d31ab1578b222c976fa5fad2b3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982686, "uuid": "fc545615-bf62-497e-9d00-f48feff2cb02", "comment": "Malware payload", "value": "033b6b035bf96b02404a04de3586d3a793671ab5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982686, "uuid": "2f2fb89a-2288-4500-9660-6838eca815ef", "comment": "Malware payload", "value": "87cfcb92c461cec9e68d05245f878cb207be6eadf41edee63c20747a73a6d70e9b8698ffa31dab0d4e9331acc6f95786", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982686, "uuid": "985d58c6-b5c7-47cb-bbe0-ec8710c39de0", "value": "T15335C052F789CF27F02BC53098A79BA59663EE226F0641173764B38D0D773EC58A5232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982686, "uuid": "4a93beaf-e715-4d2d-90d8-00e588983b40", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982686, "uuid": "9909a91a-7fd7-42b7-a5a5-532643e377af", "value": "24576:Vb7Qf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY1Hq5bY:VX0+s8KuqGaX0ToIBAUZLY1Hq5bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982686, "uuid": "5ea74821-ae57-4481-88b7-6d58ecede34f", "value": 1159959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982686, "uuid": "327e686a-a0ab-4104-a392-37c18a8b6326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982686, "uuid": "6108c856-f768-4b09-8e11-0acdd34e0a4f", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.24509.2120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83476763-82d5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699956403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956403, "uuid": "a4c11d8b-06c5-4302-ade2-cc1100b20f4a", "comment": "Malware payload", "value": "56d76278c62959b6d0525bfcf8b11dea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956403, "uuid": "3d3bb58e-f736-434d-a85f-92b5c1396b73", "comment": "Malware payload", "value": "59bc63fd20252adcfdb6ccd58c036c0938354e467d47bec626c1063791f1151f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956403, "uuid": "77ff8a37-1a55-4b30-8045-d350d2dcfd24", "comment": "Malware payload", "value": "6cc407f97a03ae0ef3322fea35aadd10c9771490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956403, "uuid": "c3d064fd-9feb-4d22-b556-69d61cd4bd93", "comment": "Malware payload", "value": "6c2058b4a613e627b5fc710a4fa79d79def23f83b42440a72103c99debeae0dc83cef517cb6cb2e5f2a04d57b0ea846a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956403, "uuid": "ee39c9c3-2366-40ee-8b90-6de7cbe1f34a", "value": "T1B70733611DC3A971CD860E37443419257ABAF96012097DEF3FB6B54EAC24FC8D920B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956403, "uuid": "cef839a5-142f-4391-b515-5343b1552413", "value": "4dfb85da1495e891078e48fc182e3cd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956403, "uuid": "375a79ef-eb90-4c7d-8568-d26d7e040eff", "value": "393216:FU3CisCIe+eFDdDwfFVS3olcHf8ebX5re8teHIid:y3OCnXFDhwioYtq8woK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699956403, "uuid": "31f14233-99f8-4cb3-ba54-f608c5aaed30", "value": 17961182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699956403, "uuid": "dfdef904-33dc-4ae3-a04a-d218a6d116ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956403, "uuid": "4c1a1ae1-c533-4213-a4e7-78bb73335da9", "value": "56d76278c62959b6d0525bfcf8b11dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6d7e6b-82f4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699969899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969899, "uuid": "1441f591-3780-4158-a45d-6e77b1b85420", "comment": "Malware payload", "value": "4355a9fda1c6e707feaff39d7c5ae8e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969899, "uuid": "2b0bbcf4-eea2-44ca-a356-7cc63c938189", "comment": "Malware payload", "value": "5b8a371c20b16861e2dfc33f4757ffab43c79361a21099d92acda671e46d1f3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969899, "uuid": "f1a91831-b411-4130-a996-0c802a6dc493", "comment": "Malware payload", "value": "bb4b3259ead2dacdce80b1406e649c1e0220ec10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969899, "uuid": "de159784-67e1-4cf2-bbee-538e3d47e49b", "comment": "Malware payload", "value": "d9bd4b2176a15576a6232ec82cd721222ec505dfad75e922cce57b16b7f8b98ab79dd297339a1a3dedb1615bd25d131a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969899, "uuid": "caeb2b82-a770-432d-a013-7c6d45682732", "value": "T1E07633867CD0C97EE7FA0036FA4A7871C072F4058E2168BF5742191A3679C15D8B7BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969899, "uuid": "498bd851-1139-4eb3-a7c0-ba5c8b3bcd0d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969899, "uuid": "48d8f759-eeaa-4a8a-9265-c292d1d7717a", "value": "196608:91Og6ucpn3Av7wMMUzFrbb4HacLUDQNtbkwMNFVmQ3S:3Og6ucN3Av7HMinkzsQN2zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699969899, "uuid": "affc1edd-b5d5-4de3-9479-6cc06ac97549", "value": 7507753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699969899, "uuid": "17ddfe4a-5599-469c-bb1e-285e88bca51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969899, "uuid": "ac3b6f64-40cd-4539-abd6-be404d38d21a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9e8891-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982726, "uuid": "96b074f9-3072-44fe-bf46-2f54ad7fa4ce", "comment": "Malware payload", "value": "9853155dadf1092b2c6c93a7fcba241a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982726, "uuid": "12e9e713-8107-4349-8814-6a506860f974", "comment": "Malware payload", "value": "5dce23221c5c4ce62fb33f2de5438ae15b86d796c39091cfb495ca01f8eb04c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982726, "uuid": "fbe6e929-2475-4c7f-8a9a-9875fe8aa113", "comment": "Malware payload", "value": "29ee3e925339eac8ba80eeebbc7ffc7f86d5bb79", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982726, "uuid": "831110bd-78dc-4164-a6ac-fa80d55aee29", "comment": "Malware payload", "value": "db9229fae20f96f14e3a18f932625bebf70fa04947206b55661940098ce1022a997f063d5615744e200985e558ddd993", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982726, "uuid": "8a17915b-c5e9-4fdc-a99e-343bbc987ce2", "value": "T146E3BE217691C032E59712398979CBF56EBEB9228B7541C7B3E41E7E5F603D06A3830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982726, "uuid": "54a4aca6-403e-4bb5-b710-7cc6290438df", "value": "18fd1b1ec5b58182b9186e8627d5abfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982726, "uuid": "a658a0e9-3493-479f-8e47-dd3093380e4c", "value": "3072:AN2lDKBApWugqRjDJdrijIY/ApAvYy9eUyRzPg:ANOWudTdreN4pkD8/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982726, "uuid": "bf944720-a3b8-4d08-a406-2a73d3f37e1a", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982726, "uuid": "2f3bf410-a921-4924-a850-23465de4a0c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982726, "uuid": "9edf1007-2de6-4790-bc06-062705e7f914", "value": "SecuriteInfo.com.PUA.Adstantinko.9616.6257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c079102c-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982705, "uuid": "55e69ec2-78e9-471a-84bf-fe76c38e52b9", "comment": "Malware payload", "value": "268fc4a9bc8ebc266c40de80155ea59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982705, "uuid": "b0ef9711-f97a-4324-9c84-00ca96479fda", "comment": "Malware payload", "value": "604c88cf909edfb72deda4ba7e0a78a7981fb9420df6e367c174d098e7460f3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982705, "uuid": "332c624c-273a-4143-91d4-1111ae3a5cc3", "comment": "Malware payload", "value": "b48c98403354ddf89c78e8fa9cc94b0aec088176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982705, "uuid": "3945cc6f-cc1d-4ea2-9ed9-4eb5a3190413", "comment": "Malware payload", "value": "8cbbf833fd7948986712d61554a13bbf145c9e838bcbff69de10ffe1be2b9af4c452ba168aad9157139c9a4e552e243c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982705, "uuid": "7de05baa-1bb7-44e1-9262-2423d8e70ac6", "value": "T1FE357C0732915033E6B279364A1B42ADC826FE161D78345A6BF9AC483D35643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982705, "uuid": "81cfaabd-f082-438e-bd51-5378cb014e3d", "value": "12288:2GB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3N:2KvzcrnyaLO+3Yb/wQeAh/7RN1llI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982705, "uuid": "81094340-ebed-4679-9af2-02c12d75a412", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982705, "uuid": "3f1a98f8-36d0-424d-9a46-bfa8dd3d09b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982705, "uuid": "4c2dc127-5c82-446f-a13a-2b7e6ab6cebe", "value": "SecuriteInfo.com.Win32.TrojanX-gen.23832.24960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5559092f-831b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699986391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986391, "uuid": "38ca597f-d0ff-4ec0-8a8d-76b8dbc4e46e", "comment": "Malware payload", "value": "11f0047cdf52787f918a5e9be6da4434", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986391, "uuid": "ab75a017-fc42-4fd8-98c8-813746f3e7a5", "comment": "Malware payload", "value": "60792845a1086b5c2ad77e50f8c4893f34f53d274365e4140f2487a96cf3b779", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986391, "uuid": "282593ac-b6d6-4708-83a5-2c6a0097b8ca", "comment": "Malware payload", "value": "0ce77f271911ba761c210fa769403301a35fe901", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986391, "uuid": "1c9d910c-6112-4ab4-95a3-176b507b8315", "comment": "Malware payload", "value": "53707bd125706f942baa8e73bf17b058025efb13038588edbe79471daa75d4066e92107df84e85e5b1d5343ce3e5d691", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986391, "uuid": "2e9c271f-e1be-4bed-a302-f4347d0bea02", "value": "T15DD302B93D0EBDAACC4615B00EF628664EDD5DC74494105DFE73881579F8B00BAB2E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986391, "uuid": "8d65a4e0-d4f6-49cb-b676-538666cfc650", "value": "3072:gjrYo7D+P/FeorjJNvnwOCbTQQv3iNKoABAjEVGAtYSkT322S:goo7DidTvwPSNhAHV0SkS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699986391, "uuid": "f13fbf75-ab3c-41cc-bcbf-f44f3e018193", "value": 141093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699986391, "uuid": "050fbe6b-c6b5-4ef4-b80f-24198e62007f", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986391, "uuid": "3df5797d-ca46-4a58-819d-0ac4bb062f1b", "value": "Adobe Illustrator 2022 v26.1.0.185_x64_2022.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d95b88-82c5-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699949343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949343, "uuid": "49cf2879-61b0-4542-8dbd-e032e16b840f", "comment": "Malware payload (Stealc)", "value": "e449ef262475500e0cd55b11542b5bf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949343, "uuid": "b840ee27-d909-47f5-ad9f-8f9b0d609272", "comment": "Malware payload (Stealc)", "value": "60e9383ff5038ed988a1b988b66091bac7bf93a6d070763f45479dccdfd9d147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949343, "uuid": "ebab9f70-6e9c-4070-b714-ffed17833da8", "comment": "Malware payload (Stealc)", "value": "f2b77dfcac750b19cb427a45afae1aaf84c42480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949343, "uuid": "06f43595-badf-4dc3-9fdf-e9c9edacf3da", "comment": "Malware payload (Stealc)", "value": "dad89267b46a748844fd1d6e296944256da4d40d32b89d59ca3e714253d19535e29fe1f12a5464baeffccf36938d460a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949343, "uuid": "5e1ae54e-0e4b-43c4-a7d2-5c0939b364bb", "value": "T1A314CF3276E5C072F16345308A72C6755A3BBCA24BA199CF27C42BBE4E31AD1CB75316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949343, "uuid": "81d00a69-33a9-4001-81f6-9998d710508f", "value": "3cf8645c93eebd6a8066c6479eebf80f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949343, "uuid": "7a357c5f-667b-4bcc-a463-5c8854a4a6f0", "value": "3072:olGBz8ibawhM2M3UDoAKLtFze+FA4H3KujaaY6Y:oAbju2MkDZKLzeWA4/jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699949343, "uuid": "d713d033-8c2b-4ce4-ba55-684111ceecf7", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699949343, "uuid": "7324d323-3b36-43f3-8653-00e0965cd203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949343, "uuid": "125b359c-3049-4ee7-9fe0-f6b152b5f1eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbaaafa-82e2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699961900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961900, "uuid": "1818f3e3-f759-48e6-a28a-b7cb36a84131", "comment": "Malware payload", "value": "77fc20429af1048b6e6ffed8121c021e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961900, "uuid": "41c340e8-4ba2-4981-b24c-2176bad56300", "comment": "Malware payload", "value": "61f64632aff22daf8d3587b424dbc312a1bc233f5174c819218b4ceb2141e26d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961900, "uuid": "4680757c-e402-44c1-ba02-aba026462df9", "comment": "Malware payload", "value": "ccf28e428008dcfe16b34bd6ca3725e13a690595", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961900, "uuid": "3d20fe7b-4739-4c77-b410-986f9315bf97", "comment": "Malware payload", "value": "35d047f1e0010f56eb9f63bb17bd941237b23b7a42fc2217ed20e090de0f887a832f4807404c4929ae1bc922f9128334", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961900, "uuid": "32988a43-f988-47ec-857f-f3a6b3f3139a", "value": "T11556335342D6861BEB8A8871056653AC7AC9BF5CFDA472957A0CF8F8D0DDACB4C043B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961900, "uuid": "ba70da25-ae93-4c60-8575-dc84ec4728a2", "value": "98304:DLqCOB4JAeZQrMWy76lwXkvqFyzRaveXHKQSED8y01ie+p1wW:DLqCYyAeslVqTkHtdB0Lw1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699961900, "uuid": "0e5d0781-0d0f-4f23-b9f3-77ff42144af1", "value": 6386496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699961900, "uuid": "a3e98356-f71b-47a7-a63c-bcb5a9ff692d", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961900, "uuid": "2981b2b9-e979-4c58-b605-861aab4c7b02", "value": "RK0R2rX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31178c6-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982683, "uuid": "604b09df-137a-4a97-a28e-00bd0207194d", "comment": "Malware payload", "value": "ae17a5ec7d24306d63a7f3c83c81665f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982683, "uuid": "c29de680-cacf-451f-b089-a5b483a68a5c", "comment": "Malware payload", "value": "6521d0033c9c95469564c86efaefe94eb653f46a1ccb7750968d7c54e0fd90ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982683, "uuid": "41e908e6-a345-47fe-b743-91349216ef02", "comment": "Malware payload", "value": "26d4a342310639a8723201e145248c0c49a1c507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982683, "uuid": "fdf3cda0-680e-4aa3-b332-7518e218632e", "comment": "Malware payload", "value": "959167df5539227ab7ca0a49b0ca919ad5d8b175d02e8fff2bb7eeac5d2211f367fc34e411a47fcb12fcc2cd5bcaf00e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982683, "uuid": "357de031-c084-442a-8551-ec153b47ed79", "value": "T167357C0732915033E6B279364A1B42ADC826FE161D78345A6BF9AC483D35643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982683, "uuid": "30059f40-a174-4a02-ab90-e888770ce944", "value": "12288:pGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3T:pKvzcrnyaLO+3Yb/wQeAh/7RRpUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982683, "uuid": "0cecf8ce-dd92-4159-8f35-58fc188ae9a3", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982683, "uuid": "eb8b39ef-013c-43a1-ba26-da2d62abf4f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982683, "uuid": "46ee68ac-b7b6-4061-bc6b-225d7e2ae70a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26909.14237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5222ee6b-8294-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699928403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699928403, "uuid": "ed9043aa-ea54-4ea6-aa2e-0ff8b97f0291", "comment": "Malware payload (AgentTesla)", "value": "b1a2ee49591c970b26668b86aac51e9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699928403, "uuid": "86ea430e-c88f-40a8-bb6e-25a398904e1a", "comment": "Malware payload (AgentTesla)", "value": "66fc227615863dc5d6d327380c0dbb43cd00872f2e13fc665d3f47b7fd610129", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699928403, "uuid": "e6f71121-0d1f-4b10-9815-9d6ea8bdec5d", "comment": "Malware payload (AgentTesla)", "value": "185ad3c1cddc41a66ff5c654d7185779bf12c436", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699928403, "uuid": "257f496e-a475-4a67-a713-dea34ac8cba8", "comment": "Malware payload (AgentTesla)", "value": "f9463d1f283f3bd641143911b30ff1ca754959829bbc2f165cbd0c36d3e3cac69a017938a1591f40e79ea36c80699a2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699928403, "uuid": "2aec5304-de42-499a-82bb-db92a40656c3", "value": "T182D423163DB85B62D9B5C7FA063919D003B2B40D7127E2EC8EE432CB3A65F850561B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699928403, "uuid": "657e2d18-cda7-4186-a92e-f9427075096d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699928403, "uuid": "13d3c5ea-8f4d-4ac0-8931-4b4ced5aada3", "value": "12288:OVMcthmJ7n3zKa7Tt76s8apiV9Dv8cIwvCmDh2xUXZHx7JNogFgHzAFnSS:/nDKaxTTOv8pPWZRNb8qS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699928403, "uuid": "84856b50-ad1c-4217-89bf-643713edac6a", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699928403, "uuid": "eafa9646-86f5-4b84-ac47-41c30b1b03d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699928403, "uuid": "d511668d-3163-499f-a02c-005217b4b59e", "value": "SecuriteInfo.com.Win32.PWSX-gen.12294.9769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ccba93-82ca-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699951606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951606, "uuid": "c2aecb4f-e857-482d-ab47-e08fac0d8e8a", "comment": "Malware payload", "value": "0e86905861e119f5f658dc8fe328d717", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951606, "uuid": "ac4687ed-527d-4b28-a841-24a162631c27", "comment": "Malware payload", "value": "6767b678fcd5cf5e973501473e540fe5c1c716101b952071f075d9ba0402be77", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951606, "uuid": "17089fdd-a3e9-49aa-b977-b5e8e3f14839", "comment": "Malware payload", "value": "46ad1b4a0a3487a8bab89a736db8e30dfbaf4517", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951606, "uuid": "5da614a1-5b29-41e5-8912-6194b0ed03ec", "comment": "Malware payload", "value": "4d0665cecf2a7d7e0ef85a37819863999420809b44b9c8e161d1dec8f97ff24c5195db10a7866a7c00a29094968b8658", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951606, "uuid": "c407897d-df6f-4a10-941c-886b9b2cc9df", "value": "T1040523B2AF9412B3F721C2BF5C931A66123201441B4F4309635DE591FA0F9AEEB549FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951606, "uuid": "98bcdffb-f421-4f30-b940-2ea89328c8b0", "value": "24576:VlByFbIzOaKFF0BkUBDDP18SCTLgbhTof+0jdH+:VKRIzxzB3F9jCTJBjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699951606, "uuid": "5ed6375c-c64a-4f31-adff-2cffe4065afa", "value": 852077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699951606, "uuid": "e8d84f91-1f9b-4bfc-9bbf-697fd650681b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951606, "uuid": "a8e1b31f-97b4-4c92-b223-d02c61175ca1", "value": "SOA OCT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be47e62a-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982702, "uuid": "cf972b09-874b-46f0-95d5-065690a135a3", "comment": "Malware payload", "value": "b987badafdd7dc9537ec1b1e322f1128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982702, "uuid": "aae3f73c-b2dd-45ed-bee4-6a81cf3003c5", "comment": "Malware payload", "value": "67b6d2863ac03575f1643fd37379908ece6763943a26163d8f72d345bf1dbcbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982702, "uuid": "7bd17dfc-6cd3-47e4-8ad8-4b6cf7755a91", "comment": "Malware payload", "value": "cc8b329542ab3707fc44d86cf939546545844864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982702, "uuid": "e6993e64-7773-4611-919b-b638f14d178b", "comment": "Malware payload", "value": "7b02139aa30696a62c68c03bcff739d111a5e06c9a05f49113f6561525c08a565d308e8d35d3e91b360803c312ecb16c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982702, "uuid": "b2b2de19-8c72-4461-b45e-cd8146052cbe", "value": "T124357C1731915033D6B239354A2B42ADC92AFE261D78386A6BF59C483D31643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982702, "uuid": "cc472c7e-46d5-4edb-845d-1d13d3e17fc6", "value": "24576://iwHPhfykvkHee566vMW7lJB4mnkd1coq7WYLZ3WS:HiqhakYZ4aXBN8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982702, "uuid": "78f2f9b5-0c29-4752-bec0-059d2e1dd842", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982702, "uuid": "64e7d050-d84b-4a42-8abb-6beb7f4a5b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982702, "uuid": "b4c90e38-5dc5-43d5-9b55-71c7fbfe9074", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1245.13831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098b9ab0-82e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699963500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963500, "uuid": "90f38ab1-b8f8-451a-83ac-2a0d5210ef07", "comment": "Malware payload", "value": "3e52bf2532a7fc04d67252bb4f8cd70f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963500, "uuid": "a1bc6dfc-3886-4350-8bb8-64f4b1708c6f", "comment": "Malware payload", "value": "67c980215d2b7daa075a60a95527409258475ab2e6e71a1fa59a18dff0cb0c19", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963500, "uuid": "75deb277-6084-4aa4-a14c-9d75822203c2", "comment": "Malware payload", "value": "78959404740e6459c50609985d7292b132cdae06", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963500, "uuid": "c480b57c-358b-466d-8703-b909cf85eee2", "comment": "Malware payload", "value": "235c35806ab147e2d11182922d7a39e7f3770f9c11d1122fcc3cc18cd91cbd86e92ff074965e10203d6cef28399a5fef", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963500, "uuid": "64ef235f-87e8-4208-b83e-82ce4fd1c926", "value": "T199B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963500, "uuid": "5be178d6-59dd-4dc3-8acf-9c95103da3d6", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963500, "uuid": "0c298222-7e6c-4b31-9808-3cd1a486f7d9", "value": "6144:LexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O70pUlLaEx:LeZeWSpda70ADIgSoxgUW/zFun7OkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699963500, "uuid": "6caf49a0-73a3-4f8d-b4a6-bd6aaab8ee7a", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699963500, "uuid": "02db588a-ff8a-467a-a44b-d7716f840237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963500, "uuid": "d0fd9492-b20f-4fba-9b28-cc457815c5ef", "value": "procedura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143bb2d9-8323-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989718, "uuid": "08e87b16-4080-4a7d-a0f0-9102a27400fb", "comment": "Malware payload", "value": "4b113da80e072b97669c634577ced6be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989718, "uuid": "d9e99ca5-0f71-4094-9aa4-fa3a21fca5d8", "comment": "Malware payload", "value": "6965c5ea91cea03b9a1204a762277a3ee3f4f89f02f2fea0599b6db6ea49e6f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989718, "uuid": "25be7613-b032-4bbd-a679-b22be01d4bf4", "comment": "Malware payload", "value": "d3c93d390c98a8004e88d1ed33eb2254485e27a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989718, "uuid": "a907a27d-f3d3-45db-9a43-24faafd6a9e8", "comment": "Malware payload", "value": "2ae1d69c7489b231b5ce9c2da0f932b78702366beef3fb1095bef48b44ab98ca630a10730aaf716615eed958cf7f7356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989718, "uuid": "88f79fa9-3404-4b43-9e58-caead74ab6a0", "value": "T1D7946BA769D142F3D3E6113334DED4A92225A477EB5B7EA713610EF2CD2098F016E6B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989718, "uuid": "88829352-7037-487a-bfbd-46e15fca69e4", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989718, "uuid": "f0752eb5-9b62-441b-a32e-f37cb8567df2", "value": "6144:P85gUwlREXKMmn/P3dAOIXR0atIsW5tNVWpflInS9rHWp1FjNtqX9:egUKRE6TdDat41VW/ISEp1FjNtqX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989718, "uuid": "dc533a1e-386e-4a46-bdc5-5f9b370e2e81", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989718, "uuid": "aa9a8b1f-3a0e-4ce9-bafc-15afcaf79119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989718, "uuid": "5a56130c-cc3e-4eec-a86c-2c06ae1dc8a6", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3544.984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560309d6-82b7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699943442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943442, "uuid": "56915669-b9a8-427c-9922-29f1d37fad2e", "comment": "Malware payload", "value": "1528b593f65bcbca9a88663ac528510f", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943442, "uuid": "29babbbf-6f27-4d62-a926-ab776cd95102", "comment": "Malware payload", "value": "69925c370a71b0bc37eb5d6381e8fc3309a7e71a7bdade54233214c73c728170", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943442, "uuid": "d31c6821-554c-4709-a6a6-6e3898d3a931", "comment": "Malware payload", "value": "2528591984935cc3290aac4931cdba8dca580bfb", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943442, "uuid": "257513f1-7292-417a-b133-dd35befb8f0e", "comment": "Malware payload", "value": "87f1b7980a214e28f7504292b260e90e863e59aebca48976894889706d8b98fc2d084f3194d5ceb5e0f8d63762566270", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943442, "uuid": "dde16863-077a-455d-b244-f229197d4186", "value": "T10247332279D2C432D67D06B01A3CDA6E45BE7D200B7145EB63DC6F2D1E729C14A36FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943442, "uuid": "d3917167-f658-41da-ad7f-94f1b933ef96", "value": "786432:Rx1I0WRwCaTOc9qPbiaZnMm/a92w21q7:Ro0WraNi1Scw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699943442, "uuid": "822c4ac7-2b24-4505-8749-ccf1f3eda80e", "value": 25442304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699943442, "uuid": "86b6e93b-0be4-4721-aa9a-3b2473d67678", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943442, "uuid": "889aed8a-7eeb-423f-8b2d-bd49ae823323", "value": "81b73.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c05460-82fd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699973698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973698, "uuid": "e533f770-3008-4282-94cd-52bf42aeff35", "comment": "Malware payload", "value": "7e54bef7dca1d9c70405d43c995baf8d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973698, "uuid": "df72408d-c46e-430b-9112-fb726f5afab3", "comment": "Malware payload", "value": "69f1ebe7c4fafa1798aa4ccdc52785e5015456e2837b9a234031884f196fda62", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973698, "uuid": "9395b749-e0df-4743-8dde-66d76880180e", "comment": "Malware payload", "value": "7ac4c05699dc23228c4567068d3f22e96464fda8", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973698, "uuid": "e00e4d06-9104-49bf-9396-f781fa8f3d0c", "comment": "Malware payload", "value": "58a18f79518712cc93eb5fac98518764411d29ceb2765d22b160db83e094cb26ab60af3a157f60df4f204fc1306434bb", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973698, "uuid": "71ec6067-3150-4e60-9cd4-057a25122384", "value": "T14F72C0B9D8597439E2B3B83DE0C5C4BDFB49CD405A00B99AA48627CD8940793239B7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973698, "uuid": "938e9456-2747-4a99-8913-d3cdc728c901", "value": "384:aNI4TURamvQLIgkZajuZzPXKAoW/6kFZBsuk1P:944RJo8gk4KZJoW/cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699973698, "uuid": "a79fcdb6-32cc-4e50-9d4c-8b5c372a206f", "value": 17526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699973698, "uuid": "95a79801-f991-431c-91a6-6ae367962a60", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973698, "uuid": "34f696c7-4ecd-4626-9d7e-06f909236555", "value": "7e54bef7dca1d9c70405d43c995baf8d.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c234acfb-82e5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699963381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963381, "uuid": "844c52f2-5786-4798-a782-4727ae8ba793", "comment": "Malware payload", "value": "bb5f02397f7d4021ecd1267e301f28f4", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963381, "uuid": "1ff22d0b-c86a-46b5-a24d-b513a06b0556", "comment": "Malware payload", "value": "6b17811bf0955ae82d108f30f526b741e15e6f00024cc71b34cc315cd64297b0", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963381, "uuid": "7e09b098-0c41-4fdb-9fb3-09a6b56612d1", "comment": "Malware payload", "value": "1dbc917aeb4fd59363c397a93d7e72cf0e4dd079", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963381, "uuid": "4d375311-f8e4-40ed-a8dd-3baa9cfa1b33", "comment": "Malware payload", "value": "10e2238088720a0f432890f6e751d274dc935de36112822a334452088df3314af683c32d822bf9eb1654ff8bf9d3c278", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963381, "uuid": "d8104619-8723-4e81-add9-1eeaf1b4f836", "value": "T16EB49F0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963381, "uuid": "c23e774e-013a-48db-9efe-3a5ee14807e0", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963381, "uuid": "0008f2f8-2f1a-43bc-93a8-bbdb758ed6f9", "value": "6144:1exbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7VpUlLaEx:1eZeWSpda70ADIgSoxgUW/zFun7O/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699963381, "uuid": "2da47030-151a-482a-bef8-88111b1b4ca7", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699963381, "uuid": "c92df396-e737-4e01-867d-8b6b08bb3ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963381, "uuid": "bc05482e-2d6d-45ea-8a3e-3e6da389a635", "value": "pratica.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f63ccc1-82c8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699950679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950679, "uuid": "d13e63f6-e815-429b-8902-36abf88e9af4", "comment": "Malware payload (AgentTesla)", "value": "b4acd308aeb6a2301c246272b9ce0b1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950679, "uuid": "16eaa90c-c9a5-497e-8c5b-f0c0215937bd", "comment": "Malware payload (AgentTesla)", "value": "6c3aa6c7804d75cd98888500430589c9996bd681881fdac1850590343ab4d13d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950679, "uuid": "2b2a0b8b-c29a-4cce-9b98-f473d689b812", "comment": "Malware payload (AgentTesla)", "value": "4da64edc58a6b59debbbb55c77cc10379eaeac7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950679, "uuid": "1a347a6d-d512-458a-9153-a51b79a8a59e", "comment": "Malware payload (AgentTesla)", "value": "892265650e49bc6970726eee89a496055c6155733752ca14781a7d5d6f71f09e9883bf121b5d4bc6a74637897d6bca94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950679, "uuid": "a79657e5-2fd6-455c-8e0c-92c55978725c", "value": "T117258C81E794D6A0DD189FB39572C9F443227C6DEC34E10E28DA3DA73BFA38214915B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950679, "uuid": "e6308d86-c494-4741-8370-e1864d03689a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950679, "uuid": "d7443aa2-3f5d-4757-b652-db4775a45719", "value": "12288:FcgM1iz9B1wpw5ATHtcI2nApMwYCEN5p6XZqOruQEoPOA1R9oUtoR4LZVkdbYtPc:FqFTNcIyCa9KMOruVyRXtY4LD+a1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699950679, "uuid": "b7284b71-e498-4965-98d6-f243e8960f0d", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699950679, "uuid": "0f476c68-bfe4-47af-aa7a-209c7627cb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950679, "uuid": "4ea29396-e9a8-4afe-8801-ff468d9e419c", "value": "PDA bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ad4b84-8320-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699988777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699988777, "uuid": "87b90416-33c2-479f-bf43-524b8ca46824", "comment": "Malware payload", "value": "ef63c97f703ba796c336fcf6824b2400", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699988777, "uuid": "4f16428a-e342-4d80-a0d5-f4844c8d06cb", "comment": "Malware payload", "value": "6d3cd39358c91c56b4798b64c73f03e3877a80dffe01d07e2ad13e979e845ed0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699988777, "uuid": "b85e32ce-1149-4202-bd2a-faf9754b9e34", "comment": "Malware payload", "value": "69b63ef20df1f2243a2a5c6eba2663d3eb4773bb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699988777, "uuid": "5d734733-3014-4536-a169-7a4fd340ce90", "comment": "Malware payload", "value": "c883cc9f90707fe7384ff15f275d73856a2732fca184787f50a9456df703b1c1b8717c1d62c7f9f607d9f43f8f9dc50a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699988777, "uuid": "18fdde58-5f3a-4130-ac8a-a620e7b16c25", "value": "T1A674F12276D1C031F22746718E62C7755A3F7CA22B6699CF27E12A7E1E207D2DB35306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699988777, "uuid": "bf658e24-bbcf-4f20-9cf2-8c62f75494f9", "value": "ac9b735a86914608dcd7bdd7ddcf7451", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699988777, "uuid": "6df95e55-dce2-4e31-8b0c-87d7a279acbd", "value": "6144:tAafHjoxb3mh2gCbhs4hxehhWrv0b6VKWUvjJuM:LHjomC1bxei1dk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699988777, "uuid": "979abbcd-5266-44a5-9192-a75a68d8cba9", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699988777, "uuid": "38686bcb-17eb-460b-9d66-389de1df88fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699988777, "uuid": "f8ad32ad-303c-4931-9e4c-7c210915fbc7", "value": "9fd0508d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0043d662-82c5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699949311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949311, "uuid": "cd2de63c-fa1b-4364-9140-bcb1bcbbbc6a", "comment": "Malware payload (AgentTesla)", "value": "96f2d6bb81b6a3763ffb5e44975030ee", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949311, "uuid": "7b5770b2-d35e-4be6-bd08-9a50d7b1b920", "comment": "Malware payload (AgentTesla)", "value": "6d833846ce0ffab7ee3c9f8872fc99e9a06ce8fa0cbcbeb039c00ba209256116", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949311, "uuid": "6cb332b8-1bd0-404d-b8fd-62f2f77aa8d6", "comment": "Malware payload (AgentTesla)", "value": "e687bcd062af6ca51eab26e557b69c10b09643ba", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949311, "uuid": "9ebb87c4-a8eb-4245-8503-d1fd7f8f688e", "comment": "Malware payload (AgentTesla)", "value": "561534831a1627b1a2457bacca2a31eee1b5edc7d1f0a221b8da7092d7b1c1e0e20ad3ec71447d293b711fe2d2d46c46", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949311, "uuid": "9a4240f4-0bd8-4444-a6cb-457a005199ce", "value": "T119E43332A50F6AC2C06CEBBF71CD0B5A51E33D455DE3887E662400EE4DF8D60A7971A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949311, "uuid": "97994916-561f-4d12-bd75-5218ad01206f", "value": "12288:tNsGotsBLvpO0f97Yo2W0iYT+w7WfmA/xK63IEvnjzYunKAh:3esBLRlfuXiYT+7mA/xnIkzNKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699949311, "uuid": "16a56b85-5450-48b5-8247-51f1bfaa742f", "value": 700834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699949311, "uuid": "558d319a-0805-47da-8534-4fb552e6ab9f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949311, "uuid": "a914580e-c232-4c67-9856-64881db9e53c", "value": "payment made\u202efdp.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73d2f1f-82ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699953591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953591, "uuid": "24dbb048-33e6-49cc-8c38-747ccce0c9b2", "comment": "Malware payload", "value": "ffeaec655843a2e8f6a156144fd8b684", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953591, "uuid": "9aca5e85-1435-4a0b-8160-af95ac274689", "comment": "Malware payload", "value": "6e627ca700a4794c9e46a849daed709312bacf1587109607e2f6c5eebb8a2598", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953591, "uuid": "80a9c3c4-d0bd-447a-afff-f40839c930e8", "comment": "Malware payload", "value": "bcb056d3a80a4c855969b3e49dcad305a0e863cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953591, "uuid": "b981f057-4999-4304-8128-574f0044eca5", "comment": "Malware payload", "value": "091686475c767b912cc71505043977be58a16562910b3f07f3fad6644e293ed77c320f46e85d4e65f4dbc08a184e6b2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953591, "uuid": "51d8ffbd-cc6a-4a14-bf1a-c709ad954ba3", "value": "T178946BC670D9C0BAC412183985D4C9782CBD94533B8707B7D2EC8D4B1FB27A2AA7B6D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953591, "uuid": "4a9d3322-b5f3-41d3-979a-edd2e838e6bf", "value": "1c7d0efed001e965dd9c0307904ea44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953591, "uuid": "3f854a69-60d1-4e21-90be-5cf1514b4db5", "value": "6144:AvilPFF2W+kUanD48AOjGHFI9m3ziGixMjlgJht/lliLZ1awmBegYZT3MJ3NiVQb:hlNF2xv80lI92ofivJ7v/B2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953591, "uuid": "44f36af4-0ef9-420b-a696-3b78f82f07e4", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953591, "uuid": "e2ff447a-995c-491e-bc45-0f0ed178a328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953591, "uuid": "db663c4a-6551-4ae8-9a51-c988865c8238", "value": "ffeaec655843a2e8f6a156144fd8b684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35a60ec-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699964644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964644, "uuid": "b3fe2522-175f-4483-a241-3585c264afcb", "comment": "Malware payload", "value": "5c54496c4776371ec85b14246006ab22", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964644, "uuid": "8ce398e3-484f-46b3-b097-31a5e11854a9", "comment": "Malware payload", "value": "6f005ba0b96e1110d036613975314ef0827afae187ac93384770ea57c3103c26", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964644, "uuid": "04ebdda7-4af0-492f-a652-60f2f82c3ff6", "comment": "Malware payload", "value": "d69fe0a4ec6604fdbec75a6960b8b48b9fa5e481", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964644, "uuid": "561936ec-0588-4712-97f1-cc39e32907f8", "comment": "Malware payload", "value": "54f528b97f06e96ac922fb952e9509963c54849243d4fa76a6a487cf207bc4ba48dc96b515afbd47ebbdc082151f25b7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964644, "uuid": "4edb205d-4ff8-41b9-b472-28e2ff4fc51f", "value": "T146A42394BF09FA219CE181B3AAE97F4AB45DD3563016109E3CE71F2B4B0AD07865BCD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964644, "uuid": "57351df0-317e-4176-9957-3584f06f368c", "value": "12288:DVBJd5dS7dKcQlqY2UJ20OoqxntcSKmQhSs3mT:hB/5AhsZ5sRcSmSs36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964644, "uuid": "20cd01fd-ea4a-4963-b3c6-4f8a6eca4346", "value": 482043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964644, "uuid": "43a73e8a-3b62-4e6b-ba7b-457422683a84", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964644, "uuid": "d8d67dd9-d06c-4035-a5aa-bbeb24fdeb06", "value": "Quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4103b56-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (Netsky)", "timestamp": 1699964646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964646, "uuid": "0644c9d5-868c-40ff-9097-0270cfce980a", "comment": "Malware payload (Netsky)", "value": "cec86152ce730b7de25203a169e133c0", "object_relation": "md5", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964646, "uuid": "26ab6ad5-0a33-411d-a680-a0728d7ef768", "comment": "Malware payload (Netsky)", "value": "6f03ec60269a12b5067044a49f64c77108828bec971cacd120bf777d4c2b8fc0", "object_relation": "sha256", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964646, "uuid": "c1261596-9c49-4891-acdc-ef6eac3b08e7", "comment": "Malware payload (Netsky)", "value": "c49caf5fa6635dd8fbbe26251ee45e46da512c6b", "object_relation": "sha1", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964646, "uuid": "3054b976-644f-4650-8a9d-1dbb8d286f5a", "comment": "Malware payload (Netsky)", "value": "2ecca16d0f2c0f19ded89dd806acdff3d31adeafd67f4912cf826c9eb924b79c1345835b9c408f85b5778224c0569dc9", "object_relation": "sha3-384", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964646, "uuid": "0e7aeb4f-5023-4bba-9a96-28371d11689c", "value": "T13BD2D016EA075828CE590F3A406F6E35E43675064F2B019ABC2E22E57F616F49D39CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964646, "uuid": "5611f014-d338-4e48-9391-0533da0a901e", "value": "768:BWkliAnUQYkYKzqbjC5RqHjrYReyZx+l0oKriCPRDL5:IySsz6jGeyZx+l0TRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964646, "uuid": "2ca4d48e-7930-4c9b-8994-a503a69e0394", "value": 29832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964646, "uuid": "255ee1ed-c83a-436a-a6b7-75d2c42585e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964646, "uuid": "64afd89f-d09c-4d7e-8b7e-0b49a5a72ebe", "value": "report01_jlandersen.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2b7174-82b7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699943637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943637, "uuid": "d50c6277-c368-4acc-9859-64aa894898fa", "comment": "Malware payload", "value": "e7114dd362a4799d13a3628d30b75c8d", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943637, "uuid": "b8c1d55d-d002-4532-aa64-5bebe47fc884", "comment": "Malware payload", "value": "70ae0ba7881ccde62370f1168b00662af52a354b97f6cf8b01219f9046c0270f", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943637, "uuid": "e3fdeafa-75b0-4247-aa79-420897f411a2", "comment": "Malware payload", "value": "51b82c1d8e54bc357b4bc116d42430bda79cfbd9", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943637, "uuid": "0aafe3a5-3387-49da-8160-189ee2b3cb56", "comment": "Malware payload", "value": "44e1c2f66c09ded8a5a27488042eca6b89670743e34ec3fc21a8f3d68be87c14c54ba620bb6a960ae41b51262e55d91d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943637, "uuid": "9636a5a9-40b3-4ddb-9369-9b51238af667", "value": "T1DEA6CF2175C2C132D5BE06701E29EB6A417E7E210F7098EB63D85F6E1EB18C25632F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943637, "uuid": "807d230e-43c7-4cfc-a78a-3765028ffaa7", "value": "98304:hY/NsAuewMInSlodL++36qlsljn6jNnnY6YLAXeajG4QjdKgEClbZp829Y1O0A5H:HSSx++Llslj29RQY7cp8XkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699943637, "uuid": "b2787805-1559-47e1-8df4-7d9aca8b6a32", "value": 10146304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699943637, "uuid": "26572e8a-ba11-477c-935f-ccab44108464", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943637, "uuid": "88aa94d9-6c45-46c0-a149-c1d74e6ac6c7", "value": "CapcutSetup_43694481.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1138f4d1-82c6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699949769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949769, "uuid": "49af8be3-de21-4a0d-a26b-69ecbd251625", "comment": "Malware payload (AgentTesla)", "value": "3e95ee6352f7cfbfe3e412d552791ebc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949769, "uuid": "3e1dff98-481c-4abc-bb01-f369435921e0", "comment": "Malware payload (AgentTesla)", "value": "73a225250c2ccdff194478cd7d7aa96a04b314c6fbdf105183198548a0f93684", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949769, "uuid": "179f9fb3-34d5-484b-a8f1-b6ba7349079c", "comment": "Malware payload (AgentTesla)", "value": "8f0ef604c43d6a092e3ad6655fb0565621f5cea3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949769, "uuid": "39326867-44d3-4c31-b17e-a105fbd4f063", "comment": "Malware payload (AgentTesla)", "value": "d2204edcc4b486995fb759bdd9bb6cbd3a6f833dbea78bb2c1edd04414ec09f132732aa06ed480fe92cb697bafb203f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949769, "uuid": "86056f6a-3d0c-427c-8884-42240832c3b0", "value": "T11AD41204B7FECF71E2BDBB7A583407245774B946683BE14D0F4151AD3E2B7809A8AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949769, "uuid": "69a4860d-d9b1-4c96-8d43-53d289df8604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949769, "uuid": "b91a8bbc-9535-4512-a111-e183c09c1e87", "value": "12288:y0Vhg0HOlRTvuB4AmlpcBmqXEa3F4RyF7QmBIn1ulUsRneuG/:yLvuh6jqxCRyEn1yNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699949769, "uuid": "0e2ae268-3e40-4a32-8ab9-f4d49f2f0e53", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699949769, "uuid": "c574746f-8339-4c34-8dde-e7fa2c232d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949769, "uuid": "63471a78-a854-4422-be05-3671f520771f", "value": "overdue payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde8eb6c-832a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699993062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993062, "uuid": "60f76aaa-bf35-4b25-9b65-ce8ccf520946", "comment": "Malware payload", "value": "3c256ec2ba6723523ea27692e7f2f755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993062, "uuid": "0f99c031-e93e-42d0-a8e1-50d1a82ef01b", "comment": "Malware payload", "value": "743754530bf3cdcf57d1f00030b109ffce1431d59d3bb0db3af2c45a57523928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993062, "uuid": "e0dfd48a-b082-4006-a283-19e9d9e87e75", "comment": "Malware payload", "value": "e2a9d3ed72c5b03a056cdd169d642ed3c0318f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993062, "uuid": "df56a902-dbba-4ac2-b7a7-4bb3123bb75f", "comment": "Malware payload", "value": "92a15510f874b088f0d903e3c66846e5bf6e03f0b9670ed78e048cd4d7707f12175253813935f8717d8acb7ffd9ed721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993062, "uuid": "7e09429a-87ab-4024-92c5-f7a3361430ff", "value": "T16394391C6CDC3039D055D0BE05F8BDACEF9D26B927A1ACE722684F159F611C29D3E862", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993062, "uuid": "6410ae1f-40a7-42e7-9b18-78e05bb4b1c2", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993062, "uuid": "9901e666-f982-41a1-b12a-76182e1cd4bd", "value": "6144:Jz5gUwlREXKMmn/P3dAOeXziPggL8hAoHbI9n/kVcdfVl9:XgUKRE6Td/PggL8+3kqdff9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699993062, "uuid": "b5a994cf-7f1c-48fc-9363-a55fbf50693a", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699993062, "uuid": "04aa3f7e-aa3d-4364-949e-f847b7c0c4ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993062, "uuid": "6ca6f314-11a0-4934-8ded-072f83ca4313", "value": "SecuriteInfo.com.Win32.TrojanX-gen.21445.15786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd97cc50-8321-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989170, "uuid": "d4aed8c4-e60c-4f78-98a3-98ed0d87785e", "comment": "Malware payload", "value": "c0a35acfcacf6cb9c8e8a4a7ca54f111", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989170, "uuid": "37e24cf3-663d-48af-b25d-dbc945b8bf94", "comment": "Malware payload", "value": "74426a4c85dc167e3d82b2f405d9a9ab6b9e2cf4c7ee93fce8a9a0a5fd21c823", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989170, "uuid": "4d815c1d-829b-457c-9984-d19b2b63ca03", "comment": "Malware payload", "value": "b71de001c9880245677f8887749fb27d18681070", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989170, "uuid": "0cb5ac53-3646-4a23-959f-82cfb5735c22", "comment": "Malware payload", "value": "2d8d63f6414e05a10a964452c0e190fb61d810be66f49730ce6096ddb23b4b01f123282cce2b02b832720b9779a77ff9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989170, "uuid": "3809457d-3bd4-41ce-bfa6-276873c71699", "value": "T140C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989170, "uuid": "4b9d53d9-d457-4fee-9b22-dd2c9d6e78b2", "value": "3072:ekYPUfsgnsb0J2ag/VfNkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0NkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989170, "uuid": "32aabc4e-7635-4b75-8404-d2432b250cc3", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989170, "uuid": "32e82ec1-f9b0-4f71-9e80-a028a8258084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989170, "uuid": "01a153a4-762b-4501-a0d7-3bd8881a0c54", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f1fc4a-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982718, "uuid": "16d6ab75-11c9-46d3-973c-1b6213f3be9a", "comment": "Malware payload", "value": "696cdff7e3525a2754f348746cf89f51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982718, "uuid": "3f1eb5d5-9db8-4753-b4ef-f57ab5eccfe8", "comment": "Malware payload", "value": "75386126b0ae0fb4e2f71f083c56ac8fa726482058e2b44274c6bbd51cd88b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982718, "uuid": "d464d6de-02ee-4628-af97-a6d630f68799", "comment": "Malware payload", "value": "b70b1b486c22b920b4c3bc9e840209634cf5151e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982718, "uuid": "8722eaf4-fe52-48ac-bc18-a841a269838d", "comment": "Malware payload", "value": "9cb4de26bdfce1e0d172a8466cd74da4a2d8d333361ebab8587a6a9d8890324b32748e5ffd1a3cd142b12eacd2f2df4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982718, "uuid": "539bc38b-77bd-4a13-b7e2-6fee2e4f4677", "value": "T1E2357C1732915033E6B27A314B2B42AD8926FE161D78356A6BF59C487D31643FA32FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982718, "uuid": "c6887d68-5ec9-4700-aeac-3580b4dfa5e4", "value": "24576:wfdWTzFpXnVH1BS958zRP/e4tIUkeNM5vbUrMBX/3:+dyFp3DBG58p6jBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982718, "uuid": "a1761955-e136-4a35-a9e9-d8c20aaca0e7", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982718, "uuid": "d4bfe4ec-c734-4aeb-b4a5-3b9ec3c714d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982718, "uuid": "2b28499e-4010-483f-8c6c-80199cce468a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.13457.27359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609e0aaf-831c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699986839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986839, "uuid": "0ff77e2a-4697-44e1-8267-e988a00c3384", "comment": "Malware payload", "value": "6b268b2c6f17a1ea277fabcf7c687066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986839, "uuid": "a9803446-346f-420f-b88f-8523ddb505c1", "comment": "Malware payload", "value": "75521cc92675383e1f9b8996fd925345e562da8b2a2aedb9cebacb9cc0ee0a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986839, "uuid": "dd06f9d8-ae1b-41ce-81c6-11577712b5cf", "comment": "Malware payload", "value": "7c0529b8393e7b4c5689ea47bd109548f5b605b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986839, "uuid": "cb110ecf-7458-4984-9c3f-6c0c37803393", "comment": "Malware payload", "value": "1eb5fdec2cf0a867e2588148a178581f2420bc70781911a00cb188a8aae8dfe0b7755d50751d80df2042a1c32cd2a345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986839, "uuid": "179854c4-9f22-44e2-a731-914662eed69d", "value": "T1D674012272E1C071F26345764A62C6A5DF3FBCB2E761C4DB27E01A6D5E316D28B78306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986839, "uuid": "0573ab8d-7c30-4988-87ab-5b2056c21c4a", "value": "ac9b735a86914608dcd7bdd7ddcf7451", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986839, "uuid": "2cf68144-f4be-4aed-847c-305881b8d768", "value": "6144:wAafHjtAP8HdXffnL523n72I8Mmtq4Z4nju7DVAglgtlJuM:qHjtA09Pze7AlKnjAuztl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699986839, "uuid": "c9023f61-33b2-41ed-993b-6d6c7209732e", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699986839, "uuid": "f232922d-c838-4dc4-a597-3cad702dce95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986839, "uuid": "e48a0510-0a84-49cb-aa1f-711d63825212", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fcab07-833b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700000221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700000221, "uuid": "91e1d225-82e6-447b-a74e-de5e0ca89ed2", "comment": "Malware payload", "value": "889f8466ba2f0bb4d5bfb3c9f28fe432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700000221, "uuid": "95b750ca-86f6-44e0-90b4-f3d21eec6cbb", "comment": "Malware payload", "value": "75b6b00dcdb1025df8a76e02a7c989b5c6d670e0dcf1737be4f20641b89cde77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700000221, "uuid": "cc014e6f-d4fc-4b2e-ac49-4ae7473f004a", "comment": "Malware payload", "value": "3f6f4906676e5a40d38177909cf1f24ed6d30a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700000221, "uuid": "6fb2d680-a8b7-43a0-9e80-e17e161a29bb", "comment": "Malware payload", "value": "8b4f566541d886b470d5cef68e866d1982f0b8209c0f69d17177864f45ee6a3858a3b194530c010e726ba7945dfc78f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700000221, "uuid": "af3b82f7-6547-4bd5-9ddd-ae1b9790ee7c", "value": "T15774F1217AE1C072F3674A704E72C6A64A3B7CB1876585DF2BD01B7D0E20AD2DB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700000221, "uuid": "614f2dcc-526e-4252-a176-3042786b9967", "value": "ac9b735a86914608dcd7bdd7ddcf7451", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700000221, "uuid": "25e410e0-20ca-406c-a620-feea5654de68", "value": "6144:Yn4AHiIZQ7SPSaEq+Vi28gartWltqIOyTNl9AG0KwePc8fmO7sk8u4:iHimQ7aSankHar+qIOuNylePc8fykd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700000221, "uuid": "b63d5a44-3db0-4b54-8edc-4cc879d9198e", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700000221, "uuid": "3ffe1180-a636-468b-9732-7a08f938a2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700000221, "uuid": "eae00a77-11f1-4985-9008-1bb2709586a5", "value": "SecuriteInfo.com.Win32.BotX-gen.6506.3929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577b6efb-82e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699961054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961054, "uuid": "15ae2712-b318-4bd4-8e61-86361a5e9f5a", "comment": "Malware payload", "value": "b36af418f2979b970504c5d80509b3b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961054, "uuid": "dba8126f-7d76-4367-a738-20bf731d4deb", "comment": "Malware payload", "value": "76143c27dd7b0f5017b03d53fffaf18ded8b2c4b310ca61f89b2a6ca78786b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961054, "uuid": "e3bcb464-0743-4188-bebf-2f90b3d1872d", "comment": "Malware payload", "value": "d37565e5ddfaab9468812f9d423e89efdeb07af2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961054, "uuid": "879240df-d18f-4539-9c3b-f103eab4e92b", "comment": "Malware payload", "value": "31f4c86b50b8db2fe432b3c98eb62aa51c49d45aa6b00c2f1472cacc3990a6f101ba7eade1134a71c8b922add1a6ac95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961054, "uuid": "3bcf35a1-feba-4392-9e6c-54183664fffd", "value": "T1C4C50156B260D433D1373A344C1B6791A839BE607D54BC0A7FE97F789D38292292A1F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961054, "uuid": "e1c64af8-0b18-4990-a065-98c190c8378f", "value": "810ddebb5441ef7b92d6977b1440799a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961054, "uuid": "d577be43-2034-4f75-997b-2034a4710d26", "value": "49152:tisGU/DDjqvOS6iy3iWOY+YLqaLOlTKrbs69V/QzO:tL3cy3im3L6ss69x8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699961054, "uuid": "4bee4fc0-79c2-42f1-bcad-49ced14f1122", "value": 2545664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699961054, "uuid": "f7b11ffc-368c-4808-94bd-a043343ceed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961054, "uuid": "68f3e6a9-091b-4715-aef1-7e9c95f3065a", "value": "SecuriteInfo.com.Win32.DropperX-gen.32537.27597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854bb660-82ea-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699965426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965426, "uuid": "fa75d950-9d87-41b5-8183-9f9e0ccb0a55", "comment": "Malware payload (AgentTesla)", "value": "b897c71df3789b95943d9a0444393fc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965426, "uuid": "787cfbf1-bd4f-4156-a046-d430a0720fe9", "comment": "Malware payload (AgentTesla)", "value": "76b695c17786615cfe769077dde4f7d7dae83e8a6f638680c9e0e59b8d1f582c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965426, "uuid": "dae0f799-0e40-4ba6-bb9c-2bb6a89a12e3", "comment": "Malware payload (AgentTesla)", "value": "0c387d85b9b8e7f32f906b77511243d3157a6706", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965426, "uuid": "69067c86-0de4-4e30-b206-84fc60c1b5ca", "comment": "Malware payload (AgentTesla)", "value": "9e46a9a3d5f746cf1642b47b5c95705b534f9eda0d4d36940912dd4d5906778e1f2f551caf6c81f38b1ee36e28d39209", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965426, "uuid": "fa1d5f94-3143-4cf8-98cc-fefb5ef4683f", "value": "T1A9E422467A9C3B56D8BA07F1143CA75543B6ACEA6498E5DDACE838C33877B41238074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965426, "uuid": "f3da6089-9777-4337-bea7-338792c3d89f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965426, "uuid": "6999e1f1-3980-44e1-8ba5-7ae79bee1f2c", "value": "12288:VVMcthmJ+ieqkC8eoYv+LxW6G07Wq7rT1N6WqTss5y2OKqVyQAFnSM5:gDkCJOFZGyWq7lNVqA9Kq8QqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699965426, "uuid": "9fd8087d-e12f-4637-9d37-e36e055149d4", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699965426, "uuid": "3c72b266-a9d7-40d2-8198-586747188c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965426, "uuid": "e504e36c-fdaf-4ff5-86d9-ff342b43cd45", "value": "Camscanner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac73630-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982696, "uuid": "332199d7-24e1-404f-a2b2-be4572d171fa", "comment": "Malware payload", "value": "cde12fa4aa6884e4939ff7767cc8596a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982696, "uuid": "6e2ca3bf-ee6f-4be9-bd4c-d6164a986012", "comment": "Malware payload", "value": "76ea6fc5e2e808633b789fd8c300e15bca434185c6007de3eb98ed1e6dc70070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982696, "uuid": "a3555fde-9434-4e83-9448-5e58547b5371", "comment": "Malware payload", "value": "e320b370bee461ef3a6c86c63e77c88a46cfde84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982696, "uuid": "3a83af26-54e8-41f1-ab4a-a47171c39899", "comment": "Malware payload", "value": "bbfea03add71aaf6c23dfe9398b70eca3be3a85c920bd9249655ffab60d4158aeb807f4213ed0023b31a6b26c9227eca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982696, "uuid": "56ab5b59-979c-4a84-a350-5c31fa4b17aa", "value": "T134357C0732915033E6B279364E1B429DC826FA261D78345A6BF9AC483D35643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982696, "uuid": "7a83111f-d7d6-422c-90c6-125d77935c0b", "value": "12288:ZGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3d:ZKvzcrnyaLO+3Yb/wQeAh/7Rzx2ihL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982696, "uuid": "0bbeb45e-ff05-4488-8f1e-faf7c06d1edf", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982696, "uuid": "3c438f16-9376-442b-abe0-963bc7b82a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982696, "uuid": "821bd425-c3e3-487c-8dcc-67d98819ba46", "value": "SecuriteInfo.com.Win32.TrojanX-gen.21719.1004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a013ae-82dc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699959519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699959519, "uuid": "cc5d9f33-88fe-419c-9176-4117e49be8fe", "comment": "Malware payload (AgentTesla)", "value": "8d908fa1d597d7a1476ec7d540291752", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699959519, "uuid": "fff6d28d-f866-4550-a8ea-c07b542e6dc8", "comment": "Malware payload (AgentTesla)", "value": "780864eca14f5609a0466e0831fd4ea929247f1bc6768ef0aabbb4a12135b319", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699959519, "uuid": "9aa3ab40-2f75-4d12-b8a9-332595dfb47d", "comment": "Malware payload (AgentTesla)", "value": "2b0ad124089447eea1b75af6c88a74035089103d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699959519, "uuid": "10ee9f45-67bf-41a6-b535-d2a6e302b562", "comment": "Malware payload (AgentTesla)", "value": "dd586ff9e2050d8fea1887225ba3a37b2850bac1dbfccce7d0f984911a5b348fb3589de9c915318b035bf3050f697089", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699959519, "uuid": "a8357ebd-b75d-4685-838a-3828cf60b4a1", "value": "T12E05CF80E58466A0DC28ABB16A36CD3543337EBDA874D46C28DE3E673BFB3931025557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699959519, "uuid": "6cd0ea2b-228b-469d-b949-52999525945c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699959519, "uuid": "4664e447-19ee-45df-a5a2-bd97fc6e9c32", "value": "24576:stZYJvNr5wKPnTpAZj56KVBer+SqSw1q:stZYJv5S2lWj56KVBer+7S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699959519, "uuid": "1ef0a05c-a7df-4cb5-897c-c4b6338c8f95", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699959519, "uuid": "5b07a6a0-fd1c-4ac0-8ed3-e6cddcf53cd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699959519, "uuid": "aa895eb4-c1fe-4cc8-9744-b235d3cd63e2", "value": "Wire Transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667b883d-82cc-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1699952489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952489, "uuid": "46b71f90-8a55-48c0-9eaa-dee507687d8c", "comment": "Malware payload (Adware.Neoreklami)", "value": "014bc71b11e0626deb13d8fb85ac2d52", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952489, "uuid": "85712cd3-7f66-4a7b-bb69-d33df53a9f09", "comment": "Malware payload (Adware.Neoreklami)", "value": "7918ab26eeb714d19d3af80cc905ad014ac6e6a337d7bec51206d17a6ddb24e0", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952489, "uuid": "7dfa4c8d-1fd1-476d-94c3-018205d35c12", "comment": "Malware payload (Adware.Neoreklami)", "value": "66e50dccf8acc4b62c4631214a2b41194b5f1efa", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952489, "uuid": "f2ae892a-8952-43bc-9627-3aa0100791de", "comment": "Malware payload (Adware.Neoreklami)", "value": "6f625e9fba8fdc049012a4133fb108b71f701463e319271263cc3744aef5f63e585f2b588ce459228fafb69ccc67a473", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952489, "uuid": "fddb0120-03d9-4c3a-9aae-f0aac5d0ec7c", "value": "T16476330076E5CE75D6A2127A8C902E84E1A7FF908A06C5E727E366497FFE05DD11332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952489, "uuid": "b7bdfa19-2a5b-444a-b06f-a2f5b4c9895f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952489, "uuid": "42e49da6-02ca-4b55-8a16-f76f58174f67", "value": "196608:91OSsCfJs4fwEvnp5FGgJBe8T9S651+nRLsz:3OS7ftwoXFG185SW1+nRLsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699952489, "uuid": "db35d3d5-e400-4004-ba30-13e7987ae094", "value": 7482141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699952489, "uuid": "c04d0989-8dfc-42cc-95c1-c1bf44cea131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952489, "uuid": "3ec9ea8b-9d7d-42de-9294-4ce2df388d69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998e6ddf-831a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699986076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986076, "uuid": "4985c039-5dbc-4c4e-87a8-e55a91a280d7", "comment": "Malware payload (AgentTesla)", "value": "96433ed133e71162245148685b12aaa3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986076, "uuid": "7f286a95-dcf8-4868-8ba3-1ee380016137", "comment": "Malware payload (AgentTesla)", "value": "79b5b0596a21d1d0642a64198c45d8662e9eede03347ce5f50eaac73f31c32e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986076, "uuid": "daaf964a-d112-4928-935b-306c8049b68e", "comment": "Malware payload (AgentTesla)", "value": "0126dbce4a7f7551990ebcd2f216d393fb7a2770", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986076, "uuid": "4b83bc2a-3d1c-4068-a91d-768a6e22edce", "comment": "Malware payload (AgentTesla)", "value": "6ed123f65f66adb4ef14ae967ad1988d783abe02c6c0876ba2157bd41b1f1d36d2a85209ad4f07f06fb62d506c1460f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986076, "uuid": "66723612-09db-4dc4-a43c-59a0255b659f", "value": "T18605D63D29BD1237D0B9C3B78FC3E427F1789CA77015ADA4A8D223664392A5674C163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986076, "uuid": "6c1be3e2-8f3a-4412-ac92-5695c996b712", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986076, "uuid": "04067052-c907-4d5c-a5df-017dd1d97cab", "value": "12288:v8RUTV5ncYZKbL2eHTNQ+4iMpQxJFzF1Z/dAarc:vvTV5ncEKb67M/51Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699986076, "uuid": "d6577e27-3949-4d74-8f7b-3a86d7ecdfca", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699986076, "uuid": "9ebe887a-5b76-49ce-8ff8-ff99547c9db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986076, "uuid": "ba5fbfee-e4cd-43ed-a1b0-3a7f9fac1b34", "value": "SecuriteInfo.com.Win32.PWSX-gen.32346.7773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fd54fd-82fa-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1699972157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699972157, "uuid": "d80a114e-458c-4508-8174-b4e2b92b8e36", "comment": "Malware payload (RaccoonStealer)", "value": "72f600d9765f84afe4788425823d89b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699972157, "uuid": "8ee90ebd-97d5-4a0f-a2aa-472dd02987aa", "comment": "Malware payload (RaccoonStealer)", "value": "79ead2d23149eaa2413377b314d1e4351cbe2451839cd652ed51c5c2e9a006dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699972157, "uuid": "dff16c79-81cf-4578-b1f0-95106531f5e1", "comment": "Malware payload (RaccoonStealer)", "value": "2d2e9f045699ca83ff7a438da8b2fbed3c106b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699972157, "uuid": "afeeb587-6d26-42d9-9c85-be3a54bb7116", "comment": "Malware payload (RaccoonStealer)", "value": "edbdd54b7f9dd3b6096b1bb5435fe285d4620e7c55f9e338914b66514e5ce3c3d4a875f3389c2c0f415e254aff570eb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699972157, "uuid": "b703c1dd-e526-4a57-93ac-4b51b65e1157", "value": "T10456237323560045D0E6C93EC52BBEA573FB03778B82BC7965EB5DC425224E4F222A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699972157, "uuid": "e6cb4427-560f-4e9b-bc03-8dd03b79bcce", "value": "92ed1aaad81396ee67a06be8b3721898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699972157, "uuid": "e3e81fb5-d2c0-46f4-be15-18e8da2102c9", "value": "196608:UMFzhzVQx69pQcuQbm8GtxoxEVsG6ZI06:UMRQx0QcuoMtjVc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699972157, "uuid": "120db9b2-c0d0-4ad3-8085-d06cbe0400dc", "value": 6428672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699972157, "uuid": "ff5cd50d-acfa-4158-adbe-4f6c7db6ff6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699972157, "uuid": "841284be-966b-4d74-85a7-f286aad2d85c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257a4b2b-82c8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699950662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950662, "uuid": "31b03f12-f9f4-4a1d-aeb7-91dfd9932a14", "comment": "Malware payload (AgentTesla)", "value": "d6e1da58845f92291a7a8cc36a7e7996", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950662, "uuid": "513772d2-35ec-482c-8db9-18a4a9e7e56e", "comment": "Malware payload (AgentTesla)", "value": "7a04dd7893f89eeffa0df553493f9a5367bf08e041c4989888e84d7006a65a65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950662, "uuid": "3ef8af1b-fb0f-4690-8086-2ac8f34361be", "comment": "Malware payload (AgentTesla)", "value": "a163cc67910673826250abdf968700db8ad1083d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950662, "uuid": "b9fbb07f-eca2-4a2f-8dc6-933fec389678", "comment": "Malware payload (AgentTesla)", "value": "81304c2238cc9a9ae17d29377eefda53f664051b3ce59bba09d598d684580e970c44a9d01b06543dd0703d5199e2e613", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950662, "uuid": "fe7f4232-2fb6-4d78-9a0f-aeb426fda3d0", "value": "T101F4125533699926E87D02F9B46611C057B1FE13A191E35D0CE77B9E2BF37808B02BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950662, "uuid": "758edb6a-cc35-4419-a294-d1bf0aff929f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950662, "uuid": "d74e332f-18b0-41e2-b6cc-31703372b8ef", "value": "12288:8xpQLlfkU8GY+HqarSjZKUKNfBk3wfYJKKpJ/3SCCTKioJ8gajC:UahL1SGde3oqULTKi/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699950662, "uuid": "50244c3b-61cd-4f3f-97ec-e1b279afca49", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699950662, "uuid": "e2f32cde-3cc1-4564-8701-d8a48b850cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950662, "uuid": "aeff0605-e6f8-4cad-9270-06c3cdb83d74", "value": "SecuriteInfo.com.Win32.PWSX-gen.9876.9886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02274ed0-8311-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699981956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981956, "uuid": "092058cb-e688-4a1d-a7da-6e2e5a0c3a28", "comment": "Malware payload (AgentTesla)", "value": "a491f4dbb2e8aedd957e0f69b0562726", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981956, "uuid": "ddf81c1d-1a66-407e-b77e-4dedb273c4a5", "comment": "Malware payload (AgentTesla)", "value": "7a26f105efac6daa9226f4ab1b6bf0ff600fe2140da9fcf3e91e502ed359ee5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981956, "uuid": "d97f1169-7b33-4efb-a37e-513538bacfec", "comment": "Malware payload (AgentTesla)", "value": "ab2837b08df3e9c80a449e7fd4814a50fd7bd7de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981956, "uuid": "06c3e5a4-da44-4648-a978-f0be8172f39a", "comment": "Malware payload (AgentTesla)", "value": "3e5f6a54af95128d6967dce7465fa1a034d98660bad5ed1a91d18a49046e029b5022ccbef3fe6d40c17d39cf8f0e3616", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981956, "uuid": "419fce80-aec1-4397-b4dc-f0abff2739b3", "value": "T1C6D4F12816E41A06F6BF0BFEA471904087B4B113762BF3AD5AD170FE2D777908821B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981956, "uuid": "f0d70eff-fc60-4a06-8207-f21a57a502f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981956, "uuid": "9395b6d6-b4dc-41ac-b0c9-56994d5140fa", "value": "12288:mWOTNXc3dvunBAFnShIb6/DFwgRyZS5CJFQvWp2ynUIJ4j8Yo6TD6Z:p3dvuBqSrZwRMwUq4jhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699981956, "uuid": "d4f8f0ce-4425-48c7-a8b1-4b9913950e6f", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699981956, "uuid": "4bcd4362-ecdc-4729-a52e-3d91135ffaa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981956, "uuid": "8b4633c3-68f2-40fd-9825-dc62673468b9", "value": "a491f4dbb2e8aedd957e0f69b0562726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00f0010-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699964612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964612, "uuid": "fb0c2a9a-b871-4bd7-9f3c-c0ef71ebcdd2", "comment": "Malware payload (AgentTesla)", "value": "7686ea7d85cf70be102180c4aeb5b92e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964612, "uuid": "a66a8c7a-8498-49c4-8085-fecd91f4084c", "comment": "Malware payload (AgentTesla)", "value": "7a8f27f3ad544c3c482f04e8fcb92fdeb4d19250228b3522ad4490aad2ae4b8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964612, "uuid": "689f0612-ae97-4ae2-8fb4-497f895ce2c8", "comment": "Malware payload (AgentTesla)", "value": "6dff3f2086e1bf59fe6a58e51b4b9b344dbba20e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964612, "uuid": "38a73b76-414d-48e4-902d-33596e5bc5eb", "comment": "Malware payload (AgentTesla)", "value": "a38d4bafcd8f04192862626563bc1b716f42ace3e72a14ebdc25c7857e7217056f2a2ed78d2841a75f8c3deffc0247e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964612, "uuid": "c2ba3325-f937-4c20-9fc7-e6c8395e0a71", "value": "T16FB423B4C0DE81EF6D7DB692BA537270B3D066AC18B13FB85D1598B00F0169DA462F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964612, "uuid": "cf7c67e9-fa3e-44a6-afec-d6236d7b05e4", "value": "12288:2J8eHtOW1FDpvneg7II6z0WdrxKZa0csKPb2ZRJp:2J8wOW1F1vne6Z6wZULiZRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964612, "uuid": "25464a9b-9b24-4dd2-8569-b954c83947e7", "value": 507478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964612, "uuid": "7296614f-a1d6-4348-adb5-6946d11b47fd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964612, "uuid": "8f4d2014-66a6-4b98-937b-c61d05069ba2", "value": "AD9613BCPZ COOPP03.23.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3d1ae2-82eb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699965921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965921, "uuid": "03b746da-32d1-449b-8e1b-e2508e22151c", "comment": "Malware payload", "value": "5cfd315ff5377ba4e0d0b916edbd8e37", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965921, "uuid": "c230b884-4391-46fc-b623-6920d2acdeaa", "comment": "Malware payload", "value": "7ac271b284c02f95bf6333c1de26f494eb6b780ce09d2c704afa3cdb112f7528", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965921, "uuid": "e266046f-67d3-454a-98bd-8c13ff6193e7", "comment": "Malware payload", "value": "02f50042deb904bcd54a377caa6f0eafc11414ec", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965921, "uuid": "a82706a0-d4d6-44e4-82ae-396c546d0dd5", "comment": "Malware payload", "value": "2061776125db9c0483c1d7cc34a4a779ceedb1e1e089d1f74cba02c1fb3fd0cc3157f592a7fb25ea7de2e309ba87956f", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965921, "uuid": "5344a8d7-c1b5-44f8-90e9-bed905234301", "value": "T1B461C0932151B8EA414283BF3D4966FA807FC264A55AA044F78C4F9DF9DDE63398E7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965921, "uuid": "3c391e35-e2cd-4247-9fae-e1501ad88e8c", "value": "48:wS+MTLimb7F6CSkuKZA31jCQfRJL0HuQHhFi5QsvuiBrVxqT/sMhG:GGtV6CfuSA31jCQfRJL0HHmAiBrVMhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699965921, "uuid": "1ccc4f0c-3fa8-4c7a-b5fe-508316cde912", "value": 3240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699965921, "uuid": "76040f8b-3c56-4170-a302-1d851ac8be65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965921, "uuid": "c7e3da91-67e6-4f82-a049-64c6d8c956f0", "value": "1mcvD5EU.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c237c60c-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982708, "uuid": "0d5a7478-a1b2-4dcf-bff3-00267b6259b7", "comment": "Malware payload", "value": "a182f0f0c04e0069a838ab96fd52c3c1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982708, "uuid": "5fc3c468-c421-445c-88c7-54858a0f6031", "comment": "Malware payload", "value": "7b9c99c1aeb0681b96a38c5084658497d4ebd6a196f8618030cb034295d825b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982708, "uuid": "e73530a4-eac4-41ba-9fb6-145327178b92", "comment": "Malware payload", "value": "50b11472e4e29f30bf60983d589ca9ae42951469", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982708, "uuid": "0a0ab2ec-b653-4325-bfa4-55224cb35995", "comment": "Malware payload", "value": "605f2e77cb739b182994ff2d18c9d4d633acd99cb31e8dd05e3ef8fc54201a4722a187ea2fc5b07a9f0ac25610cc1e41", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982708, "uuid": "0c0c0652-f744-4714-9405-553d0f76905b", "value": "T1DE25275FFE808E1BC894883248B7466176B3A6A23F85CB0B708C352E3F671557E875D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982708, "uuid": "550facff-f274-4528-9738-6e28354c5110", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982708, "uuid": "8ae59a96-0ac3-4950-b449-595c7251430b", "value": "6144:+RR5rhZFQGrsUwF7vlPoSAzc5s2UuHvfNdKyNbC/M447uHVa8opl0vI/RqR08slS:+R5nWFpPoSpfC/cu1a8C0vI5FilhV8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982708, "uuid": "cce5e9ef-23a8-4d7b-ba4b-070bbb2d3c6a", "value": 986429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982708, "uuid": "c05b82af-c13a-4bb5-a9b3-43adf01d5e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982708, "uuid": "6c0b6af5-2922-4e89-a811-fc2efa7941a2", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.24412.8436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d974090-82cc-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699952582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952582, "uuid": "bd387b99-7bd6-4e32-986e-207a05464d54", "comment": "Malware payload (Formbook)", "value": "629da1498f69c1749622070dbfeb5069", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952582, "uuid": "5007c878-8736-4537-b740-4c8d15747e69", "comment": "Malware payload (Formbook)", "value": "7be9d6679205f724ef08f8aeb900ff19e0ccc47bda06a458cf84138406056de4", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952582, "uuid": "ec620031-bbb1-41ef-b3e1-bc4f74028b26", "comment": "Malware payload (Formbook)", "value": "0a4d8ed66e5c840cc1a2e67fa2430d14a2cc5134", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952582, "uuid": "61a0dc1b-3852-449b-aced-46d7d17c82f5", "comment": "Malware payload (Formbook)", "value": "961b0e6294e8e0bd9f061c9cdad7d31b074eb306285a895be2a5fb4e19811d43317a9482a72a6906fcf0f4f9c4c64ffd", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952582, "uuid": "ba428f16-998e-4712-8937-f4a62adfa09e", "value": "T19E7423CF11FA8F6DC0A754C0B967A682334AFBB0E66117C72690A88F3C9975C9D8751C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952582, "uuid": "307acea6-e6b1-4df2-91b6-b5f3c263537b", "value": "6144:loA5lzmx31SeUCpcWbeZnM9zgbm8e/vxCP3U0J5Wrm:lg3AeUCpnbeZjjSpCP3UUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699952582, "uuid": "f9e0ed3b-2b02-42aa-a6fb-1dc68c8c24d4", "value": 338330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699952582, "uuid": "9f6c7f4c-1a64-452e-9e2f-89bd56770f94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952582, "uuid": "d0f4879c-2618-41a3-aeef-402beda03708", "value": "Order QR-00658.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c50780-82db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699958988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699958988, "uuid": "695b9236-6ec4-4184-8b8a-2279f6b60ec4", "comment": "Malware payload", "value": "79d6a26d9a494e1939f6b1f658689f43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699958988, "uuid": "9dcf85b5-8bb8-440a-8a8e-0969dddf3625", "comment": "Malware payload", "value": "7c694dd1d56f0082c40c850df23deb92f994cabc5af5a391f52e7e1702b50def", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699958988, "uuid": "31b2170f-a51e-4ae6-be5c-312fb17f21b2", "comment": "Malware payload", "value": "7c90af55a174b88fbc10221d08dc910eafa1a95b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699958988, "uuid": "7b808626-cf6d-492d-b017-738a62ae58af", "comment": "Malware payload", "value": "8932ab2011946d197826efcc058e2f04d15cd5519796e0d027b39c77c43c4c2ee79e99f613042353c9d5c472d366f2d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699958988, "uuid": "3ccc9446-7d2a-4312-b6ac-91303dcd754d", "value": "T1AD0523259E868D23CDED097DC52251A0B2B4E287E242F3AF4CD4AAF38D937C617154DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699958988, "uuid": "cfb55dfc-0fa1-460f-a68d-8b5781f1fb80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699958988, "uuid": "8b2d7d13-a865-42ac-82b3-31e8f0b6b322", "value": "12288:3F5VztK3xmM99moCGHiwkN4fPA492ANzlszPthJS/YaYCF9jmNjjF2VDbnKvj:3VztEQe9GGkNIPAQWFSFF9jmNjjF2Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699958988, "uuid": "6f446878-0cec-4011-a864-56d0107bc0ad", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699958988, "uuid": "7b365d8d-6dab-465b-9d29-665f3aa7672f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699958988, "uuid": "119502e0-a23b-4c6e-8d62-f0854c110952", "value": "ZAM\u00d3WIENIE_N.2311351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d166b3-8300-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699975040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975040, "uuid": "600337fd-b135-4346-8124-09f0fb4b8461", "comment": "Malware payload (Formbook)", "value": "9fa5cf02a4595194f91240f7adfcf1c3", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975040, "uuid": "20b2961f-7a92-4633-94e8-496939831aa7", "comment": "Malware payload (Formbook)", "value": "7d3b00a4fcda70ad6620192068b141cc01d43f1d4ed650ddd65593cb24f7f9c1", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975040, "uuid": "6289a184-cebb-4cb2-89ea-2cf77ad34e6b", "comment": "Malware payload (Formbook)", "value": "d9296131a7f190c55d87f8e3d7346c8b4142e8e6", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975040, "uuid": "fc4fc572-b1c4-4ae9-a811-33c85d6c8139", "comment": "Malware payload (Formbook)", "value": "e26fadf6b7e40f1f47359573cbe721e52c947b2aedd5a664d03c6730c85e4e6fda2b22a59a06217969b010ce80aa3599", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975040, "uuid": "79340d88-84e7-4114-a3e0-55e948932f62", "value": "T10F7423A77F4FF33EB53C6D091B56A7D410EF4993CD8A676700032862AD914BB40A93B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975040, "uuid": "d14e1425-abe9-4053-8a87-bc3d4a7c5395", "value": "6144:/3eQm3UKgMrmn3AMnJJzbIbv4dMkU/rhULukZt3XpLDEnuVyYM98rylE:/eQm31fmndbz2R/FULukj35MgryW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699975040, "uuid": "ca115d96-14d5-48c3-9c7b-557157e70f53", "value": 337541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699975040, "uuid": "70fab047-a285-479a-b8e2-496324411f78", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975040, "uuid": "908a04aa-23a9-4a01-a47c-f1155b5d8ee4", "value": "Shipment Document BL,INV and packing list.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae22a0ff-8302-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699975802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975802, "uuid": "3047e6a0-6ae6-4074-a602-fa304ca3c6a9", "comment": "Malware payload", "value": "cc8b7041532e9e251a2eff40fc3c323c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975802, "uuid": "9de81004-8b17-487a-9d28-4bebac0be361", "comment": "Malware payload", "value": "7db04ddb55518c98493c17e533c6607d28a10d5385aa236d9a84a10670c49574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975802, "uuid": "c53c9e27-935d-4382-991e-a9cfc70baea4", "comment": "Malware payload", "value": "33cd1d462a80a2bac76b82d06d7e826e9db6b374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975802, "uuid": "fbce2327-ab9f-4f42-bdea-a706792eda77", "comment": "Malware payload", "value": "a08eea2aded3c539b1732b7727651538e9b84eeecc1c509967320bf51cbf65fe9f2c0620ab1850e83a0fe8d4b237e452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975802, "uuid": "414def5f-f261-4b90-b550-fc045d334149", "value": "T1BA943B10B1E25AAAFC63873913E9E154E4AD77015B1166B70B7C2AF88BE43C5CF6D04B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975802, "uuid": "fa5acf29-c860-4362-9fa2-b25af5a93ff8", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975802, "uuid": "f9b7ecef-ef8f-40cf-8e81-8c2453911796", "value": "6144:GcXiUbluekAVmOHxrknAOYx8tqp3G8pd0ls8m9b8HxCEyl+Lr:RiUBuelnknzgvf0ls8mJ6vnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699975802, "uuid": "454ba61f-e0ba-4c52-9166-ed78732c7578", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699975802, "uuid": "acb60e7a-e907-4f0c-8d96-6c5cb6aa1982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975802, "uuid": "9f4b47c0-0a97-4eca-82cc-547769329df0", "value": "SecuriteInfo.com.Win32.TrojanX-gen.10033.27944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b7e4b0-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982694, "uuid": "2d1097a4-ef6f-4511-86f4-de25e1c9841c", "comment": "Malware payload", "value": "1a613510c193f44586d1c55bea813b17", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982694, "uuid": "1890cf84-5e8d-4459-9302-af2e17b2c545", "comment": "Malware payload", "value": "7dfc837c2da8c5a32150052a9876447170d8923b31409a3a1919d918027cae19", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982694, "uuid": "7dc8764b-456d-4adc-a248-51aaeca1d015", "comment": "Malware payload", "value": "15509fd1c30b57e703ea0b85fde605005af084ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982694, "uuid": "22bf7acb-6722-46ee-a62c-4a4e9c91c182", "comment": "Malware payload", "value": "149672c3954abdd47fdd38231da10ec949074b887bef892d0ba10adc73bf78fef7a976c6dd2d4092a59a92652f5c2e0e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982694, "uuid": "82815fcf-04d6-48ad-8a02-93b3603d0698", "value": "T1C464C53635B9882BC021C6306A769BF4541BBE334DE28243A58B7F4F7CB6185EF93165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982694, "uuid": "18771ea5-e382-473c-aec9-d475d81ad5c3", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982694, "uuid": "4a0f335f-896f-46e8-a918-7bae6fe741fa", "value": "6144:+RR5rhZFQGrsUwF7vlPoS9sL9dFc0q2+lMs6451s8:+R5nWFpPoSOL9dFq2Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982694, "uuid": "fd99b103-5858-4944-80b4-db2024b3c6f0", "value": 336524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982694, "uuid": "fe12d2be-c6bb-48a2-a6b7-dbbddc308d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982694, "uuid": "e378cf92-ecd3-4ee1-bf48-4081af710c50", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.8628.30807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a32b90-82f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699970574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699970574, "uuid": "12ac0ea1-6a3b-40bd-91db-62b4a213b42c", "comment": "Malware payload", "value": "ba200438ff24d871a56dff7a2df554eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699970574, "uuid": "0246a5dc-fd47-4613-be68-86b924fa6c3d", "comment": "Malware payload", "value": "7e2fc238252c47231d37ab938055672b07423ce2688bb32cff3b97dc179fee9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699970574, "uuid": "886a7b1b-205a-47f9-9922-6a973c0261c0", "comment": "Malware payload", "value": "61ed0d05ccc16607e5f26eaf487f1a97a17ae179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699970574, "uuid": "fb91f532-4e0e-4b54-ac17-a3032452b210", "comment": "Malware payload", "value": "ed0b2e9b7f1ad3e78ba7af7423013f07647d347ee76731420f103c93383479b05175d1cf38b20f5d66f123813aeeba78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699970574, "uuid": "ac405113-37fe-491c-8aa0-0076cdf4b95a", "value": "T16FC66B90D2F1A68CE4DB85368E6073F4A3B3A4237B23E355DC54E625782D3E78AC4563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699970574, "uuid": "80746983-95bc-41af-b362-8bd8f911c81b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699970574, "uuid": "66ba90da-3b8d-407b-9607-7ad9355fcfd4", "value": "98304:DAbxta1VhHg2ZWlJzbTKbq99/fKG1nEB/bE7ccv+1111mTPeiv0xxx++BYzlfj8L:DAbxtaDhHg2Zzbq99/yyn77RMC1Qv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699970574, "uuid": "939ab3ed-7ef4-4f56-a7c3-2a14f5ab92a6", "value": 12146032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699970574, "uuid": "38f89796-afca-4e1d-aeff-0f933e16337e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699970574, "uuid": "75533cb9-8a80-446c-aa44-05144bec3ebc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904c8329-82c3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699948694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948694, "uuid": "482ce57d-021d-494d-a3ba-f1760fe31f15", "comment": "Malware payload", "value": "c509c2b292c0211ebbd3f64b879d180b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948694, "uuid": "9ee182ca-97a4-4290-9d46-b4a018316127", "comment": "Malware payload", "value": "7f17d3d47f053498a3efecab532932dcc8018e3ee0da60fb090be0abc3fa5a82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948694, "uuid": "138b5d50-e225-41c5-88f3-b649f72dab69", "comment": "Malware payload", "value": "ee4e69780494d8530d14440585a2a576c3722b8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948694, "uuid": "c22dbe67-a6fb-484e-8af2-1eedc41d9474", "comment": "Malware payload", "value": "8bae6bf75197b10ac87fe1ccbe1657ef4f9baa9c547cc6cdca25eda93ac99f0e4929dd9bb987ec812cacb110729d2c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948694, "uuid": "33ec325c-3c01-4027-a69d-512ee3127e4b", "value": "T14FA53330C31192A9DE24633D6966C2600325BCE4AC7193AD652F7DBE18B359E8FB5273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948694, "uuid": "0d5ec558-10d3-4ea1-ba00-c83532e62fd7", "value": "a9fcfb15a5aa9fa0f3b761a2696ae772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948694, "uuid": "080b807a-c4b7-458b-afca-405141ffb269", "value": "49152:p83IHWKXYjZSy5mVrCX+isdjNWjS3YByt6q6UacjGU:hHWrsdCqpWGpt6q6nsGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699948694, "uuid": "e22b0003-014c-4125-93ca-36c87e067c9c", "value": 2159120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699948694, "uuid": "beead8a3-71de-4908-83ef-5efe8d470c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948694, "uuid": "d9061e8c-0ea8-4543-b0ab-56e81ceb0f6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cd2ea2-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982684, "uuid": "397844bf-06ee-4453-88e9-064095c16964", "comment": "Malware payload", "value": "c05d6b562a9ca912d1a0899bcf7ec02b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982684, "uuid": "75834fa9-aa27-47ca-9cc4-d3310aab07bb", "comment": "Malware payload", "value": "7f25012f931ae9d691b9b2e393ec959eec7bad5987805440f325b13b3c033957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982684, "uuid": "a826f277-258f-4e3c-992f-ba4b995a5a21", "comment": "Malware payload", "value": "9a398b2d74ddc4a67d6f813bac722fab51330f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982684, "uuid": "3f330921-b96f-4a2a-bdb8-26b4258a2d1e", "comment": "Malware payload", "value": "0d5d095e46646dab6b113f8a6999b94c12107ceea411ad59a83df1d27872a636d5246ca8e802c555687a22141d37eaf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982684, "uuid": "180ebeff-4cdb-401c-af62-a56db6c14d9e", "value": "T11A357C1732915033E6B279364A1B42ADC826FE161D78345A6BF9AC483D35643FA72FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982684, "uuid": "da29202e-e4cf-465a-affa-fbcba742e58b", "value": "12288:CGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3P:CKvzcrnyaLO+3Yb/wQeAh/7ROlgCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982684, "uuid": "b35e81aa-0757-49e3-adfd-cc233ec859a4", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982684, "uuid": "a324e2de-4794-4965-8c7b-2594ff17f441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982684, "uuid": "90857378-3c98-4a9a-923e-a4a021bca3f3", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26581.31256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e2d809-82d6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699956669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956669, "uuid": "1c76829a-f5a6-45eb-92d9-66fb3a48b4d2", "comment": "Malware payload", "value": "09fb9a24fb470360bc69585d50dd2a29", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956669, "uuid": "f8f2d8bd-2d09-483b-92b8-67420baf13ad", "comment": "Malware payload", "value": "7fc8d7dc73ea28fb88262e807b2707ff6bdf2ba3b84ca2b4d866dc5e9e2def8e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956669, "uuid": "e002131b-5b75-4b03-b364-9203735e5f1c", "comment": "Malware payload", "value": "03d2b1ef6ee4c493d6bd9fdbd6bcfb1c4fdd22e0", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956669, "uuid": "b21fef2e-47b4-4164-858b-03c450956e4f", "comment": "Malware payload", "value": "760f172df69739b003bfaec3026b58f271347c9a25594c69d0791dffc5a38e15611625e8bbc3f2b051034a7ff4f99201", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956669, "uuid": "26a47eeb-b56a-4c86-9d95-28bf55d62a2e", "value": "T106B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956669, "uuid": "24b73a19-5618-40f1-9fbf-14759c92bf9a", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956669, "uuid": "260ecbec-d67a-45e3-a640-fd9fc7a47a63", "value": "6144:JexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7zpUlLaEx:JeZeWSpda70ADIgSoxgUW/zFun7OhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699956669, "uuid": "c00c7069-9c7a-40dd-b089-de8546d59465", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699956669, "uuid": "ea387cbd-6ad9-4fdf-aa36-cb1035ec8d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956669, "uuid": "f92bc69c-fe5b-41da-90eb-04e3c1188b7f", "value": "informaz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc2cbc4-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982704, "uuid": "109ccdd2-eef8-433f-8f20-de9df8eefe9e", "comment": "Malware payload", "value": "ac1e4fe8a2bfdc5bfe087003458b6adc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982704, "uuid": "8b22a4fb-9147-4929-9d57-7eecbf81adf9", "comment": "Malware payload", "value": "8022240f5a37f269d0a553c7dff56748864cadeafd8a603ff2920cc69c6bbf76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982704, "uuid": "395286f6-8289-489a-84e4-7281c1f19640", "comment": "Malware payload", "value": "370c3b2f24793d6a4dd7c6125288908f528e0bff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982704, "uuid": "1f7abf1e-75be-4711-9975-019f0597ad38", "comment": "Malware payload", "value": "958b7925b6ba0d62955a56d73b71410b4f2d862a76c7d8efa975e31a2ecff1eacbea48435f85692f2b9b83de2dad4c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982704, "uuid": "fbb8e24c-1465-4175-a18d-3f016701c8a5", "value": "T1C8B50196F6C08173D1A508F1281B43CCEA26B8F1197DD96702F3675D3E322B8A53779A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982704, "uuid": "98b354af-2f4c-4758-ad50-a2fc10e89d64", "value": "2c4d9154d51dff5c506e63e5a6ee71a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982704, "uuid": "faf97b24-a0f0-4399-b1c2-13df81bd78ca", "value": "49152:flwIX4Dkn+zLG0fdP5VG0BcEEDocKHsR1X3F+DR6/PcHSYuW:twa4D2S5VG0Ba0tHq58DGUEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982704, "uuid": "dbdc6d8a-1af2-48a0-bc43-087c9a60146a", "value": 2280045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982704, "uuid": "adc20ebc-3da6-4dc3-85c6-f4182d84b7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982704, "uuid": "b01f5f05-9003-449c-9577-837b950d0b79", "value": "SecuriteInfo.com.Variant.Babar.303591.25864.8928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6532d39-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982715, "uuid": "bcd98ab1-a0f6-46b7-920b-4128e7a3cf96", "comment": "Malware payload", "value": "7c802f3ddeeee7f8736e03855c7a9b6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982715, "uuid": "557c5305-91a5-4e17-8c68-7f3afafcb1a0", "comment": "Malware payload", "value": "8383d1cf45e6dd5345dc5d6e7aff4dff75a5dac629a617cc08150924ab019fee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982715, "uuid": "ea8cc312-9282-4857-8f71-98daedd22ec7", "comment": "Malware payload", "value": "b2196a8c6e771ab485416e19f0d53f1c419e1ee4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982715, "uuid": "bf7d18eb-9703-4880-8a5e-6ff9e7eeb0b3", "comment": "Malware payload", "value": "fdf486b40e90a347dae3980e66bbdcce00f44e4e0a18e3aea8de7ec3d901e09a762717fa7ec25aa5985e536373c8499b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982715, "uuid": "023f0cdb-dd2c-4c7e-bc0f-c0e568f2c7a1", "value": "T1DC957C12FA81C5B6D02C263104B66B793778EF954D118B87F3E4DEAE3D322905A2771E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982715, "uuid": "967cbbb7-0cee-49ac-a7eb-4e6942e13db1", "value": "1c96bbd6353bed8f7000194f5fb5ef25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982715, "uuid": "ff8b649c-7631-4eff-99ab-cd0932147982", "value": "24576:AmAMCPPzfhLVC72fWyXbdIgNd24CayxiG3/wXGFtEeFbpsbcpdG39:ALjZVXWqWgnVgoiwXGLEGpswG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982715, "uuid": "15f0802c-c5dd-47f1-a32a-0d5cad8f27b5", "value": 1988407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982715, "uuid": "257fc0e9-cb6d-4999-8544-590817d9439a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982715, "uuid": "f62ae087-5d48-4254-828f-6f2df0b120c6", "value": "SecuriteInfo.com.Win32.Evo-gen.24628.20579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fd588b-8321-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989164, "uuid": "b103ff2e-ac35-4eff-9441-32cbb18947bd", "comment": "Malware payload", "value": "b449edd3b60245a4f97987dd5afa9811", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989164, "uuid": "78868802-927a-4539-8193-265b3c753c8c", "comment": "Malware payload", "value": "83981024c834aacc141729a185cc3f3771e04feb8632ea209d47909e3b82d4b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989164, "uuid": "edf7a26d-58a3-4f15-af3b-bbc364de3d49", "comment": "Malware payload", "value": "0201f84b61c4507353745825f70b7b7eabf6860e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989164, "uuid": "acc81827-adea-4534-ae25-e00848179907", "comment": "Malware payload", "value": "10cbc669c70176a18552ba4ecf6d0fa34bba6a69d9e88093f8e8db2f72dcda3ff6ec04bd29dd6fc689b07471d4216f35", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989164, "uuid": "06e8cc91-5403-42f1-beab-41e5f0ead1f4", "value": "T11C935D27B552C67BC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989164, "uuid": "ad143fdb-e17a-4259-aa67-9041710be835", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3EyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjK0ifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989164, "uuid": "fd715ff6-d18d-44d6-acb2-5412acd6f24d", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989164, "uuid": "af0be56c-c864-4432-92a5-4d66e05e5862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989164, "uuid": "82f994c1-47b5-4134-9f23-f557197801c7", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecddc82-8323-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989789, "uuid": "69370680-95be-43f5-8ff3-1c896035f772", "comment": "Malware payload", "value": "f01f5bc76b9596e0cfeab8a272cba3a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989789, "uuid": "07fe05b7-2557-4458-abb9-550771b541a6", "comment": "Malware payload", "value": "83ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989789, "uuid": "1a6e4f8c-1237-4990-a0c5-80e569534f03", "comment": "Malware payload", "value": "19cab1291e4e518ae636f2fb3d41567e4e6e4722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989789, "uuid": "c71f3fec-4a38-4924-8e56-ec5dae961e13", "comment": "Malware payload", "value": "93759d53859cdd539b36c5d002bda7ea89b3bc94935e22cc66f51ec05889ced9e130b5582edca5298d7ca3591c2931a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989789, "uuid": "6874f5b2-7684-45b1-b723-ec23959fb42c", "value": "T1EC457D1BA36501BCD4BB9178DA234A46E775700603709BEB57E05AAA2F13FF15EBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989789, "uuid": "01b9d0bf-8a78-4a7a-aaee-2d44c16dfdc7", "value": "c1660912b726baa5dac8bf47e5fa01c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989789, "uuid": "225145c9-f6c0-4766-b422-3c15450ad36d", "value": "24576:Pc6CX/YqLAS81Un+J35XBMpZ9+Jo73Jw/tDMX/td:rqLAS81UnI5XQZ92ogO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989789, "uuid": "d2986c6a-b120-4667-b5ef-894ba8081e1a", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989789, "uuid": "1ed3983c-0e40-403f-9e1a-a2f8797d5e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989789, "uuid": "98d69fa0-1282-40d0-a252-4e1b89fbed2c", "value": "cred64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb950e1b-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982724, "uuid": "511444e2-096b-4665-9a23-955bfc05898a", "comment": "Malware payload", "value": "935f4c5f1f7f7e9b3b4843aa4b048822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982724, "uuid": "e0588661-c2fe-437f-97a8-acf2ddf6d658", "comment": "Malware payload", "value": "84ff81ced73bc59be766c505ef9e65c6f898f334d3de0510d18248254119b326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982724, "uuid": "df074125-0f97-40fa-9e6f-a94805c1e9fc", "comment": "Malware payload", "value": "484cfbd071927f6e3b4fef16daa3e335b89cb6d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982724, "uuid": "7f35e28a-3e10-47de-b5ac-f03261577b42", "comment": "Malware payload", "value": "e50f3f0ed2c2d4e712df70d26cf87934a1d36a12046201ee9a4188545f6fe1407c96b08f7718d78da917075b1a97db99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982724, "uuid": "5edb67a3-c0de-446e-bbf8-b5e7687020d7", "value": "T160357C1732915033E6B279314B2B42AD8926FE161D78386A6BF59C487D31643FA72FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982724, "uuid": "4dd4cd3d-98d3-4505-b4a4-e80f33e42502", "value": "24576:xfdWTzFpXnVH1BS958zRP/e4tIUkeNM5vbNrMB7QaB:pdyFp3DBG58p6jBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982724, "uuid": "84e89b68-5b34-4e6b-8769-ba7267e46a3c", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982724, "uuid": "43452f0b-1ca0-4af8-b00b-e4386d427631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982724, "uuid": "0784017b-4a7c-478b-bd5a-b89ca70a5076", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17448.19672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0cb420-82f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699971799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971799, "uuid": "848963ba-99d4-482a-9f03-f3e26ce7f055", "comment": "Malware payload", "value": "7cab4e477b0eb201972c55bd1df06d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971799, "uuid": "23bbef8f-ec97-460e-8e0f-99454329cc15", "comment": "Malware payload", "value": "8538681af5bcf6c5742e9407c89c6caabe24b0453397b1712448177bff21f6d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971799, "uuid": "ae97222d-17a1-4b33-8d17-18d24d22fdac", "comment": "Malware payload", "value": "171b1708cb9622c0fe73e1942bd21da03fd3bfd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971799, "uuid": "ce3fcbab-74c4-4383-b1ee-0533b23a8e64", "comment": "Malware payload", "value": "6fe771009076fbc86a0a909880665656de6450014a5ad8c063b422d79b9ee643165f471e82038ebb7356c9dc2862d6a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971799, "uuid": "ccbeffae-d80b-4988-957f-b96c19e7a661", "value": "T1D5B66DD3F491C433C2321DBCC86E50A858657B622C6F189B77EBBD09CE681E1518F5AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971799, "uuid": "527fe944-d6b1-4caf-b5c4-e5fe8bcdae60", "value": "1536:svGJxOf/BEy4L2yt3ZMsmcy5uFudq4OXj4W9uiBmBCBxkIV:seJxOx2BZ2cDFudq4YjyiUMnkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699971799, "uuid": "c0f808c6-c6a6-464f-a496-20e7153167c2", "value": 10490368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699971799, "uuid": "796a5a7e-6ff8-406f-9329-0414d6d3a998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971799, "uuid": "d7e64731-c266-4c3f-bc1e-c449bba9ec14", "value": "bet365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c52ad47-82c6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699949761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949761, "uuid": "4215d669-f497-4307-91b2-ccd22beff5df", "comment": "Malware payload (AgentTesla)", "value": "867a9334691e4a998f4159c46fe8d42d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949761, "uuid": "a6826ee2-1c7f-49a9-a6e9-819297742aac", "comment": "Malware payload (AgentTesla)", "value": "861f1511b4464e0c3fd64db843fe357894204b1427014232c6c7434b02947811", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949761, "uuid": "d8065532-c9ff-4f49-a495-ee7a33aed584", "comment": "Malware payload (AgentTesla)", "value": "9c36d376c7e82416c0fb6be3656745beaf5c4bff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949761, "uuid": "60c78a5c-5e52-4fef-866c-26444bd991d9", "comment": "Malware payload (AgentTesla)", "value": "88d5db34cbccf2114ca0d13da498e78b0d03f3bae78be66782c1de46fb036b31ecd98e830eb029ae2af749c96d439dd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949761, "uuid": "e58ad7d2-5ade-4949-b9a6-20e378c46606", "value": "T1D7C423585E36E2B79D0D3EE25441D08CB2174BC0D1E5526B28A5291FAE031FAE6FF84F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949761, "uuid": "ff3ee84c-69fe-4447-802c-aa9772d109e4", "value": "12288:niE54BT9A3alnw18LI34okqNvoAO+rWbPSVC10yG4sUbBecY/:i4mT9AKmJIodNnOCxryG4VE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699949761, "uuid": "97946815-4579-4264-841e-f34c959ad3e0", "value": 589131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699949761, "uuid": "dec7d82f-eb49-46d0-a84a-324d4ac20f18", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949761, "uuid": "fbdb95e9-b473-4ba0-a3e1-99add24cfa6e", "value": "overdue payment.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf220098-8333-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699996876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996876, "uuid": "c5da4f6f-435a-4b28-8285-5cbf483079a2", "comment": "Malware payload (AgentTesla)", "value": "f3b140dcd58be134e8bae5c824f122e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996876, "uuid": "2058d5bf-5f61-42a3-bcfa-bf2bccaf6457", "comment": "Malware payload (AgentTesla)", "value": "8645bdb895457e08db9625bba8903490cecaad66c6cd3c0af3688afa60a425c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996876, "uuid": "f1b08327-11a9-4397-96e0-1f743de7d3eb", "comment": "Malware payload (AgentTesla)", "value": "62b26d69cff580973e6062b239ff5ca0b7e62781", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996876, "uuid": "ef22a806-9d64-457d-adbf-bc77abc8448b", "comment": "Malware payload (AgentTesla)", "value": "d058d30c0e90e99a5fdf9a1b2e960a7c8d1d253b55f81d0778734eb06b015b8749131e1ae82e2ea3bbdfdadbcf5baf90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996876, "uuid": "305e0806-85d6-4408-b07a-7dcb280d923b", "value": "T18005E53D3ABD1227D1B9C3B78FC3E427F1389DA77015ADA498D223664392A5674C063E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996876, "uuid": "0d355926-8c24-4df2-8001-4604f16c096c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996876, "uuid": "b91d811f-a644-43c9-b1f6-229e00f27c8a", "value": "12288:YRUTV5nILpRNgjHzMQjA3lMhUS5x70f0lrP/D2tIcLRT8FN:DTV5nwL6jHQ3K80lzDsIORT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699996876, "uuid": "b55096fd-4153-4be0-a2d7-b12143130c87", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699996876, "uuid": "19dd248b-5899-4155-a332-b0b7e46e1a95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996876, "uuid": "5c78d747-a1d3-4db6-bc60-4827ed738c23", "value": "SecuriteInfo.com.Trojan.Inject4.59820.24882.29359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8aada25-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982719, "uuid": "fdee5ec3-ceae-46ea-a87f-e130dc783672", "comment": "Malware payload", "value": "ae8328b4dc66b9fd0c36ec290789d06a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982719, "uuid": "96434b95-b935-4d7f-99b8-30334789ccc8", "comment": "Malware payload", "value": "86951a2c31972c2d34d5eb44f518c05a449c00d751163282639f41bc5fac09f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982719, "uuid": "a73d12f3-25a4-4bd0-a0ae-f9c7ecf2820b", "comment": "Malware payload", "value": "d9f0facebf3b2dd1ab09f5b71487e2720039409f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982719, "uuid": "282a2e02-46d8-4dec-a8d3-12764c2a5873", "comment": "Malware payload", "value": "11d6ef78667b72caa5360b1e8e7e507a09db541de374fbc18a321f581df06f03de798e5711e4cd27f1acde9d7943fef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982719, "uuid": "288a143f-3c2a-4020-b3db-4f592fc81a30", "value": "T176357C1732915033E6B279324B1B42AD8926FE161D78396A6BF59C487D31643FA32FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982719, "uuid": "deec68bd-f6ce-4a52-825c-be5e38c3e101", "value": "24576:ofdWTzFpXnVH1BS958zRP/e4tIUkeNM5vbQJDGDym:mdyFp3DBG58p6jBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982719, "uuid": "a4f9192e-9b87-4641-a6d8-6f710fb7d5bc", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982719, "uuid": "33c661c0-e0fe-474a-8d51-c607f548cdfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982719, "uuid": "b12203e7-4b35-4a9f-9b9b-302de401ca92", "value": "SecuriteInfo.com.BackDoor.Pigeon1.11241.20157.15169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ebeca2-82d7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699957458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957458, "uuid": "8e76a91c-bc6a-43b6-b9a4-0352060cbb37", "comment": "Malware payload (AgentTesla)", "value": "ff78ba298b2f669075b2e654f14ba268", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957458, "uuid": "4c64c1b8-1fcf-4da6-aba0-dffd6c43daa3", "comment": "Malware payload (AgentTesla)", "value": "8992f05844656419027980e08a09950c5162846b52277dc662b4866dcfa18871", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957458, "uuid": "8a15b74a-a603-4771-983a-b5d027ecd322", "comment": "Malware payload (AgentTesla)", "value": "3fcd556fc53af3391a8f4d1405493af17c7f8d27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957458, "uuid": "0de2960b-166b-49d7-b02a-9ddff66da80d", "comment": "Malware payload (AgentTesla)", "value": "23a3b987d28bf60d4bedc00af1cfeee0b68e1e5f3d8253e1a48934371908d85b93d243fd45b9a3dec0b2ab6651bbc77f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957458, "uuid": "60cc8c50-c76f-44ef-810c-8ec41c0d0c47", "value": "T1DAF401163324492BE46D0AF9B86651C147B1FE13A561E35D2DA7BFCD2FF3B8046026A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957458, "uuid": "dd091456-035c-44c6-bf27-61d10e66ab88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957458, "uuid": "cfda9629-3914-404b-9c8f-c2687c9e068f", "value": "12288:Tk4LlfeQVdA5bL00QqjOCOKJinZoe/xlP4xzs7GtwVVzuZyr0EE:5hGmO/9TjOGiSslPeY7OIVzuAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699957458, "uuid": "fdfa635e-847b-465e-9379-bd888fd5c312", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699957458, "uuid": "bf3737fe-c250-450e-b773-0fab37f04336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957458, "uuid": "76331415-a6f5-4429-bad8-7f1709eab80a", "value": "SecuriteInfo.com.Win32.PWSX-gen.7740.23798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92732248-82d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699955570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955570, "uuid": "25989c26-5ec1-455d-9625-0db7028d7f0f", "comment": "Malware payload", "value": "6f8860e341610f07d07f5ca29e771db6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955570, "uuid": "4a047c19-0392-4519-b0da-3ca7064706f6", "comment": "Malware payload", "value": "899c4c78e96a4c19a650d2cad2ad6b7e358bc78f42c9ba9407821e0be43347f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955570, "uuid": "d8de3545-e224-4cdc-80f4-2fc2c94f14e0", "comment": "Malware payload", "value": "fd5b088a5a5eea5fd8a76c7bd984e8aae3e0baec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955570, "uuid": "3531cd98-270b-4f34-a8af-671d43c0d16d", "comment": "Malware payload", "value": "03c8b82b0cbb77d3eca644e46c0f61490e80e6f03f24ece3454dc3a25f280af6351e076d6e3fea1154357154ba90ee7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955570, "uuid": "f592ae23-b173-4b9a-84aa-200407f61f3a", "value": "T1BAD4221C37FED716C8BF6BBB0A75132923B198951232D74D4EA018E13E26BD44692F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955570, "uuid": "96d5cc5e-2f1a-4530-866d-d4582da88ec3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955570, "uuid": "ddf3d571-5ce8-4e1f-bf65-2934c5187063", "value": "12288:70V4gA4DOLza2lEVuSHy3n6TNRZ89cOD7BpG1u+W8bvQZAIzJlGBy1X3hdh8n:7EyLuiMyKTNecO/GW8bhQJGyt3Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699955570, "uuid": "c617c85e-fd15-43bc-8590-f492ead71c35", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699955570, "uuid": "183af652-2dc9-4947-b1a1-9e478ef42785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955570, "uuid": "ff29e779-8696-472c-9a3c-b2e793d49b8b", "value": "shipment Inv.API23105073013565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a767ab41-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (Netsky)", "timestamp": 1699964624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964624, "uuid": "4c7526f1-eb2a-4e68-a392-3baa0ad1b625", "comment": "Malware payload (Netsky)", "value": "96fa9591595aab4ba1f7c7ad7445e344", "object_relation": "md5", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964624, "uuid": "f575c046-1c20-4eb2-a3b9-fa1f10108f97", "comment": "Malware payload (Netsky)", "value": "8bcd589ae4587480a36aaa7d1c610308f7915195dab6cfe95c106bf854c8e1f6", "object_relation": "sha256", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964624, "uuid": "4a3f0cae-39fb-4209-9697-1afc9e14888f", "comment": "Malware payload (Netsky)", "value": "7ab0d2e5f1f887d45e0f2ad6c06bf3639d969fb6", "object_relation": "sha1", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964624, "uuid": "f8b20e27-8709-4b0b-a72f-a69186e2d843", "comment": "Malware payload (Netsky)", "value": "d9a4049d33c623740b7ce76cb3d23e8c2ca562ec669baa537b1330457f879f910ef9e4a517d43586cc4e3c0126690a8f", "object_relation": "sha3-384", "Tag": [ { "name": "Netsky", "colour": "#51511F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964624, "uuid": "964f8ce6-2f94-4906-ae03-c024c8112042", "value": "T145D2D016EA075828CE590F3A406F6E25E43675064F2B019ABC2E22E57F616F4DD39CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964624, "uuid": "7d3385c8-a583-40e3-8464-d0acb00ee0ae", "value": "768:aWkliAnUQYkYKzqbjC5RqHjrYReyZx+l0oKriCPRDL8:LySsz6jGeyZx+l0TRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964624, "uuid": "de7196f4-5b25-4b90-83a8-002c7efaaa77", "value": 29834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964624, "uuid": "c5bb9e57-0cf5-4704-86d6-3736dc1a3a35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964624, "uuid": "ac687d7b-1cb0-43b0-b944-18c1b55284c3", "value": "details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b635eb-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699964615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964615, "uuid": "3cc80a17-5a54-477b-98b9-500458b10d67", "comment": "Malware payload", "value": "85e9bf108182ba924b7db2968e713a6d", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964615, "uuid": "2a541790-93f2-4232-8681-5800d3d69ba2", "comment": "Malware payload", "value": "8c6edf75c3e2d3736bc03813881ade2bf42b6e13ee31a7b62654454f7eec8bbc", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964615, "uuid": "aacfb829-e297-4151-86c0-973b93218a1f", "comment": "Malware payload", "value": "a0e3e9990685b3a08241834998fe9c267024cf67", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964615, "uuid": "6fa073c1-532f-4bcc-820d-db582b23690c", "comment": "Malware payload", "value": "f6a4a24d5a075516211304464ee5807cfd9e4e3853d11e617cfb583c70cb5c01f8e2a42d0883ca2707e98169394c5fb6", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964615, "uuid": "908d268e-0fcb-4bf6-af25-94b693d93c3c", "value": "T108E5337F4C54B7EAF895BE6514A0F3208EBD3729C2539D3131CBBBE63B614520A89463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964615, "uuid": "6f7f3a25-28fe-4d98-a092-68377aefa0fe", "value": "98304:eaIjZGk0s192Heq9BmmG0efG63hw1nwqX:eaIjZGnHeq9Bmm/efG6321nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964615, "uuid": "6c8c9281-b055-42d0-8b4d-60786d0972da", "value": 3146185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964615, "uuid": "bb58e959-7639-42ff-999b-3c301f9238b2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964615, "uuid": "82b2eed1-de12-42d6-b8da-b0488639a0fd", "value": "BDP #8949 SOA.PDF.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a3e1bb-8305-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699977129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977129, "uuid": "e7232f49-abd1-457a-82cc-7322a2723fca", "comment": "Malware payload (AgentTesla)", "value": "1adcf4b691a61046726b6683d6f7bc22", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977129, "uuid": "d48f2cf2-04b2-4c3c-8cd2-5e268a823d90", "comment": "Malware payload (AgentTesla)", "value": "8dc7626964bb2236228f1cd54d064c5a03deeecb0fd4cd64ee010e36bb046d23", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977129, "uuid": "3e413215-77d0-423a-9123-7c5fb0bc2e0d", "comment": "Malware payload (AgentTesla)", "value": "60cabd84aa5e7b8a4d0d79e7b7a210fe631fded8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977129, "uuid": "6a34983f-1c3c-42b0-8cf6-13b11fce30a0", "comment": "Malware payload (AgentTesla)", "value": "a8fec0d1ef9028fbe5ff7b2cc5f8ad1f84d1182f7af180a34abb2c03efa54b824cb5e69dcce1bf3fea224e39eab7e32a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977129, "uuid": "85b185e7-5b6e-41f2-9034-069e937147a6", "value": "T1ACE42330496B5F78197BD4380190C7F86D3C4A24F6EA4875B1C347A41636AE8BF9DE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977129, "uuid": "bb944a6c-0320-4b6d-b53e-e675cd6e40b1", "value": "12288:L5M4Mt27GWBQ5PdVWrCJOPy5d+VxBrsyH4JZNY1FzrSAVO:SVDQrJPy5OH1H4hYnLVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699977129, "uuid": "846ed18b-315a-41ae-a92a-41dd881e1a55", "value": 684518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699977129, "uuid": "6846175f-d8b0-4cfb-a77d-a266e663040a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977129, "uuid": "e503c158-1fba-4b19-b16c-28f1364f1da0", "value": "Booking amendment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac38916-82f0-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1699968120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968120, "uuid": "da0f394c-1c20-4c8d-a87a-6bf90536dd90", "comment": "Malware payload (RaccoonStealer)", "value": "828fc9beda28a7e1256edef0b7aebc6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968120, "uuid": "617bad9d-2920-4256-92d3-315e1de16e05", "comment": "Malware payload (RaccoonStealer)", "value": "8e6021918d108cbb2e19ab300a03e25b1e1e0c6e621754f5940e6db2ac195d0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968120, "uuid": "e5e7743f-82c8-4660-b741-10186edb5b8d", "comment": "Malware payload (RaccoonStealer)", "value": "62e95c1fa8fcf0619472243fae8c3750378d11d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968120, "uuid": "c265c684-4d8a-4f37-93f2-a5b5d988f56f", "comment": "Malware payload (RaccoonStealer)", "value": "7e57f293a39ad226d02ce281130beb714eb629536de5c3e73fcbc55abaf6bca593afd3992a3529e1e1ddd1aeb82f262d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968120, "uuid": "dee0cae3-7e90-4eb8-a57b-ab33e9302587", "value": "T136547D10F48183B3EBE2143205DAD5B9093E756E0B45C9FBD7A71A5C0FA72D39A72A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968120, "uuid": "3f327186-799b-477e-97f1-05ea015a9cbd", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968120, "uuid": "a674ec12-4d5a-40dd-bc5c-9bfb88defcb2", "value": "6144:BUnttntG3PuxBHhbOsAOwc+nUTOmaEykp3VHXUh9dN:OttntGfkOs5eKOO3Vq9dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699968120, "uuid": "38e4915f-217a-4420-93ca-8933ac049588", "value": 302200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699968120, "uuid": "5d272aa8-b0fa-4d6b-91c0-b43c399ffe31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968120, "uuid": "e9a4345b-f463-4fd0-903f-a42a45a50813", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4653f7-82cd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699953008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953008, "uuid": "818279ae-4808-49f0-ac58-f580b4a43890", "comment": "Malware payload (RedLineStealer)", "value": "03a197cb40408aac6618e7053cfeab39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953008, "uuid": "063a97d6-461d-4207-9316-fba5f5b2f01b", "comment": "Malware payload (RedLineStealer)", "value": "8e658be1287f69327c68a575863888918e1ca90e2bd09247170a81af6b3cd34b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953008, "uuid": "5df27c51-a453-4773-8819-ec47cf529cee", "comment": "Malware payload (RedLineStealer)", "value": "b8a29bad9f6b58446e9b893915eb1257c491d25b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953008, "uuid": "03c3f05f-834c-4a1f-bb30-462c8b027874", "comment": "Malware payload (RedLineStealer)", "value": "5a1160994be24e3d085d2879bb150bc5e5dd9508d4b8eee938352bcdfc5ffd2a5093fa3445dde411eaef5d9123382ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953008, "uuid": "692a94ff-3d47-4fb7-b456-5dcb097273ee", "value": "T1DD152317ABEC6037D8B9177405FA02D70F397C329874D36B27A2582918B2A84E53777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953008, "uuid": "f9408373-d0cc-4e4e-833a-be4b50896f10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953008, "uuid": "0d710e53-d4be-49a3-97aa-4394af9224a6", "value": "12288:bMr4y90FsqzLwuxgjDc9/0SsepUKwUhOa2oCh08Ul1rsiLBziv0KTHJYJKfdpuij:LyCzsuKj49wKrhT2bpPuKDOJKHuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953008, "uuid": "21cc01ae-0e3b-4c9e-9620-38d6180e232d", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953008, "uuid": "a1e38e8b-31fa-4c52-a125-bfa6194ebfb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953008, "uuid": "49b363a5-f845-48e7-b8f9-0b209096a6d1", "value": "03a197cb40408aac6618e7053cfeab39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af921a40-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982677, "uuid": "b3695fe2-bb46-48e6-ac83-e861b753801b", "comment": "Malware payload", "value": "a60aa52dfdd62021db63de31c76b4743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982677, "uuid": "d9c7f04e-d8bd-4841-9dba-57ae79abcc54", "comment": "Malware payload", "value": "9084ecef307c10374f2b4f6d54f7ab929a33ae254b349abf3f7399a8e6cb381f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982677, "uuid": "57a611b5-bf30-49e4-a149-3deb0dc91333", "comment": "Malware payload", "value": "350d14a5eab836e9cc13f0b05232e8a5a2030123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982677, "uuid": "0eabb27f-f18b-4c31-a5f9-d2d2764f496c", "comment": "Malware payload", "value": "9cb268f7819033a5af4b2c47599209fdf18c470af6fdf770099cb5e26e4bdcc76bdb10d52c075c186e4069744ec07660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982677, "uuid": "d8189443-e62f-41c0-a3f6-cf296036b666", "value": "T12345AF42F6D3A0D0CB066C31065BA3369DBAB68F0B31D7DB5368DB1C5E32591AD3B252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982677, "uuid": "459ad318-37c9-4dc0-af21-2e13b459eed0", "value": "12288:CJkRUs+6uSxxVh2ikSbP6CLrAinD9PBWSyZXd+rotztbNpe+6FvD73QivP:CHsfuSxotVbNpeVL7LvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982677, "uuid": "b97f5ebb-8d8e-49ca-84a0-e4d01cd1c622", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982677, "uuid": "efc66405-f3dc-451f-a179-10c2655234f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982677, "uuid": "19aa17c9-79b0-4271-9052-ed5c94c788e3", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.7243.1875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6deead46-830b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699979560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979560, "uuid": "89dfae48-3e63-4a26-bc31-8c9df1c1c17b", "comment": "Malware payload", "value": "f5bf66da8451e76e8386691277791f0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979560, "uuid": "5855cf4c-46b7-433e-b277-98f101e622f5", "comment": "Malware payload", "value": "90c9d40878861fb8a41fe65b46aab0a2a7153866619beb2efa2be92d71ffd240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979560, "uuid": "24d8881d-90ce-4d0f-a743-308a5651f52b", "comment": "Malware payload", "value": "07072d142789347d66ff76de184e928900379d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979560, "uuid": "b9858457-13ae-4b54-b3c8-d7d9d1cdaeea", "comment": "Malware payload", "value": "4786dcc4487f06871f5cea9b6ea175e33e11eaa097861d2d62105dc4922cee6a6a73d96652ccc7b13a796b230ab9f54b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979560, "uuid": "598657eb-db34-4eca-aa50-29d57cb79f8f", "value": "T18C944968F3636171D099F936F4F4B3B836F1A715C7F2898BA311C6188A163C09774BA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979560, "uuid": "a10325d2-070b-4dde-9d18-7be5468044d1", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979560, "uuid": "1bd78606-5c20-46be-9f5c-cf7f1ebfe0e0", "value": "6144:O15gUwlREXKMmn/P3dAO9XW0UZEGt8y/STHiyLR8nt9:+gUKRE6Tdu76TPd8nt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699979560, "uuid": "d1a0e979-b5bb-4713-8c0e-b45ab63bbdce", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699979560, "uuid": "a1a091b2-4dbb-4953-a635-16eb3336dc73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979560, "uuid": "37d025dd-01f4-46bc-a3d8-af2a5f7da10c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.24496.7452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2866578-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699964643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964643, "uuid": "8e12e966-c04b-49f5-89b6-f1f9281ebd5f", "comment": "Malware payload (AgentTesla)", "value": "be37f7dc8a991f1f7add2aab86fc6e2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964643, "uuid": "90c2c88f-b2cb-42a5-97f9-26f82dd23605", "comment": "Malware payload (AgentTesla)", "value": "91b0829c56341b5ebe30e0b59b263f8d174bcf4b1718bbfe5cb18b7faa2d606f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964643, "uuid": "d6c02ba4-a813-42d8-bfa4-e202a7140fa7", "comment": "Malware payload (AgentTesla)", "value": "61fe992022a09c106fa1c573c65b369227b45980", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964643, "uuid": "7a7da440-d51d-45d2-beb1-08fdef5ded95", "comment": "Malware payload (AgentTesla)", "value": "94f5c9df5e099dd7caae3827f65bf8a635181fb6dfc3f0311c74a7f9614b3469e4756777b83ffc9401dcb3b64b580ed7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964643, "uuid": "dd5661e9-b288-42d9-b2df-08694a82eb32", "value": "T107C401123378953BE66D02F4A46652C14BB2ED276460E34D1C97BBDD2BF37818B036A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964643, "uuid": "9a554720-543a-458c-8ca6-3f5d9c568809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964643, "uuid": "02884782-9fe3-44db-958a-e2295319d6f0", "value": "12288:W7zLlfs7sT0TjJEHizxjgCT4QPB88w08DxP8Ks+4/:Uh4TjaCp0QOgEPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964643, "uuid": "af7db22f-85d8-450f-a41d-6eeeb88f4888", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964643, "uuid": "cdbe07ba-b8b8-4825-9a45-f3f482f881f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964643, "uuid": "3e31be72-8cf3-456d-b0aa-0f721f679155", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa44c29e-82ef-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699967770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967770, "uuid": "cd6e5345-8364-455e-9baa-9baeba67386c", "comment": "Malware payload", "value": "8a0c75a3cbd07e65d99184bb6451862a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967770, "uuid": "db8b6753-1592-4d48-8400-8747b14ea822", "comment": "Malware payload", "value": "929e07936c124aca9a998c29cc6c75e91ec2f0f6a45acdc4b5d55ebcd453292c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967770, "uuid": "42bc09ea-5b6b-4fb7-8952-247a238af929", "comment": "Malware payload", "value": "80aa9d04621a0f9ae9d93307c98481b4db0c7baa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967770, "uuid": "49601c4b-435d-4530-9e90-ed4570df6e31", "comment": "Malware payload", "value": "6fb3ae12f3a9e8cff942a15fd6fd5435b7ede7dc0fe195677437915946c764a886296311977220d886daf4f51f961809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967770, "uuid": "fdfe3874-b6ed-40f0-8f84-d3c654dfcb78", "value": "T1BFD5330696443CA7F274D8F436B0E67972A61DD4E8CBCFA073212367DB12E6E4641E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967770, "uuid": "d637b9b5-adbd-4748-83a5-7a8ef89428fb", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967770, "uuid": "998afc45-7a26-4af8-a4b4-f6f3e0c97907", "value": "49152:/Z3nfTUZeSCHao+WDmDoKS20jfPK14fCI8C7NhBbw2z3w6VUYsOcoSA44+vpBc:h3mS2WDTbrDS14fCgTA+ca44Q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699967770, "uuid": "f4942cbb-255d-4a39-9ebd-ce6735ff1d88", "value": 2961312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699967770, "uuid": "f3519d6d-191b-4138-a100-2c38710c28d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967770, "uuid": "ff820f79-9676-4427-90b4-4364fd5eb124", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709e2b1e-82f3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699969257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969257, "uuid": "90379bd7-cc71-425b-892e-eb301b7f6070", "comment": "Malware payload", "value": "433434e57e4879e389e9a26466078023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969257, "uuid": "b8d973a1-1077-407e-b175-01b2296e2e1b", "comment": "Malware payload", "value": "93851cdb575d5ef907a563962037853c8a59f77a8912db9ec637ef33a9d608b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969257, "uuid": "21b09726-260e-48f6-b257-810561c6027f", "comment": "Malware payload", "value": "9aa442e3d38e6f31977f5cd71d8499882bf5afc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699969257, "uuid": "d2067a59-f7a9-4adf-b5c2-355ea4e53c90", "comment": "Malware payload", "value": "7e6d570a427f8b5a61828d5a9a91a03b0cc8ddbdd4dc7f491f3eb6eb1ccece6fbcbe243fec10045a7671c865216e64b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969257, "uuid": "46556dfb-6e2c-4e62-af95-825f9c75f006", "value": "T16A24B466E348551DE83A433DB41C38709F70BC52E16EE32F55BA7EED683BB498A104D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969257, "uuid": "16db22fa-baa5-4874-9131-15691072f702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969257, "uuid": "558f7f00-4c7f-4197-9f6a-f22167e79ede", "value": "6144:ie7AoJ7BNgcRnr3e7G70J71S45rrkrNi:fA0NgcRnrvG5rrkrNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699969257, "uuid": "aa5a016e-ed55-405b-b3fd-1dc1310eb054", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699969257, "uuid": "dd8929a7-a36d-412c-b02e-0baf480563bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699969257, "uuid": "3cc67a76-2314-4ab7-89e5-5309fac3a27e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970e689c-82cb-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699952141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952141, "uuid": "7667d0d9-b767-4a22-b7ae-353f8884daba", "comment": "Malware payload (Smoke Loader)", "value": "4133ef730b6780d9efd87fd4882a4360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952141, "uuid": "7f07e31b-23c2-4d4c-b824-dc670ee6c8a8", "comment": "Malware payload (Smoke Loader)", "value": "95396f2372d133a24cb6a06307c865f37441cb985baa6ce021387ac7b0a2de91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952141, "uuid": "0f710756-fbc4-4e3f-8a02-b22579a70e02", "comment": "Malware payload (Smoke Loader)", "value": "d0e7bfb42ed8520742ab700852ffcb844c78bdaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952141, "uuid": "eb71b21c-124a-45da-99dc-64a771e8c4d1", "comment": "Malware payload (Smoke Loader)", "value": "df3d48ca9eff9b7a4001566bb257d24436ea18863f967ca96197a1bcbab42ef187fcb0e97ff8474afab0d4fdd9d43c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952141, "uuid": "59c88222-2e1f-4db5-a9a3-5d5fd92d827b", "value": "T15A24BF1262D1BA75F22306314E66E5B56AABFC314F23FACB37946A2F0E711E1C671311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952141, "uuid": "a4fa8524-8087-4f23-89f0-800b402c3b0a", "value": "98d64d0df65e1303edb7a8837bf98562", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952141, "uuid": "db7e426d-336e-4303-aa4d-d80680a5129f", "value": "3072:RWb61/s2Y6Mp2US0udgn1BNHXk90rzz1BRT3iocL9LqakE:s6ad6JUfudABNHU90rz5T3iocEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699952141, "uuid": "6f6cfdc3-08d1-4711-890e-47bee15f2f8c", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699952141, "uuid": "349d0227-6f73-4513-b3ea-3fff766b8abd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952141, "uuid": "1ea3ffd8-db98-43b6-9219-3d8123dabd2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef54583-8321-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989145, "uuid": "17c81990-976d-4d11-87bb-cacfa14f6c67", "comment": "Malware payload", "value": "b3e385194a542c7b28a7be926303307c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989145, "uuid": "d926159f-b2c3-4640-a6bb-f606ad6f96f2", "comment": "Malware payload", "value": "96041a9b535707f03ead8059db28c2fd76247794c2020eba53e09e52c2e45bb6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989145, "uuid": "e14e90f9-d3a1-4e4c-accb-824c186b6c37", "comment": "Malware payload", "value": "e616b57db10d79c988ff9c9a0fbc2f42e5007254", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989145, "uuid": "e47c1ff4-976e-401b-92f0-60997783a6cc", "comment": "Malware payload", "value": "103b6e1982ee1122286cce291b3a70ece0952489f5609f3c973f5795b5a8485bc204d2b5541af84ba758bb30f3001e73", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989145, "uuid": "878462ad-e28b-4d70-9763-57b9603df08b", "value": "T125F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989145, "uuid": "d42a3beb-e2ab-4a3e-8f96-e9b55fbf8cba", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBGYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/cYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989145, "uuid": "6ba1eaee-1dcf-4083-869b-d7be0cca80b1", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989145, "uuid": "9be54e99-2335-435e-a652-84c73408730c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989145, "uuid": "5179aee3-3cd0-4341-a750-e767f46aa0c7", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d3ad9b-8329-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699992546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992546, "uuid": "2a9fa5f8-262b-453b-9841-26959be847b3", "comment": "Malware payload", "value": "e541e8120ea3881a5176f10b4a57db76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992546, "uuid": "47f9ab28-90e3-47ec-ba72-d4316db1031d", "comment": "Malware payload", "value": "960bbddd7409a58ff3e094c626a06cf7b744cdfc0e4ed353b5f82daa86716ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992546, "uuid": "11f4f0bf-90f0-4d21-9581-db08be483ef4", "comment": "Malware payload", "value": "2340ab4178188b651facd914436e273856e0a865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992546, "uuid": "47db99d6-b9da-4295-85dd-97f89fb1081d", "comment": "Malware payload", "value": "85dc9d46bcdb58ecce66dabf0c4617895f3f4c110ac7574f493d8cfd64bce9b9a82717c155eb657f1b77e81dd8028abe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992546, "uuid": "cda2988b-f4b8-4654-8fae-b430f5d19f7b", "value": "T17973BE87D9C0A066C1A1217E6BB53AB55978F1FA3201C1DA7A8CC9F4DBC2CB066353C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992546, "uuid": "c7dc99be-8fd6-4da6-a7f4-a19864b123e8", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992546, "uuid": "a9c7c559-8ee7-4acd-8e4c-58c74229c4f3", "value": "1536:IUGpZPJXdmSopKbPzlRyo8ynDXU5NztIl3Mb+KR0Nc8QsJq39:7GfBXxopKbpRbJnMN6l3e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699992546, "uuid": "1de12535-57a3-41cc-ad17-08ca1464ac70", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699992546, "uuid": "0891fafe-ca4f-4811-89bb-acb95501d12d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992546, "uuid": "cb303ea9-c895-4dc9-9e64-daca8588f45a", "value": "mw1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40727aed-831b-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699986356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986356, "uuid": "e6baf27f-f4f2-4e86-93fb-1ea9fcfc13f5", "comment": "Malware payload (MarsStealer)", "value": "2976287704476e6df68715c0d20754c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986356, "uuid": "98ddeb70-e82e-4f84-9c6f-95c5d6cca544", "comment": "Malware payload (MarsStealer)", "value": "961fa39e74e92717c34a65cefca250df55cfc76faf1780c45e6b7dfc0fc80eca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986356, "uuid": "17bd16b0-f887-4516-8c67-78bb8a28881f", "comment": "Malware payload (MarsStealer)", "value": "38a334d0f0cf0c733276518cba8dc91bbaa366e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986356, "uuid": "b93c8980-c8e9-4414-b3bd-72a5be980346", "comment": "Malware payload (MarsStealer)", "value": "666098d6393701002c7312e6daf81c2a681c295a9a9233f63b76b8c7aac0d2c1963521de19206a606b2014c032cfd9e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986356, "uuid": "ac2b6a30-903d-44c7-9057-324757ffedd8", "value": "T14624D02277D1C072F16745344A62C6B25A37BCB29B3185CF2BD46ABE2E312D2CB75706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986356, "uuid": "201a5ac9-0d5f-42fe-9821-f76324aa3e37", "value": "ac9b735a86914608dcd7bdd7ddcf7451", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986356, "uuid": "6cd9958a-5841-4de5-834f-3ab50282cfbb", "value": "3072:u6O0UHQP9HH02RNCd3EoyzuKDRFQenyjCGcPQsvhPVlzsHc:JUwP9n02znoYuKPuC5Ptvhz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699986356, "uuid": "49149175-0bfb-41b0-b5d9-8228019f0932", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699986356, "uuid": "5857e6b7-392e-48c6-8d3b-40f3c5c07843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986356, "uuid": "8e5fc54a-03a2-4b14-961e-731276abde28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d383f9-8294-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699928405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699928405, "uuid": "c9c65ad6-e41e-4a0f-834b-59ab8cfa0f79", "comment": "Malware payload (AgentTesla)", "value": "1996d73de90d69baf4351be9ea15f35f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699928405, "uuid": "27708caa-8ea9-4c34-b65c-edaa94247887", "comment": "Malware payload (AgentTesla)", "value": "965ba13c271f1b9e9317c713d9b75e2fbe2d439610204e37f6142e166e58ac23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699928405, "uuid": "326cbf05-c358-4ed7-a2c4-44d1c78a9cea", "comment": "Malware payload (AgentTesla)", "value": "452a649f511ee55acf28e0c4563cdf013ffb2650", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699928405, "uuid": "3ac5fcd9-0a9c-4d0c-b810-eeae2ffd2726", "comment": "Malware payload (AgentTesla)", "value": "2d7c2c6bd9d04b8068607a91e436f4872f287d3cb52bbf0466b676a63236e33612a340ba239fd6c9ed43830c4d5d30ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699928405, "uuid": "8c6ebc53-1342-48d1-b9ce-efeb793f1c5a", "value": "T182D4234C30792BA2E4F547F41634059903B1E2BEE620EB5C9DD871CB1E77B8509A3B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699928405, "uuid": "d56417ff-36a3-4194-91fd-a3def99a3a02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699928405, "uuid": "65a98f69-d530-46ba-98d5-38a3d6a72f12", "value": "12288:nVMcthmJV4teGc8tRC/F76ZlPEhMNSGjSCnaMS5q5mii2+av2R9Sr9qoCMAFnSD:jU98tc7+VJ3SCnln+av2XO9qAqSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699928405, "uuid": "48c823ff-56a6-4b6f-abc3-4aee6bf944d0", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699928405, "uuid": "8be6f2d4-3b70-4d6b-b90a-61b43bee5922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699928405, "uuid": "b9e56715-e099-4233-a6b2-680a8e590308", "value": "SecuriteInfo.com.Win32.PWSX-gen.10842.5398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a73980-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982680, "uuid": "cb69336d-ddb3-473c-bbc1-85c97787cc62", "comment": "Malware payload", "value": "d89e5318f31e89ef248b5512bafa36dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982680, "uuid": "c15f0549-9d91-4be6-a37f-42d683bac268", "comment": "Malware payload", "value": "9672eb651f72a3dc2a2b676d56d5e3424392123e3ae883719097af836129eb34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982680, "uuid": "70495a49-18e5-46b7-8601-6d638fe5b5db", "comment": "Malware payload", "value": "550fdee5fa1e20446d15900cefa46daea57226e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982680, "uuid": "cfef6aa4-e814-4486-88e4-35b5837f5fad", "comment": "Malware payload", "value": "f8fc47e19830758e307f302985dc1e3966f409d09edc8813a581ede4bf2b47732a4e405163a3fae76b1fd0994764c340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982680, "uuid": "ee9c9863-5736-477a-ad2a-e6f8d0878e3c", "value": "T17484D81F3D70C472C24D26310CBAC7AE962298607F518A4FA2DC9A1EFD369516D670FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982680, "uuid": "d2e67ea1-2896-46d7-9321-79474cff2eab", "value": "edf46b6a9aceeebc55eb9cb33ed4d508", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982680, "uuid": "f83981ba-5b65-479a-9da3-20a2d325fe29", "value": "3072:wAMbXIVuWJGt0UzoDtFsFda1W9bijvN4VL4J:wbbY4HpFwo9bOmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982680, "uuid": "2d476f82-fdd1-4898-bc93-8a0c391ac4b8", "value": 378695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982680, "uuid": "2fe4069f-d08b-41a2-acdc-2cd2572f1d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982680, "uuid": "51e11b12-582a-42bc-95c3-3793de2ee5be", "value": "SecuriteInfo.com.Variant.Mikey.158453.23397.420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44ae840-82d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699957452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957452, "uuid": "1e7b5c06-b25f-4d28-8c2d-4bec09a5aa36", "comment": "Malware payload", "value": "7bd998d966fcb78be8981af6d61ac45e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957452, "uuid": "0f33d3a1-77f7-4d57-b672-f90eb906efc9", "comment": "Malware payload", "value": "970dd198cf22fd0add061581be379fac2403bc071ebd495d32050e0c7ce5d75e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957452, "uuid": "93a7fc51-22d1-4119-bbce-61dc06dcc0d2", "comment": "Malware payload", "value": "c216fbf2645cb8e85d7e228f66092bc9ca19c1c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957452, "uuid": "d0ba6c92-04d1-4221-a6e9-3a017c7c1878", "comment": "Malware payload", "value": "e167746803b398d51241a23d0d153db88231bd34a7fcac6ae884621937d40720b4b081f1177165570b6a5f6f251067dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957452, "uuid": "b88ef056-2cdd-4b11-9bd5-aa000bdd4caf", "value": "T12DD4DF017F63C1D5DB83DFB47610E02DD5F961362C12B8AA28773AA228FB91538D8E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957452, "uuid": "0a7e3285-6c15-4708-a442-ec2df5df880b", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957452, "uuid": "d4b2675d-2265-4311-9d66-bdccd3815fbc", "value": "12288:XuotysbCn8FsbBn8+9ivCSB2NXZVZ3IEdh4+3xnY56r:+o2u+Ndz9xnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699957452, "uuid": "6d21ebc4-5f8e-47fb-9eda-d8ae3a29549d", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699957452, "uuid": "110340f3-27a6-4cf3-96a0-069e792de8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957452, "uuid": "8a5c5873-cd3e-4c41-8332-8f157277da38", "value": "SecuriteInfo.com.Win32.PWSX-gen.562.11727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cf6c34-82fe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699973961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973961, "uuid": "36f2b070-5e10-483b-80a7-981e63cacd12", "comment": "Malware payload", "value": "2adb6576bf08d51ccd636d0c17c0faba", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973961, "uuid": "5223823a-5369-4e49-ac79-63efbdb10d3b", "comment": "Malware payload", "value": "976c4fdf5120d4a6e6b5d1cd26d70244fb788ea1cb50031a129ea8da9509f86a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973961, "uuid": "07d179e1-0358-40f5-aad9-21c2aa1833f2", "comment": "Malware payload", "value": "a41e007c0b20a000bce1dfa1568b804c0a5121ab", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973961, "uuid": "b7fbedb3-d3cd-4c66-a5bb-58c86b93a046", "comment": "Malware payload", "value": "79bdad2ca1d293e88f54a2417403b6379005fe216930e9509c28fa5c5cb26f1d8896886b421cb35ca8fa4a7d28990783", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973961, "uuid": "8f780633-fed2-4a3f-9999-a13f64e20203", "value": "T1DB82CF1EE016A429C927877E346A87E8FA4D4077E043A74BF9D9F38DC71459363898CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973961, "uuid": "50291f8a-5499-40c8-81dc-306b6561e600", "value": "384:huQPjB2E9RoKXMVm/vELGAKX9pGjaxB9ZS:tPF2aMVwz9pl1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699973961, "uuid": "3b4af457-a2cc-4302-8d6a-c07fde7f8529", "value": 18636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699973961, "uuid": "fe665ec0-996f-414d-8bea-7c2340f385c3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973961, "uuid": "a4da0e61-6750-4445-a70f-085b78c16bbe", "value": "2adb6576bf08d51ccd636d0c17c0faba.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764607c6-82ce-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699953375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953375, "uuid": "2c4677d7-8083-4dfa-bae1-673a02bb4109", "comment": "Malware payload (AgentTesla)", "value": "93adaebacfd4300695efb1e39682d094", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953375, "uuid": "85630dc6-669a-400f-8b91-006e60b91898", "comment": "Malware payload (AgentTesla)", "value": "99d376b4afcda6983c0030431b264aaedcfc09d7b805fe0d3c372175695da8a8", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953375, "uuid": "c74a0f3f-445a-41cb-a20e-c4acf8fb731e", "comment": "Malware payload (AgentTesla)", "value": "e363ac01a4a01e58082ec26a743f7259eb43af4e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953375, "uuid": "759a7eab-1663-460b-b64b-779003fecaeb", "comment": "Malware payload (AgentTesla)", "value": "54fc7a233092931e4042fc94c85671828cd9e7acbcbafb3574320932f4a481dc71df471bf839afb584ad5ca46f9083ad", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953375, "uuid": "c0b007b4-d607-4aa3-b49a-1410a8267152", "value": "T1DDD423C37D3DFCB334064A4FF01E581A206435ACAD5F7A74B0AF548766C2860976A7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953375, "uuid": "123cac5e-6d3b-4733-8edf-9ce51ea462b8", "value": "12288:ZiHrK58ISxJs6zsoGyNgToVq88H5E72e7lZTn+P1p+pWPNEz:um5Aqym0VcHi7Tvz+tp+4PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953375, "uuid": "264a096f-13f8-4003-95e0-c0eb9f3b47ab", "value": 643282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953375, "uuid": "75ef2e95-a0e7-4ffd-855e-8639c3e17fe7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953375, "uuid": "0665789c-d45f-4d28-a836-603843d7ff73", "value": "COSCO DN 5874 COSCO DN 5977 COSCO DN 6268.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5f0d56-82d8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699957892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957892, "uuid": "7736cbec-c8ba-463c-913c-dc3bc4a96f1a", "comment": "Malware payload", "value": "cc67009c57882aeb23422f2fb34f96e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957892, "uuid": "81dad6d4-60ff-4b22-b01d-c883d440892a", "comment": "Malware payload", "value": "9b1a04a9a7488c5c618d00ee10920203d5bb51cc2c3470aae460f7a971a44843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957892, "uuid": "c57cdec8-ee6d-402d-aca8-b8c8ec5082de", "comment": "Malware payload", "value": "b6f48c50a8938913b5391b1810fb9aedb02772a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957892, "uuid": "ec8fdaf3-65ea-42e9-9841-7cda87ffe35f", "comment": "Malware payload", "value": "04acc8c45deff1a8c3076d90011d45263ca1def30de7b8fb949b5a479ecc9f7143994d6322e6ece6f75418025265fbe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957892, "uuid": "96a267f9-d9bf-44fc-8a50-f1c19c73f2a4", "value": "T11C540158E5AA94D2CC8962BCC1A79F270F72E853D563E4CA615933339847787803FA0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957892, "uuid": "0083b58f-7198-4c56-a4bf-d2f82b8c277d", "value": "6144:41ynkjU2hckoyWh6mOiakmfJEGZo56L6XUVD:4d74yNmAPJujUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699957892, "uuid": "b8c4d88a-7cd1-4dd4-9440-2bc624a20150", "value": 285584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699957892, "uuid": "68647757-24d2-4702-9a94-9a5289f1482f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957892, "uuid": "6b4bb5c4-ead6-4c88-b13b-5d67f58d868a", "value": "Shipping Details_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c731b835-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982716, "uuid": "3381945f-4a51-4f46-9388-6e4659225208", "comment": "Malware payload", "value": "8f74f833c20b026e55d3f84badf721eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982716, "uuid": "190ac48c-bab7-4df7-97f4-07adc9c58f87", "comment": "Malware payload", "value": "9b1d3802c41f21dcfc6ae41d795a56f200bd4298424b5fd9f4f66a4e5de88d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982716, "uuid": "05bcb5d9-5bf7-4b1c-b4be-095d2aaeb0fd", "comment": "Malware payload", "value": "5da6cdc02b945f8edadac1d859c21dca6385e695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982716, "uuid": "18653937-3afd-4dcb-adfc-809e84da2a45", "comment": "Malware payload", "value": "9f6adf784790bf024794f50be1e2297ba5c6ed72a681a45c7e4b7e25c9059dc5016a167e08247f66ee4b38ad3fa01260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982716, "uuid": "06f9430a-7f8b-4cb6-beb3-726a414beeb5", "value": "T1E6D5F126F6919833C1721B388D1B8799AC36BE116E78ED467BF21E0C5EB86417C353D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982716, "uuid": "839dc574-9804-47ba-b548-eb58fa32a398", "value": "49152:0zisRsXaZxXgWHzUFJba3dz9BLsUf8Bst9OK2bulG6h:0zisEkybcBzLsHCt9OKaulG6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982716, "uuid": "020244ef-76ef-4631-bedb-c40929c4e573", "value": 2871808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982716, "uuid": "8e575e05-8a16-46b4-b440-8bab42f63ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982716, "uuid": "bb0841a3-db1e-4a69-adeb-608078f2647d", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.17851.16698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc20494-82f1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699968443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968443, "uuid": "ca78bc93-0b16-477b-b3ca-05ba18e2b5de", "comment": "Malware payload", "value": "b4926c1f9ec05712ead0e969eaf01357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968443, "uuid": "1e826f5d-6d96-4662-881a-3ad478699e1b", "comment": "Malware payload", "value": "9b6a1d1a00ddd716e344cc64e5592291bb2eb2f5d36a95a32a7b2bddd02a1402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968443, "uuid": "80295c00-ea4d-4d62-b72d-dc0ea35957d4", "comment": "Malware payload", "value": "dc1987188b7ba0ab40272cffb0ed34023b36b710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968443, "uuid": "b1aaeda3-a214-4022-b90f-671ae06a9a15", "comment": "Malware payload", "value": "6d9528664031df19347eff1312a5cadbca6dbdc25c370b9c332509b800415650150b4f1676aa5789ccf26eacd958783c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968443, "uuid": "d28d410c-ca80-4027-b46a-4e2a231d8933", "value": "T1613633336E77D041F3AB53B67851D07842A06888AB4E47CFE4D9AF5E78C925D670A08F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968443, "uuid": "2621354a-bcb3-4443-b6d8-9ed155718fe2", "value": "2c948f84df90d09d5ec0ed0cc0486ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968443, "uuid": "9b830992-3be2-4431-afb3-dc9731dfbc09", "value": "98304:9E2M430Xb5Ur+IfLIZzM+7NOVZkF0kWFa3WnkWGxgZm+jzWBk0:K22XbFIcZjgC9jvLIzWi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699968443, "uuid": "8b77f402-b90a-46ae-b1c6-0a63f7fe4982", "value": 5260288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699968443, "uuid": "2ecfcf83-9c38-4e1b-b2ed-ff47c2079f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968443, "uuid": "9bcd9989-9bc7-4e97-9a24-a8a388509bc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd81eebf-82b1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699941146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699941146, "uuid": "10dbb762-54ab-4a38-914d-23480de3eaba", "comment": "Malware payload (AgentTesla)", "value": "d700ae1961858276347b6d5d232ac82c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699941146, "uuid": "65fed271-cbcc-42a1-b023-966aa6d84f63", "comment": "Malware payload (AgentTesla)", "value": "9da59b694d6ea1b5378325432ecaacb4eacb9ed45eab7982f33141c7313617bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699941146, "uuid": "9f28aebb-2e2f-4e12-875c-0137d1723bce", "comment": "Malware payload (AgentTesla)", "value": "f8eb8b78c2b8976adff5fcf6d369cb056edb3903", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699941146, "uuid": "7fc67f0e-5439-4263-9223-b80fb1a9567b", "comment": "Malware payload (AgentTesla)", "value": "987a245773edccb4a3191030104095e8c37bd6df179375e8aa9e27aa7161de8b101699e2516c6cb0c2015000f8574907", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699941146, "uuid": "aa6c4f18-27f0-45a5-9839-2fa1825205ca", "value": "T1DB03647A10A443027A866F96D9E5A30FFB1D4270A6052860E45FC33F168EF5C3966EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699941146, "uuid": "b77bc8f9-3988-4579-bc36-baccbb531471", "value": "768:YLhLVLLqFLWL+8pwVLheJZLRoZBbWSvVC0kULhLVLLqFLWL+p:YLhLVLLqFLWL+8pAAiZBCSvV6ULhLVL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699941146, "uuid": "62a293e7-3e46-44c0-92af-4abe71c08de1", "value": 38165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699941146, "uuid": "3ce1b0c4-d039-4831-a710-be2b127d169d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699941146, "uuid": "1afa3b51-14d1-4e86-8675-a0456495b906", "value": "PO.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e71cae9-82ee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699967133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967133, "uuid": "e816a970-e80b-4a1b-949e-caa1e5fe691b", "comment": "Malware payload", "value": "563f8aa6714157259c1d64fcdfa5f3ad", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967133, "uuid": "aa05e8f6-3685-4f9b-b563-4eeb53c7c9e7", "comment": "Malware payload", "value": "9eca615670499996757e8fa2febf2e820c065f4a0c3a4cdbd86e1d934d3d5ef8", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967133, "uuid": "69d2994c-b359-4dee-9be0-371cfb75ea0a", "comment": "Malware payload", "value": "1ad9c5f26c55553778e3e0effcc6aac520bea45e", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967133, "uuid": "59b9e291-00c1-4468-a045-1f658d28f801", "comment": "Malware payload", "value": "1eec6db4c4a1fafa5520a02fb592d0f398f1c95fab4a50e863be595b7ca29099b69753ea31db0b93a938e967125b52a3", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967133, "uuid": "80be13bc-b5b6-4767-bad5-a20a4e0344c0", "value": "T1BE0723CB5AEE929DC0835E0016C243DE35C5B1DD84EDCA2E35CE58027565E6B8ACD3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967133, "uuid": "c672f74f-6266-4d0f-add4-9ce352d9e534", "value": "00e8defd44dd11c0dedf1681f5507286", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967133, "uuid": "f8d6e14b-d203-475a-9f02-62c9d6ef83c3", "value": "393216:AaJBfZoa+fcoJtM2EgfBpq9+vhNPECaXf2jTuZU:3BfZoa+fcoJtMZgfzy+nPExST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699967133, "uuid": "d4f28afd-df04-4159-8df6-5152558539ec", "value": 18435384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699967133, "uuid": "f16bf257-4b5d-4254-835f-fdd4f68804b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967133, "uuid": "13b6908d-545d-4c61-89a9-e3261a5c4b58", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee32acaa-8300-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699975051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975051, "uuid": "20ca1613-fc59-413b-b5a2-774aa11ba8fe", "comment": "Malware payload (Formbook)", "value": "07ea9abe8aeda1c72f42967c7d9f475a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975051, "uuid": "7cfa607e-6387-4074-9261-65eaaf19729a", "comment": "Malware payload (Formbook)", "value": "a0a6a1c54775713ad3e884b6bc49f2c74f393464a69175c8713221504ae6d72a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975051, "uuid": "0f6cd158-c92a-436d-86de-589df81b1d24", "comment": "Malware payload (Formbook)", "value": "5f495b957acc693e5019ee2ccb5a1f458286f67f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975051, "uuid": "65eeb3eb-e195-425b-80d4-9d35c67d1aa3", "comment": "Malware payload (Formbook)", "value": "b5f336dcb3b2bad390408ac6a5f3f9a79c861f87dc3212b543c7d802f4c66889d26cfa44442d557b65b80b413005869a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975051, "uuid": "28c62c68-7205-4c1e-9631-decc57d0e9bb", "value": "T1EC74131BA4B0C8A2F78102FA4BFFAF95C6F0BB151951D98B2B944F5F3C516CA1E41289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975051, "uuid": "c30d9530-760d-4717-b476-85644162905d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975051, "uuid": "b88b4176-0405-48ea-b422-daa9a197113f", "value": "6144:wBlL/90OO8k3NWzK22YTzxAdhlpOxWe+mJ/0u4p6+zTV28BkvTXR:C/0Oe3NWh2dhoWG/0u4s+fyXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699975051, "uuid": "0522fd39-8b86-40e0-8622-24117ee9c94e", "value": 350833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699975051, "uuid": "6e4b836e-a20d-4cf6-954c-8812a5e3888a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975051, "uuid": "127f853d-bc85-4319-9537-12dee34da348", "value": "Shipment Document BL,INV and packing list.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b03f3a0-8329-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699992413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992413, "uuid": "8a22920f-2340-457d-a665-54751458ad9f", "comment": "Malware payload (AgentTesla)", "value": "c13cf8ebe7f6dfc5bc8f057b96db9fba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992413, "uuid": "288aa100-da0e-440f-a395-a37990e77665", "comment": "Malware payload (AgentTesla)", "value": "a245bbcd8bd89a1b4d24f79630212fed50905ac410132678fcea552048b66792", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992413, "uuid": "3264c351-2e44-48dc-b41e-69f6399abb1e", "comment": "Malware payload (AgentTesla)", "value": "373e8bc5d5a3f02c5e80102d87353cae2354b6c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992413, "uuid": "9d0aa6b7-3656-46d0-b420-0a5d611cf11b", "comment": "Malware payload (AgentTesla)", "value": "a30f2a75a1bc6ce5b0cdefe75f428c0c6a40e56533a142d4d095d53db9ceb22d4eba399ad455f90e69962ee0c95d6d95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992413, "uuid": "2bb1b170-6be6-46e7-bdef-17a72b640179", "value": "T1B805E63D2ABD1127D0B9C3B78FC7E427F0389DA77055ADA4A8D323664392A5674C063E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992413, "uuid": "00039a10-3d56-49cf-ba46-4bbfd01788ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992413, "uuid": "273c34e9-7dbd-4008-b21c-3fa4ef1d9548", "value": "12288:ZRUTV5n7K0MSsLV/7bF8wshLTwFoMUA0PWvrMC/HiZ2G4S6Yz28jj4ykm:0TV5n7+beF3wFo004/HW64HX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699992413, "uuid": "f64e7b5a-d04a-458c-abad-53000b7b62e9", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699992413, "uuid": "7a7b66a1-f4a4-4399-a71d-a77698fec319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992413, "uuid": "c9d6a4ae-ac1d-4e5f-93c4-1ca4c9949a1c", "value": "Remision Copia #190922-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85710c89-82d5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699956407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956407, "uuid": "4b420863-6a9f-467b-83b8-b5cde28f0e9b", "comment": "Malware payload", "value": "a42fac1d3d105d69d0baeb02cc93107e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956407, "uuid": "d53dce74-4aa8-49fb-a8e1-a214c51464d6", "comment": "Malware payload", "value": "a3cc4fff4aac80dd379ae09712229eff389c1172d888180dbce61715965f4885", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956407, "uuid": "fdd93ea1-3868-4664-8cfb-6d072a904b5c", "comment": "Malware payload", "value": "635fb563e0e4b95301e459cc3f59caae431b5e33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956407, "uuid": "141b5149-8519-4cb3-a61b-b9069c0d9076", "comment": "Malware payload", "value": "d6568a5bc4f29f504e14580c4c64be3de78a22c174bfa8cb3f8f2f5698a65774e1439e0fb4befdc52ccfd5ddb272d6f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956407, "uuid": "c8706759-ce73-4fe6-a575-cdc3e931a8f4", "value": "T1B4946B993981C4F2F2B9833706B26E246B5462E6DB01C98F771C0A983B157E1F53CD9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956407, "uuid": "e4793a02-077c-40dd-8b53-6bc74fa69423", "value": "1c7d0efed001e965dd9c0307904ea44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956407, "uuid": "39a8076d-91b1-46f0-b6a5-9a369f88f26f", "value": "6144:RWIU/FKe4lNUq/Vr58AO00HHY8Y+IxyCq+DX/buAfotdnJ/mgb0q0:XU9KeIB589nY8Y+IkCrfotdJ+gb03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699956407, "uuid": "5e0beedb-4b2d-4308-9c87-abc671a3a4a6", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699956407, "uuid": "6e1bbe42-1b9b-4c30-9f8a-7b49b8e5133f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956407, "uuid": "97f7e950-db60-42a9-b312-f4afb1925c44", "value": "a42fac1d3d105d69d0baeb02cc93107e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8760182b-8325-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699990770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990770, "uuid": "44905388-5ec7-4799-bc3c-d779c3246bee", "comment": "Malware payload (AgentTesla)", "value": "b084b5f891ee58923a846052fe574bed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990770, "uuid": "b954eea5-1320-4d4b-82a9-6921c699930e", "comment": "Malware payload (AgentTesla)", "value": "a3e10f92baec9fd3a6ac12cfdc393f4031a94b4843300a767e89b0dfbc026a6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990770, "uuid": "058c684a-561e-4ae1-9e11-8fb940a169e0", "comment": "Malware payload (AgentTesla)", "value": "a6d701d174f211f39cc88c3160fb3124bac82b99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990770, "uuid": "9ccbe5de-2e9e-4511-b195-d88f74f85f32", "comment": "Malware payload (AgentTesla)", "value": "4632a506f036949732db0bc7afff2afb577324176901fb0e05c609999c14c385c06d9b28ad89d890e3a5044799fa09ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990770, "uuid": "d5f50ee3-2f35-4e81-b1a7-692e8823c068", "value": "T109842306A6E2D0B7D18329B049738677D6B29D044131E7CF57A47FEA7E31292ED8E083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990770, "uuid": "69eabc89-95e5-4d20-a486-5fc57b735e0b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990770, "uuid": "2eabe74c-df04-4b50-9f8d-716048379658", "value": "6144:iBlL/k/H34hmrfE5HSoJryzcUOmqX3nrr3TSmvOhRePlMNc1/J/uMFXOCpxA5B+f:Ii/XfrfEEu+3BqX3rrjSmvxauRoO79h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699990770, "uuid": "00fc4001-8610-4c59-b781-624d332f0b06", "value": 395980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699990770, "uuid": "d5a68887-ccf3-4519-bf3d-fd98feae3416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990770, "uuid": "e3295c4f-d0f7-4131-9fb9-f500072c1a69", "value": "Dekont_BelgeID 23TB005206_23000001350887000005286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f98415-82cc-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699952591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952591, "uuid": "6c3f8127-4a5e-4148-bc05-fab3489ee864", "comment": "Malware payload (Formbook)", "value": "7690ad629325aa8d720749249c0142f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952591, "uuid": "a67f4458-836d-4fc9-afa1-c7606ce5b5ff", "comment": "Malware payload (Formbook)", "value": "a3e4cc3747006495c9cae3e6f08010b8368ebd5883b556e021a923fc20f5bef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952591, "uuid": "d36c1a3f-5102-4d14-bbdf-bbe60c34d7b5", "comment": "Malware payload (Formbook)", "value": "a532fdc6b1786805e0e9e12d97fc8c2640b14f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699952591, "uuid": "d9f8030e-5895-40d2-899f-64cd71492e2a", "comment": "Malware payload (Formbook)", "value": "088e5664b9c4f12d8c7cd1886de82ec0ec6bfca8912fa2c1f46ba4238994bd5fdca6c214a9ddd605cf351c37aae8a2f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952591, "uuid": "31e48f78-a1c4-4923-befa-2a0084618dc5", "value": "T1BE7422DB22F18ABBC19709F07977D796F3A6A364C26116CB13645E2F2C653C89C8B019", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952591, "uuid": "e7a3e9a4-bc76-4e90-ad68-0d9b08e7630e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952591, "uuid": "830bbbde-6aaf-4aa2-a5f3-1d5dad2c398b", "value": "6144:wBlL/91vk5jzmx31SGUCpkWbeZnarzgbm8q/vx2P3U095WAD:C/t3AGUCpvbeZNjup2P3Uqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699952591, "uuid": "38ae09bc-6cc4-4970-af22-ebb4f813c995", "value": 351031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699952591, "uuid": "6792ddc0-6ad1-4b85-bd4c-dda51980fc00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699952591, "uuid": "1a270cba-e5d8-448d-8ef7-9879fb738686", "value": "Order QR-00658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72b3541-82f5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699970234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699970234, "uuid": "d15fbacb-340d-4de1-ace3-f27ea14ce7dd", "comment": "Malware payload", "value": "4e431ada50287a4075f509904fa12421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699970234, "uuid": "d375f581-2553-434c-b8b9-18fd748e57f3", "comment": "Malware payload", "value": "a6189864b80a674de976bc67a13f42fc6e601f2ea11c446047c84e2d12e120ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699970234, "uuid": "100210e2-c6da-4d2e-86d3-e518278fe081", "comment": "Malware payload", "value": "2a22597624ff473f9d7d08625421052874540091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699970234, "uuid": "48133a53-507a-4533-a4ca-11d3c84722ae", "comment": "Malware payload", "value": "8792d956546791db4e3d1a714d49a1c0fc652b02205a020509fa8f7eb02d2412b0ed56925ade2645772ff9cdde094d78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699970234, "uuid": "7cdaa3bb-f4bc-4361-94d9-8dd29751f9ac", "value": "T17E14CF2277E1D072F2A7453449A182B5AB377CB24B7185CF2BC61ABE0E316D1DB39316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699970234, "uuid": "b5de5844-448f-402d-82ee-02d5d17890a5", "value": "a7abf36a6b659d49138cb3d2e8a5f744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699970234, "uuid": "1f42d2c8-c29f-46c8-8c89-ae4c1bcf7ec2", "value": "3072:gqz5yp10w2iXcmO8ODUIRhjBVmju/7kfYj86RR0KhMm71gIc:Sp+bCclfDffN7HgAR0KhMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699970234, "uuid": "0df7b7c7-ee8a-46b5-a746-e6f9218fb529", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699970234, "uuid": "9caaee30-2d44-4e11-ba0c-3221fea47871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699970234, "uuid": "abe20708-d514-4395-9806-5a9efe73d243", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63df879-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982688, "uuid": "f04b0ecc-3411-4696-a681-40875017ebcf", "comment": "Malware payload", "value": "84199c61d879b604d2ff510d3c46f460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982688, "uuid": "cac35dac-5b0a-47c4-b5a0-9138d9782bf1", "comment": "Malware payload", "value": "a6f065630c7b482267b7fd73a39c55615b8e6e35e258c1798ca42878ea989905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982688, "uuid": "6cc05ce1-f66a-450d-bc56-c8ab6f478791", "comment": "Malware payload", "value": "8e3f3a1f460c7883c106edc82ef020a8afa9b015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982688, "uuid": "dd20287b-c7a0-4e36-a7e1-cd585faa5a0e", "comment": "Malware payload", "value": "29a39c822ddc40db520092a47f4505a2f92d50c536746d31f48e1795613c962bdf13601ffcab65bcb806893fb52e8d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982688, "uuid": "4271a911-6a6c-4549-8466-612edc0d77dc", "value": "T118357C1732915033E6B279364A1B42ADC826FE161D78345A6BF99C483E35643FA72FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982688, "uuid": "edab491d-dc20-4911-9195-b15b087797e1", "value": "12288:bGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3a:bKvzcrnyaLO+3Yb/wQeAh/7RR1M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982688, "uuid": "8a5a2615-c75e-49c0-bb29-538263637eda", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982688, "uuid": "08248d32-1a0d-4132-ab1d-0a7fd64b9357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982688, "uuid": "d90480fb-b600-4313-8218-273739e587a4", "value": "SecuriteInfo.com.Win32.TrojanX-gen.18572.26322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df21297-82ef-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699967427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967427, "uuid": "db9ba994-d67d-45a3-82d1-7a412ab62ea3", "comment": "Malware payload", "value": "b266c6c7dd8c458c7b6260e947bc9966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967427, "uuid": "9d23b2f5-cc1d-4dc8-af05-8404659a5b53", "comment": "Malware payload", "value": "a79f593a22f2698e351aee60ab23afdaa239ef545297e495df30ecedb99fe222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967427, "uuid": "376adaf2-8a3c-440f-be92-0359fa206400", "comment": "Malware payload", "value": "ec751e5f7deef9e54035480adfc2c4b8dd8d832a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699967427, "uuid": "803e86d4-f3ac-47dc-8f89-7ee395c8397c", "comment": "Malware payload", "value": "39beaa9fa29995d8b738e5ea17985822de35a78c9df18c5e06abe008f69a3c49c2840f4c0862bce937d7f6f45f0edfa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967427, "uuid": "2ef738d0-6cea-4559-a40f-4d8716418e57", "value": "T19A14CF21F7E1C072F2630638896285715A27BCA25BB5C8CF2BD41B7E4EB16D1CB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967427, "uuid": "bbedcf2f-4e58-4ec5-8b9d-68e0fdc22218", "value": "a7abf36a6b659d49138cb3d2e8a5f744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967427, "uuid": "e4777de8-4738-4604-ae20-23cc23d6e228", "value": "3072:wWqHyHO0w26pcmiBEn9YzTlNNEcEBasm4RMMe0OkMN71D/A:jHXb8cxR2kgRMMe0OkM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699967427, "uuid": "a2bba655-0523-4265-ae3c-794ad781589e", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699967427, "uuid": "dea46f39-91fd-44ee-be6d-c944e36a4524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699967427, "uuid": "2676cd8b-4221-4040-99e3-48af36cbffc5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67a20c9-82e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699963898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963898, "uuid": "d5fa1876-8b5a-499a-9626-14d5e832b064", "comment": "Malware payload", "value": "3c6b733b4375710f7f5c58d4e8875225", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963898, "uuid": "443c2fc9-2079-4171-ab67-ff70b95d2d00", "comment": "Malware payload", "value": "a8338b8fece4e078c2ec6b634d6d1a161beb68cc8632e41127edb24e2b9ec80c", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963898, "uuid": "a02b49ef-cf0c-4a0a-a5ba-2708ebd18d0a", "comment": "Malware payload", "value": "09ac58441139541d549b17eed919a918a43bb967", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963898, "uuid": "a1e1359f-f436-4edc-ab39-c5d8506b6015", "comment": "Malware payload", "value": "7057eb40c01b423f600ad7df157389efcb270620346dfdf1f0d2a83414af0080334d6253875dc9f249d673d7cdc43b9f", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963898, "uuid": "3473fbb0-b9a0-42f6-b6d2-a33dc0d8fed8", "value": "T184D5BE2A35CAC637EB7E82306669D77A61BE7EE00BB100DB63D42A5E1E305C14275F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963898, "uuid": "128771d1-eebb-4d45-a7cc-7b9b11009f96", "value": "49152:+lDUdqW8zBQSc0ZnSKQZKumZrzq4Fb6HXr1iWnYs4ntHurpllQ6akuxtZ+OOsLRa:930ZnqKzFnWntuxqsLRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699963898, "uuid": "5a332da8-3feb-4303-84a2-ccd18e8efae9", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699963898, "uuid": "ee87e05d-dc6a-479c-b255-4986a364a0ce", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963898, "uuid": "5e7b6dbd-b1d0-468b-b71e-75ed02da1ebc", "value": "Cheat Lab 2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d275b5-82d5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699956590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956590, "uuid": "74317a42-9bce-41d5-b0c9-fe7e9b27cbc1", "comment": "Malware payload", "value": "efffb97aa9f53110ab5035c995e7d62b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956590, "uuid": "49ce9c5c-83cc-4852-9c0e-4663904e3611", "comment": "Malware payload", "value": "aa0668633c7c710b0a09adc99362b4a3547307f0b3f1338ae731c35d9b071d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956590, "uuid": "7346063e-18e1-4148-9d41-fc6e78c67e76", "comment": "Malware payload", "value": "8594e94f8991efba6cad2b90d44ba0a8176ce941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699956590, "uuid": "d108a5f3-4cea-428b-aeb2-38e38fb8cfde", "comment": "Malware payload", "value": "3ef202a1a01729685e3ad995604919ed84fd5cb44746a512a01c20f5a4bad4464a1017929d52cbc671ca837852397b67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956590, "uuid": "39479c06-d768-4db2-8e3b-ea0fbaf07657", "value": "T114946C26FB93959DE265533EC58F8808836792D0A273E70E7DEC33DA4AC33665E64341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956590, "uuid": "c9f0c7d4-bd3f-441b-932a-47b171258b8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956590, "uuid": "699a5e82-0adc-4416-8784-c25e524bde2b", "value": "12288:iUkdr8MYQ4RB2I3t8tfDkKeXXfmDTh6+:/7t85kFMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699956590, "uuid": "1635f509-99c1-4f99-9429-09683151615b", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699956590, "uuid": "fc90faa6-5d52-41cc-bab8-4f7a7ac6122a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699956590, "uuid": "a56052e1-afb4-4ca1-a5e6-4835535b0116", "value": "Wzphku.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadab059-8305-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699977139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977139, "uuid": "38f8cb38-8807-40b2-875c-ff57d6717eed", "comment": "Malware payload (AgentTesla)", "value": "b4746838dc731451d28d7480f981f4df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977139, "uuid": "b9c0f4c5-10d0-4dee-8663-f939da4c452d", "comment": "Malware payload (AgentTesla)", "value": "aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977139, "uuid": "1809ea18-d515-48fb-ba9b-c673e18aaaa5", "comment": "Malware payload (AgentTesla)", "value": "ec133378a88d8ad76a2ca9db01bade15463d361a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977139, "uuid": "e36ed54b-d200-4187-9377-6def0a9e4b64", "comment": "Malware payload (AgentTesla)", "value": "352d0020c715f2111e7c406ad7cfdedf57bb44079a00502d39fa165d2575f78d42eed327b534d2c19c9bdea7738723eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977139, "uuid": "bea82ec8-e746-46cc-98d3-b0fbb523a7c0", "value": "T10015CF91F2889883D46A15F54C37DA7012E76FA9A569C30C24F77B295BB33C3101AE9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977139, "uuid": "4892dd18-d39a-474c-ac84-6acb1fd29bff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977139, "uuid": "e30c853d-2ee2-4f49-95b7-3a7beb2e850c", "value": "24576:um5eFkOPhJUpaKycyYJAjbaGPASdlsaTzeM/:um5XqJUpXy95SGdlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699977139, "uuid": "b4b84c7a-31a2-4b1a-b2e3-8c2647222f9a", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699977139, "uuid": "4244ad42-b298-4f5f-bd4e-9b0093f8cb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977139, "uuid": "35faa2ae-1da7-415d-b415-205101335d8c", "value": "Booking amendment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954a9d3f-82b7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699943549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943549, "uuid": "73bae82a-d8f3-488e-b6ab-e3f17a6bb046", "comment": "Malware payload", "value": "2d9e93d7efdd29091807122268863bab", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943549, "uuid": "fda27989-6cc0-458d-93f9-09caec280214", "comment": "Malware payload", "value": "ab6b3a30d643bd1a807d4415e554a7e005c9320d1adbd0bfb4666cf1509c3078", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943549, "uuid": "3470ed6e-0c46-4a95-8a5e-1404dd8026c9", "comment": "Malware payload", "value": "79620e2cb35232c0e50d6a94ff02655f2dea696b", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699943549, "uuid": "ae7fbd3f-9e8c-4c1b-8c81-94576a709748", "comment": "Malware payload", "value": "b4df40e49cf7492bb5b468b50cbac75eb7ce4697e405247f5635941cd6571d91dca2374eb07093425ffeec8d8ea2580b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943549, "uuid": "0eb40aab-f32b-4a5f-934a-3a94090b7abe", "value": "T192F5F11276C2C533D5BE06701A29EB7A417EBD200B7198DB63DC5F2E1E724C25632FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943549, "uuid": "03d699dc-ab1e-429f-8976-bd0718cdf4c5", "value": "49152:Cu4YW5T68otYLN4TFvr/7RaZADXGQt56YK1JeXl2ajKMIoDqc1lodL41YsxBMAdU:AY/NsAuewMInSlodL++36qlsljn6jN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699943549, "uuid": "cb710017-829a-46ed-b62b-83bdab6bd896", "value": 3630592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699943549, "uuid": "6968103f-0375-47a4-9af7-8b32e27baa82", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699943549, "uuid": "015b0568-09b5-4d61-a4c3-058805d4e9fe", "value": "6004195.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcd4c1f-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699964638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964638, "uuid": "09c19c37-636f-4cc4-8254-92e37a75a722", "comment": "Malware payload (AgentTesla)", "value": "83b1a391df80adf36389042ab32ee925", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964638, "uuid": "06bc73ae-94ee-4cbf-89fc-c4dd2acb2bc8", "comment": "Malware payload (AgentTesla)", "value": "acee9632690fe7361a073ccf9525e9d3211faa67a4b83f88367f83013eaa7403", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964638, "uuid": "c14f3100-dfa6-4607-9502-4311a6462b16", "comment": "Malware payload (AgentTesla)", "value": "bd34c3878c637b97577788530bc9b379e54d7c80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964638, "uuid": "d84b62be-2706-44fe-a279-bbd60ea0ac3e", "comment": "Malware payload (AgentTesla)", "value": "3d1d7f55ec49dda8f99c7fadb0c0d71eeac7b2ce778a78c7b123a2962df22f52f46633872d5e54ef06a9d232f3b5af72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964638, "uuid": "5b389a31-e7aa-4462-8515-3cfd7d99dc56", "value": "T134B423BBA7B07A434B464CCA2D518B97903DCD4D7BB3DA1C709AA05DF87D882D900E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964638, "uuid": "691f5538-b216-4de9-9e46-9dc096d35124", "value": "12288:5vehMGCdlspd/cO4hDosuE2kLKlvuURO+z2xlK5Wfk1o:NehMtdC/cOQoFTkLou6O+ic5Wfk1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964638, "uuid": "0a4f6052-84b5-4837-8959-e1e050f97329", "value": 510349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964638, "uuid": "17bc5eda-887a-4ca0-b5b1-acaac74add0a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964638, "uuid": "4a7a9622-b190-42fd-adf6-11b083a1882c", "value": "PO-PO2723030194 Version 1.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297c5a49-82cf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699953676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953676, "uuid": "f2beea9b-97fa-4d5f-81d8-6ee3c88bbcfb", "comment": "Malware payload (AgentTesla)", "value": "fd911a09072768bd06c35f6107822be5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953676, "uuid": "02e52c21-0c3f-4571-aac2-ef45df948e32", "comment": "Malware payload (AgentTesla)", "value": "ad654aeceeb0af81e68181bb70bfe413527895eb4b23b378bb084129f9ae1a0c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953676, "uuid": "67fb00f1-e12e-4b34-b696-5345c73e2245", "comment": "Malware payload (AgentTesla)", "value": "8aaf3f3e9517410d5f613742f5f05a1e7820b1bc", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953676, "uuid": "00553962-f991-4b6f-8e99-3437b036567e", "comment": "Malware payload (AgentTesla)", "value": "2f8abdebf4f6a5d51f2fbdae5010c4cb2fe44ca7b2d66cf22fe6bb96ab229262ca840ed3036c4b57b9183ea24fb69839", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953676, "uuid": "e7323aa6-a0eb-4a4b-92fc-1d4298a0b12c", "value": "T1BEC43398F9F56E4E8158A7DB02043639E6B822CF1362FD5D00AC491FB6B6D0F535E478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953676, "uuid": "cad0ef1e-18fd-4340-aa77-e89da07b5cf0", "value": "12288:it4W3VT08zASfDopyhP7zHhHvtzeZUaBpgYkjt/CwsY0OyngzW:it4AxkSropGuCaBaL9+OynN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953676, "uuid": "16adc129-4117-4897-9562-a9acd68636d4", "value": 561503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953676, "uuid": "0dd680f2-4f22-471f-adaa-6bf3e79aa95e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953676, "uuid": "32136635-ae42-4e82-a77e-4c721085ee64", "value": "Confirmation!!.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074821ea-82c5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699949323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949323, "uuid": "80fbc33e-bad3-4bcc-bd54-bd1eaad77e5c", "comment": "Malware payload (AgentTesla)", "value": "174dbf4df3333baa33d0971fa985bb35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949323, "uuid": "c6c14f69-4500-4a29-a953-19d8f8012493", "comment": "Malware payload (AgentTesla)", "value": "aebcd6039f3bfcf9ddfadaee2d5e631afb676e36e1497036283b24c73b810800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949323, "uuid": "056f070e-0757-47c7-a6db-005875e6a216", "comment": "Malware payload (AgentTesla)", "value": "82275277e199be92518662701213e66c63832820", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949323, "uuid": "3d4f611f-d78f-4c76-9cc3-d6075acb91f7", "comment": "Malware payload (AgentTesla)", "value": "c30a1ed40cec9aa0f1ba01791cfca934ade8b0ef34c158768233770d01e1395787ccdf98ff311a41eab694978200091e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949323, "uuid": "0f8a4993-8d79-4914-9431-e8de480b65b4", "value": "T15225D05529E40306D3EA06B8E865C5710761BC1E5451D66B92F83CBF3FFE3A3C462A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949323, "uuid": "e2d07325-8b13-4ad4-af10-ade7ef1828e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949323, "uuid": "a129218f-3fe7-4dc3-929b-fb5baa8784ea", "value": "12288:kWATNX43QF6bpAFnSTbLRT8blKaho2N0ixc+ewGfmA/yS639ECVYzY6BSpeUgffg:13QF6tqSXMlzWixc+SmA/yP9UzfBKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699949323, "uuid": "0ca2646d-2df8-471f-9ba5-a02d23b822b9", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699949323, "uuid": "ba946c2f-7d33-4c37-aa0f-75aff0522c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949323, "uuid": "e64045f7-04a9-4bd5-8b13-b621d9d68dae", "value": "payment made.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0c1167-82ed-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699966649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966649, "uuid": "c19ccb2c-42e5-4589-8d4e-5598e919ef61", "comment": "Malware payload (AgentTesla)", "value": "fb72e21a5d76384b9390f0a942527876", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966649, "uuid": "e9949525-05f6-4c13-9c1f-84885bf199f0", "comment": "Malware payload (AgentTesla)", "value": "b05c4c012a23a232bb4cb07b15af09c7df8ff87cd664f6169bf2b9cf0ec392d3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966649, "uuid": "81af8605-85d1-4805-ace7-e0483635df4c", "comment": "Malware payload (AgentTesla)", "value": "4de6e128dd3f2d2001707bdb5e16a3f247b99444", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966649, "uuid": "47f0c24e-b474-4264-9bab-73df2df96404", "comment": "Malware payload (AgentTesla)", "value": "ad7cf18c8f116915b48d559420f2b82cf529715bd07963419ce9ce436459406e725ef27bd406a24e8717d5f5e3b3fffd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966649, "uuid": "4cf48edd-8b00-49e0-8f53-5d79e056d037", "value": "T1C70533E4DA4ED9A6EDB0B8CE0F09C5C5F372497AF43845C07403DE1A5B1583D1AE0AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966649, "uuid": "7b69b6b6-c600-4f6c-9d43-a2e99eb03820", "value": "24576:tvpuj5VP/VMhvpu46ioF44L2dg3ID7F2zABt:tvpudDMhBulezg3o7s0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699966649, "uuid": "dce3e341-8e8e-4d3a-bf8b-b40177e0459f", "value": 863891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699966649, "uuid": "0b3e96d4-7ae8-48a1-80a2-09a84a34397a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966649, "uuid": "36976e26-de2c-4b79-ba60-4eaa697ef069", "value": "SOA SEP.OCT.NOV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877dd468-8307-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699977885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977885, "uuid": "7acf39a5-b4e1-430f-b26c-6c846d7aab4f", "comment": "Malware payload", "value": "7918013ae55de62f5e108342a464864c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977885, "uuid": "5bd8cf64-4393-4d11-bcb6-ea31fd9a0b9c", "comment": "Malware payload", "value": "b4177d3d69f7951f46d07b01204fc749befc81531720de78ab7e75e93db35c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977885, "uuid": "f31f40f7-f3b2-45ec-814f-7c78aa7691a4", "comment": "Malware payload", "value": "8708c49b44c2807ef24687ebd4dc68a1a69b4100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699977885, "uuid": "3f46834d-d040-4a0d-8f8c-336d6b494d6d", "comment": "Malware payload", "value": "52986d1daac2e3adc5cb4ed8ce062e541103779ae2e17005d6aab8209a2b531a84ad859c71aeacc4915284e48b6efef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977885, "uuid": "181a7277-1496-4a9a-9679-84627f55a3f6", "value": "T17924CF2276E2C072F22745305972C2A69B37BCA25B7094CF27C01BAE5E736D1DB79312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977885, "uuid": "0dbfa705-c74d-4b76-9e71-850e7810dbe6", "value": "934ec125307f845a986ee85bb76bb1de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977885, "uuid": "c864df6d-3dad-4c28-bf54-f2713d0f0be4", "value": "3072:+W24/2cixIYIXT4f9Nv9+vDgnd3MVdGUmPtV/8zDKlpN4c:+hxIlXTGvY8nd3MVdGUctlmKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699977885, "uuid": "495f199b-67ee-4f9c-8861-d53ea9eeb5c2", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699977885, "uuid": "e1f7af30-dceb-4715-8bb3-e405e706e393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699977885, "uuid": "6502b1c8-891e-444c-a5b7-383867b5bab3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00df6114-82c8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699950601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950601, "uuid": "515179cf-12dd-48b7-9636-d52794594bb1", "comment": "Malware payload", "value": "83a24c69ac5197ec0d163e7d1be8ec85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950601, "uuid": "87cfa24e-9506-4170-bd0c-c50e546fe609", "comment": "Malware payload", "value": "b4fc50feb3200e9f998dbb7b89dc252220c913c039624fb599aaaab413ede44e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950601, "uuid": "998cf71c-f189-448c-96c2-b930538260d2", "comment": "Malware payload", "value": "14ae6abf185b9758ec7d3929f5887a55d28a232b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950601, "uuid": "17aebeeb-8a9e-4ee6-ac0e-1e088d609c2f", "comment": "Malware payload", "value": "47d2af4e08f8eb43ddfe5bcd10fe65fbe9fbeb8cb8104ce37667fccd2e6ce3447d5bc379800eb1e41786004336571f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950601, "uuid": "c3e981f8-fb10-47d2-9712-331c7f8da7f2", "value": "T191947D53B0D3A9A3D012DB35A8D4927C36EDE4E2ABFAE8A71342531DC6153C34F291B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950601, "uuid": "d045074f-6f8d-4121-a4ba-04753ff56519", "value": "321e5e3951fac38d82c138eb99f56618", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950601, "uuid": "276b550f-0008-4a9b-8e92-89e5eb448c42", "value": "6144:4Io05R5soT/UKxHy+DAO+YZ+67RJwqs7jiveIwIdFs:E05wAy+DHRJ6fCeIw6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699950601, "uuid": "603a8cb7-b004-4ed6-a0b5-2b354bb8b8f5", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699950601, "uuid": "9423516c-6e86-4ef6-80eb-fafad05c21fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950601, "uuid": "8f7b7afd-231f-4b5e-9d4f-c0ed0a5fbc93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0f48a0-829f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699933096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699933096, "uuid": "ff650cb0-d0fe-4606-8b4f-bddfa3c3bfa7", "comment": "Malware payload", "value": "c9d5934e996e50b1417ac5ba5fb87103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699933096, "uuid": "6ae1d8ab-1227-4695-aea5-daa106d3a143", "comment": "Malware payload", "value": "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699933096, "uuid": "a8bc019d-ab6f-41de-a0ea-ca8acd9b49c2", "comment": "Malware payload", "value": "30d083734c44641f35079498faa1bfffdad37434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699933096, "uuid": "bf361b32-e82c-4109-8ca8-5fa89ac48d9b", "comment": "Malware payload", "value": "837b6b5877c9c3876b2df1684c793752b535ddfc54384691ecfe6591431a99d8cbd60b472d320912eb3c8b5014a6b192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699933096, "uuid": "4ebf06ce-18f0-430f-8cef-b7b7ad2a16ce", "value": "T12A335B4A33A044F9E5935739C8F29A11E773F8532339434E43A482AB5F737919E2A772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699933096, "uuid": "3027ca97-41e7-43e3-af91-b4087d17c5f5", "value": "06ed791760f01a9818957f0234599d87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699933096, "uuid": "23a88ac2-fbd0-4714-8f59-e86d0af14d3e", "value": "1536:BOyKZ5EBTy1jG6oplCVCyiRyxTNOll/xdyyyyyy7v:BOyasTW2ljy0WpOll/x1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699933096, "uuid": "3a348f71-7c62-4c3e-beee-855b38a00918", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699933096, "uuid": "63dad76a-0061-430c-b6f5-69811b0c1e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699933096, "uuid": "1186ef2f-884a-4382-ac70-240d35f1b180", "value": "user.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef61058-8312-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699982703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982703, "uuid": "61c45fae-7104-4cfb-8252-55ba4c12e4bf", "comment": "Malware payload (AgentTesla)", "value": "699ec24a6a13d620e51397a9e26561fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982703, "uuid": "7d584832-6e36-4a67-8cb7-7be209bb61e1", "comment": "Malware payload (AgentTesla)", "value": "b74c35fff28c2545faae06261ed6ee1649067638169ef24dfa449bb201fd6039", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982703, "uuid": "acc0d156-a335-4bc9-8a07-dd629ec68e82", "comment": "Malware payload (AgentTesla)", "value": "d48b02570b823db0a9587f90184b9966d4f77d99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982703, "uuid": "68efa67b-657f-4815-a033-74f8f2815bc6", "comment": "Malware payload (AgentTesla)", "value": "15442031ea1a1fef33e8b8894e8b002e3868f928e14d0125383909999145c6c2db56e17b537a05cc76ef67c74fc181bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982703, "uuid": "5d3fc17c-e487-4f24-ad7f-92de0f827a59", "value": "T181F4022632689937E52C04F5604B188403F1EF17A953E7D89CA3BBDE67F27C15A0A1DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982703, "uuid": "8521e804-35ff-43ba-b47d-8e2b65b50f41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982703, "uuid": "32609ef7-18c4-4f67-bcb7-b222fc24fa9c", "value": "12288:h6ujlfyx9EWPjtmRlc7wb43gR5ZICU573F9m9znULjMNMM8lsWtG85iBZoi:jqrPjT7643gnZZ2V9oULjMWhlVs85iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982703, "uuid": "d9a104b9-7881-4c83-837a-ae0e218c8c1e", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982703, "uuid": "538adbba-d486-4789-9b99-cb2e0402232a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982703, "uuid": "eb73c488-acb4-4843-a3d5-d1c1e414f1bb", "value": "SecuriteInfo.com.Trojan.Inject4.59820.15812.20006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba330037-82eb-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1699965944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965944, "uuid": "dcafc72b-8fd0-4de8-b8c8-340466043680", "comment": "Malware payload (DCRat)", "value": "a4c1d7c49472e76cb2390966d091a53a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965944, "uuid": "cf90364e-a344-4eaa-ac61-648a38e4c20d", "comment": "Malware payload (DCRat)", "value": "b84309a3904c7956ca30b8803e41862ab7b4de1dd943f57ce5a211f2479e48c4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965944, "uuid": "4463756e-ab82-44f0-bc12-cd9945b623dd", "comment": "Malware payload (DCRat)", "value": "d60b3301c5315ad2de0bd6c72ceed8bc8511353d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965944, "uuid": "13512bf4-a55e-4e10-bba5-46d2cd198cf6", "comment": "Malware payload (DCRat)", "value": "1eac346010bbc7e085760d627edb8cc70a9c09f7dcbb1802b43df7e4de4212390450a7285e371ca5e52a7b6eb5091185", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965944, "uuid": "c6d320c8-3f95-4ce2-944f-a54387af40ec", "value": "T18805E6027E44CE51F0491633D2EF458887B0A8516AA6E32B7DFA37BE55523A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965944, "uuid": "5e4b1554-1ed6-4984-ad55-c59904cc58d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965944, "uuid": "eb719abf-4e3a-4046-81cb-df53122e3aeb", "value": "12288:sHXMK0GyVwrWK1psBq/D5bMaeU50KIbxUCWgzY4OsMbiKHcEuqGCkHoo:sHzowrpjMPU5zI8mY4dMcQGZIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699965944, "uuid": "9dceb907-6533-40e5-bc4c-a8a8233799e3", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699965944, "uuid": "42674f10-a336-4e6a-bcae-a0e466b1238a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965944, "uuid": "adbdbdcc-e4e0-419f-9276-a5dbe8cc0d94", "value": "a4c1d7c49472e76cb2390966d091a53a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027fa7d0-82cf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699953610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953610, "uuid": "155bdd4c-b54c-4a73-84a7-3944761958a9", "comment": "Malware payload (AgentTesla)", "value": "5d9ae7dead94469a6e9f0fb44fd22acb", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953610, "uuid": "a206c673-e21b-45d5-b65f-6a9757c57727", "comment": "Malware payload (AgentTesla)", "value": "b8644db718fef4951bd198cb7342d7070b97a32ef4344b8eb0d0e8f244c041af", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953610, "uuid": "feddb316-c02e-47c2-a7f5-ff556f19d70a", "comment": "Malware payload (AgentTesla)", "value": "b8059a1a22e54b113101400eb2d2d47952f1908d", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953610, "uuid": "984ec7c6-5687-46a2-aca6-446e62d7c959", "comment": "Malware payload (AgentTesla)", "value": "984cd9beecea8e8f37f620861c0e1d2ab094d483caf42cadee8b03c6b32b18b48a563c948fe8bb4c308aefaed2b81665", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953610, "uuid": "8243eeac-936d-4574-9312-fda9d1b10ae4", "value": "T1CEE4237DE4677C6405920A437758E795CDB5A9C7BCCADCE488863942ACF030D83A9EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953610, "uuid": "7e8b53d8-89de-4e09-8e39-98caa3c9828e", "value": "12288:/JV1h5vb3GVbmz0iMySUUJVBScaPdJS3guho5kQF4FYF70iT7/Ft4aI:htVbqbmwiZiScsS3gVkQF4iF70iHoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953610, "uuid": "c391646a-c98a-4a77-8401-847f87d1350e", "value": 702199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953610, "uuid": "f50f2f0e-e003-4b80-af00-5dc8672d2048", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953610, "uuid": "c3b9128a-b9c2-433e-b174-e07d08b046a6", "value": "INV. DSSTO-202311007.exe.gz.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ce43d5-82a8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699936951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936951, "uuid": "0b4abddd-e20c-44c5-8e49-74f0efbe2a8a", "comment": "Malware payload", "value": "de95d3e4f773c1c17d083c76539f2bbd", "object_relation": "md5", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936951, "uuid": "ad801f47-5549-4598-8cd6-2899a691486f", "comment": "Malware payload", "value": "b9a953af462e7c92a64aa70d6e596cd715b3e0cf5761bd76a80d8c252c45a38c", "object_relation": "sha256", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936951, "uuid": "038d59dc-9811-478e-82af-26bddcf38bae", "comment": "Malware payload", "value": "0fdf1cbe736ecbb61be7eec122d8f38c0e4c5868", "object_relation": "sha1", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936951, "uuid": "3a398a3c-bae5-423e-95a2-8a4dc6b2e2f5", "comment": "Malware payload", "value": "a7eb5bca6feb050fd38f5ff86f5cdce60de3b6fb6f66df54c1970a668741a966e2eaa7852affe4cee9d192f183c2f1d8", "object_relation": "sha3-384", "Tag": [ { "name": "cfecobrodigital.site", "colour": "#35D175", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936951, "uuid": "6758e142-2d53-456e-b171-9c43e8f0932d", "value": "T1FD35519C765076DFC857C972CEA81C64FA60B8BB930BD203A46712ED990D99BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936951, "uuid": "fae64854-8da5-4704-9ed8-f4a8cb10be5b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936951, "uuid": "2b97ae58-3f61-4669-af92-3856bb4f8f5a", "value": "12288:HdYXvTpqqp6zvmU+WXuB2WlmqIk89kH835Je3LSvxLdzSod4/JIxf2G/Mc0T8wKW:mv4mBWXuBXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699936951, "uuid": "f60e26c2-9dca-4992-bc58-5d2c5bdccce0", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699936951, "uuid": "85e652c4-4394-4cdf-9c5b-b73b3d6cdc9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936951, "uuid": "cb29930b-b1df-4cf3-9f50-1b406a9062d5", "value": "rp9ep21xy1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4515a74a-82c7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699950286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950286, "uuid": "83fa619c-a129-4b67-8683-20d9d4ccc8fd", "comment": "Malware payload (RedLineStealer)", "value": "cc54b6e43746da71a70a44a694c9cb4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950286, "uuid": "78a090d8-7248-4db3-ab1d-55c90591c009", "comment": "Malware payload (RedLineStealer)", "value": "bbe4b4a0aab75cfdeb067064f73e05d793d699247ecd0ec93ef576cc115baca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950286, "uuid": "cf90a956-1265-46b8-826a-706094c79c9e", "comment": "Malware payload (RedLineStealer)", "value": "b0ffd46a377bec331173ccb3cea7339fdece8152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950286, "uuid": "fb56710f-a667-47ed-9a67-bbde2aebdcfa", "comment": "Malware payload (RedLineStealer)", "value": "114a57b70faf012d15c6f5c85ad5588b656b897efe1ee54dcbd058bd49c7d2cadb423d502ef93eed444aeb0a21e38562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950286, "uuid": "ce970883-9b35-4f51-83a6-6df992a826fd", "value": "T1F7A5126217ED52C1F3B6AA32787D11A0C9277C50BC39C11E167A723D1FB29819F26B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950286, "uuid": "27fc23df-8776-4242-86f1-7f0423b6b59d", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950286, "uuid": "c0eb82e3-ecb8-4337-8330-87c86357deb4", "value": "49152:G4WU0C2otxU3Ara6t5NsKrOZRcGcn2PJ01XTD1toU4:G4Wo2obUmbUKrOt8oe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699950286, "uuid": "3da851f4-671a-40af-a324-6218c4abd150", "value": 2180264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699950286, "uuid": "c1e19a89-5249-4abd-9769-22c8dff5eac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950286, "uuid": "5f49c827-5d38-4603-bcaf-3ad94d2e4c76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b048c33d-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982678, "uuid": "7b659396-ccb6-4afa-b012-c2101e5548ef", "comment": "Malware payload", "value": "4e845392ed5922b15976ef87a30142a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982678, "uuid": "3b7ae08d-7848-4805-a14d-fb6b3f0c98bf", "comment": "Malware payload", "value": "bc60d6b0dd2558c683f2db24c79187f1c870e35deb4dd5586965f49e2d24de33", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982678, "uuid": "ac97e972-27fa-403f-8757-4b737da2df57", "comment": "Malware payload", "value": "5eaf5e2e091a94aa0e70aadda46d08970bb9efab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982678, "uuid": "928d21af-1835-4339-8438-a7d880cc53c1", "comment": "Malware payload", "value": "5417499145315f381739574ca107227795ba6353e111ca9b41322a8cf6730110ce8b63ff76cb44db4acb8a895177c64d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982678, "uuid": "8c11c0ab-77e0-48a7-864c-c384ea6533a8", "value": "T11C25DF5A3356CC8BCD3E2B70C9D3499965E7A9F14D0A06E723BCBE9F5CA55900823CB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982678, "uuid": "a768d427-716a-4885-99ea-f649a56619e7", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982678, "uuid": "1b581f6d-0ba4-41d1-b51e-fd43116b96ba", "value": "12288:+R5nWFpPoSVpHiXinD1A+aMd4QZYbbHth9GEPyGBtCHImXHbRHl2Ro3:Vb9iXI1jbRYbbpPyGDUHHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982678, "uuid": "05376c3b-c0c0-4011-b40a-3e904508d004", "value": 966600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982678, "uuid": "37e29841-e39e-473e-a3d0-d1d5077cd901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982678, "uuid": "e74bf198-db09-400f-9fae-7164501aa5fa", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.32720.11800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a4e8cb-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699964640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964640, "uuid": "55d3e66c-357b-4c1b-ac30-ce6ac1983eb4", "comment": "Malware payload (AgentTesla)", "value": "9c7a61ca0c7e8b1da1214a5355931ce6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964640, "uuid": "a76350b6-403f-4a49-87f4-85b73d7ca002", "comment": "Malware payload (AgentTesla)", "value": "c073d55e30e424b99d07e376c38ca35b579dbd327da6be96cec527b0e3132ccd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964640, "uuid": "a91b31d6-ba74-4575-8939-d84bcf319d4a", "comment": "Malware payload (AgentTesla)", "value": "b5a2f9b62944c93ec0abbc2d0aa307e14d85192c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964640, "uuid": "643dcc9a-e2b3-4ae7-9760-fdf7858bf357", "comment": "Malware payload (AgentTesla)", "value": "dae47a292df772b5864c54f4c87c8f8c6043d7e663f98a39f8140f8285e9a6bd93b2d775db68be7f71f76d8302053c14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964640, "uuid": "1bc733a8-e713-4ac1-bfe4-f4eed68271dc", "value": "T134C41218A7EBEB61D53E6739AA7427680F31B9466432F35E4ED040A93D337C09649F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964640, "uuid": "9b3f5c49-e2a8-4dbc-a9e3-e316f4c52ad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964640, "uuid": "62e9fb50-c0f9-497f-8490-e7622afc0bd4", "value": "12288:H0Veg9z9IgPKBLO4IYIbF3SYRi64hMPU25I:HAI8KBF2SY+hMPv5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964640, "uuid": "a4bd8066-4d84-4eae-8a89-5701ec1cc371", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964640, "uuid": "743808e5-9e0e-4871-9642-5dfbb23ac0e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964640, "uuid": "91c98c40-83c0-4699-8784-0b62aa6c4ace", "value": "PO-PO2723030194 Version 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8abb1a-82c9-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699951214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951214, "uuid": "b6709ec2-7e57-4779-880f-5eacfc3d1774", "comment": "Malware payload (MarsStealer)", "value": "88fdee8c7dcf1258e57c298c07fa6242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951214, "uuid": "07cf03bb-1f5e-4463-9867-8f3f835d7874", "comment": "Malware payload (MarsStealer)", "value": "c1463af12fd0e9bda5b5c94381ea22d82abd5d95008ffb77894c5be3c77e3bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951214, "uuid": "ae0b1e8a-6907-4788-9562-7c5530ef31a3", "comment": "Malware payload (MarsStealer)", "value": "926975a24a7ad80527cd5a4fd0a0f3ef5bce312b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951214, "uuid": "fda41615-5a54-4a3b-9397-bc3708fd969b", "comment": "Malware payload (MarsStealer)", "value": "944f7448b9b7837668859c730420f349cecfc7d1908bcf9b4e66d1dc6d87b523312ce9c685c0de5b42dc1e6eae33a318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951214, "uuid": "ffc95f15-bbae-4bee-bb4c-3756ff5b5b15", "value": "T12624BF22B7E6C072E177453489B2C2B65A3B78B29F6185CF27C05A7E1E216D2C73531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951214, "uuid": "a431ad96-78ea-4c24-aaec-213e355590dd", "value": "3cf8645c93eebd6a8066c6479eebf80f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951214, "uuid": "e3e342ba-a89e-4482-a86a-1a0516ebdc7b", "value": "3072:5aozciRhelgMhTl8TLOVCnRrnyT/y5LF/PMY6wt:LRh6BhTyvryT/qLF/iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699951214, "uuid": "2d05c5c4-d754-4ae8-ab99-9fa20ac0c655", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699951214, "uuid": "b0a4e0e4-2163-40d7-8779-dc7ec95a060d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951214, "uuid": "22297dd8-a788-45b9-bdf9-4686f5eaab20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d4e7a3-831a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699986174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986174, "uuid": "b8cf1e46-b327-4b1e-898d-10417d52d17b", "comment": "Malware payload", "value": "f14d9b8331659f7268bb9173b99addd7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986174, "uuid": "1952597b-cb9b-48cc-b048-08e35d2d26d4", "comment": "Malware payload", "value": "c29a303468ce5c3274902765deac7a76d4fa98c10657be06acd7d1a358341c93", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986174, "uuid": "83e50f94-8bf1-42b0-aeba-d64d4672b739", "comment": "Malware payload", "value": "a3edab82f363743538593c604584f851525aa96d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986174, "uuid": "9bda55d2-7de1-4a10-bcc2-d2637b8f3743", "comment": "Malware payload", "value": "5d997a83468646203a1e17b5ae583b623eb6f405ce259724d5661f185096dbe8c8a0e398694da8a760fde40636274ae1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986174, "uuid": "e8fc23d2-a32d-4b38-ab55-25674a158018", "value": "T16A459E2276C2C536D57F0670292DE77A016E7D200BB189EB53DC5A2E2FB25C19632F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986174, "uuid": "6f57d917-13f4-4b03-869c-accda2da8ad4", "value": "24576:Z1/YKztdfG8NQGafAdbe/IEFXsaV5C7eYVLsTPRDKeo:Z1/YefNQGoAhRaV5C77yPROe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699986174, "uuid": "6ae86b7d-c551-46c9-9303-e3f39be72b60", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699986174, "uuid": "01a0429f-8bd2-4c9e-bbd2-508c50e90799", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986174, "uuid": "659fd7e0-a26c-44cd-be84-a5d4b1e0cc3f", "value": "instalador.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e123b6b1-832a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699993068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993068, "uuid": "deefe39d-e92c-4958-a897-90d394248bfc", "comment": "Malware payload", "value": "3490825682c943930ac5b7bc1802db73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993068, "uuid": "e0bdf97a-3130-432d-aee1-a3684a6cd3f1", "comment": "Malware payload", "value": "c309b4f0f99e1686e9bc954da81701b3fd26cfccd17627cde55df929fb712311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993068, "uuid": "8e7d1d34-ba4b-42de-814b-fe16acd9362a", "comment": "Malware payload", "value": "b8d2ec816d3bb3aa32e37583e8fa28f8bed76829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993068, "uuid": "a61ad52b-651e-4222-8f7d-b5e6240cc742", "comment": "Malware payload", "value": "91133ddfc754744433527d01da8346d196fc8c7bdea66143a45151f8c8f5e157b6914c1db098873603484bd77e35c877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993068, "uuid": "1c5f4b72-b800-42ac-b5f4-77246ab554b2", "value": "T1CF272AC7F85150E4C1AED37486665222BA703C891B3027D72B60FEB92F36BD4AE79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993068, "uuid": "875bae5c-8faa-49a5-8b5f-c00cc402615d", "value": "b2e121c8fb86c781c89c83ffff7fe337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993068, "uuid": "3a7e41c8-943b-41ac-b4fa-78e2a7507a88", "value": "98304:IiI3SRwuT0qPay0fdOR6MohU9EPZcBZdMEr49Ai1Mp79HYonU73jIDp5qdh/u7q:/7T0PRodacBZLYFGG3MA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699993068, "uuid": "4740b473-aef1-48d9-ada5-dc3d41b9e4a9", "value": 20449792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699993068, "uuid": "2422a044-1979-4a78-b422-e96067c30dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993068, "uuid": "9606c25b-8712-4ac1-8423-8853f9e33525", "value": "SecuriteInfo.com.Win64.Malware-gen.29248.26001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75e9279-82ed-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1699966825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966825, "uuid": "1e9256e7-3175-46a7-870b-c802c870cdf1", "comment": "Malware payload (RecordBreaker)", "value": "7d57b9e5ff073b06d62cea316f77e6c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966825, "uuid": "562ded44-0ea4-4526-acff-b35983ff6a6f", "comment": "Malware payload (RecordBreaker)", "value": "c3ca3799150177eddce80d6eaf8905f29b02c31651f565a913690b83ba36a788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966825, "uuid": "a69318ed-9cd0-4b11-96a6-53cdb53625a8", "comment": "Malware payload (RecordBreaker)", "value": "4c278f1c0ca982da691ad5cf0e0bdf35df43398e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966825, "uuid": "a8cd9779-5114-488e-a9a2-44378afed4ea", "comment": "Malware payload (RecordBreaker)", "value": "537f3f22f7812a08223247ebb8df368ada4ba4fc51e99f4478be56034cd427df547084c65faaa2dc288411debdf00554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966825, "uuid": "24750a9a-6e86-4127-b4cd-953311c51b4d", "value": "T1A4452313A9F85172DAB123308DFB03D31B39FD215A7447AF27866A1E5D72790293272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966825, "uuid": "02527b85-545b-4a8c-8d9a-f04411035b64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966825, "uuid": "5ada565f-208b-4d30-8ec8-91818d58d7ca", "value": "24576:xyjZtJ0RMymoUv1LUyJXL3YXYDjduCDZZMwPs3:kjZz0ePoUvKoLSipDZZMwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699966825, "uuid": "17b98fa9-e3fd-42a2-8df3-47f683a18934", "value": 1268736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699966825, "uuid": "1906737a-3e8f-4ae6-bb95-927875b95d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966825, "uuid": "0047ab09-c433-4014-88c2-b7cf28828480", "value": "7d57b9e5ff073b06d62cea316f77e6c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadb1d5f-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982723, "uuid": "4fa61b83-21a5-4b34-9c0d-488ab0b45fa4", "comment": "Malware payload", "value": "95e58d96c1ce17bcd4a2ad748a95bed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982723, "uuid": "c6c72a46-2fea-4164-8751-caeb9b8e750b", "comment": "Malware payload", "value": "c3efd2ad3d87e34d909c43790872b69e41232c05d8d498d1e1ee6c928573a33e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982723, "uuid": "fec8ff89-c345-4284-a7b0-1df4b0e182cd", "comment": "Malware payload", "value": "62e1dd80b48d7e81a027abbe411ced2a2cced6ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982723, "uuid": "c862c768-b1b1-4463-a3c8-d2d4d5d03c01", "comment": "Malware payload", "value": "1ce1b092d13c15eebf26c1e0c5b3ebb563d92e9f59684902dff9dbf62a02702fba104772ee2d49c985e509dfa912c988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982723, "uuid": "dc8a66fc-1ee9-4a38-9f87-470f267b1e1c", "value": "T14F5502053B69F862C0497D340E5ADAD49B52FC1ACEB0C68F77D1FF4E2E31290AE66461", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982723, "uuid": "f76bbab4-5eb2-4d21-9f4c-317e594eddd0", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982723, "uuid": "118eac92-453a-4412-8d72-b979d4599d0f", "value": "24576:mEADx1s1UL2YDR29B1YQAMpIma5YGBirei7nRWdR7Icl4AVGlJ5ClBabPz:CDg1RpAMpIma5kqp/IIdhO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982723, "uuid": "7ffd3ac1-6597-408e-a7d0-50c144040893", "value": 1380955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982723, "uuid": "82c14bdf-e509-4b65-b3c0-a73d4afdb231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982723, "uuid": "e39b4a2e-70b7-4311-91da-6642ef6a9730", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.10660.32599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72aa48ff-82ae-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1699939625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699939625, "uuid": "288831c1-8a42-4b5d-b44f-a82d158a220d", "comment": "Malware payload (CoinMiner)", "value": "dc9fa52171eb0944c00164c6a046cb58", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699939625, "uuid": "6fc3321c-b32c-4843-b648-98018d2bf567", "comment": "Malware payload (CoinMiner)", "value": "c46aadd00d3a7b81a3910703cd109b86ec1d52cc08493a9d3ac757ec55046010", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699939625, "uuid": "28b1cd12-e7e4-45e1-b4ed-42b5768ece46", "comment": "Malware payload (CoinMiner)", "value": "b55cbc8422b4cc006fe47675b7d1b67cc02657e8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699939625, "uuid": "4c267c4d-b2a2-465a-aacc-e5d5d293dcda", "comment": "Malware payload (CoinMiner)", "value": "6b6aaaf58fefe89b25dddf85518f24af8233d1c0dff4058ef0f3a91663732db0c843264e0226c8afefdb4f024bb95df9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699939625, "uuid": "39f16a67-b3ee-438f-a1f8-46cbf81c547e", "value": "T1E871BD5BA710D1F5F694F3B423276D0BA1E8E6B245BA89B874CBE1C9F71004462B17B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699939625, "uuid": "d6611912-4642-4d7b-9719-ea35c3652dcd", "value": "24:mfk0EdeH3KdhY5R7z0w2lQB/8E24roudT5BadhBaovlEM6NQXE4qclsJzBlhEznT:x0h3GGzJ8Usud0Rv5XEBcyJcQ1El", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699939625, "uuid": "1bcaf252-e17b-42d6-8f57-d8f6e2cd54d0", "value": 3558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699939625, "uuid": "9df82757-80a5-486d-b500-589acbf69e5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699939625, "uuid": "d0542099-0266-4cf5-b1ef-317610f84557", "value": "H.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757aa5fd-82d3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699955521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955521, "uuid": "a3714205-2669-4c68-baac-8b841a234b96", "comment": "Malware payload (AgentTesla)", "value": "2edceba4762254a2d8f08284a2264c24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955521, "uuid": "176a667d-7f58-4728-99ab-23c968435891", "comment": "Malware payload (AgentTesla)", "value": "c49d3c572cd0b818ced382d46198cd833015f79459b10e2cb4caee1bd18f5e72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955521, "uuid": "2a06b7cb-2d33-431c-8f45-cf64c82a8853", "comment": "Malware payload (AgentTesla)", "value": "dfada5e6cc8caa5eddc70d821732ea0b836f1ffc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955521, "uuid": "d417db3d-119f-4f79-bf37-7cfdc40d5e3a", "comment": "Malware payload (AgentTesla)", "value": "98cbf7f756112feeaf485126aab868a5260c3c81c3506cca33c15adbf238afccd2d5c22d5c9376f27f5ffabef5c6f17a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955521, "uuid": "02886f5c-85c0-4091-a469-1f586acf7ce5", "value": "T11405CE85E94566A0ED299B716A36CD3453237DBDA870E41C28DE3E773BFB7A31021063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955521, "uuid": "41e56b08-ca50-461c-b190-498fac52e45c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955521, "uuid": "6757e0e3-7012-4afb-b0d1-19b76e387b18", "value": "12288:r1AFnSQavkzfDjaV0TkyUz9TM0nLq6WpXsBZL0dGP7r9r/+ppppppppppppppppF:JqSQ9zfXaV00ztMl6W6BZLqG1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699955521, "uuid": "b48290e8-54b4-4461-8457-d7102a49958a", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699955521, "uuid": "a021da2d-ed86-4ce3-a1bd-8f457fa0eb59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955521, "uuid": "318b0cc1-4bfc-472b-8630-10d9e0601cbc", "value": "payment confirmation\u202efdp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce724211-8329-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1699992607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992607, "uuid": "5f32ac5f-5f44-45d7-974d-55554c206b1b", "comment": "Malware payload (Loki)", "value": "a1338b561919f20324ad8ddea5093780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992607, "uuid": "34291770-85b1-4071-a940-0cd5911ccc7a", "comment": "Malware payload (Loki)", "value": "c6a124887bee7710a6bfebbc4af9a094cab70e3b82e2bf82a2c75b96424b6142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992607, "uuid": "6795fe24-1cf3-4ce1-8299-44cd0464aac7", "comment": "Malware payload (Loki)", "value": "be2b4cadd4666194b922cc8c5992088b46bc8c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699992607, "uuid": "b60d74df-d8ef-4f53-9d20-47ab6405bee6", "comment": "Malware payload (Loki)", "value": "edc740abc62b99099fecf9a6475c52f3c9f7523bedc9a01081459e0ce1ad617e4feed02672b682515de3d13dab724766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992607, "uuid": "01a89676-db5a-46cc-b32f-aae44f874681", "value": "T178C4F12233744827D73E02F5A02654A41BB5FE12F520E39D5DA37BEE1BF6B9187006A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992607, "uuid": "e4b3d4fb-76b6-48a9-85b7-fab6972836a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992607, "uuid": "d3e40887-687a-4cf1-b9aa-2383d2879214", "value": "12288:VJX4QtLaBlPA7QODwWXGq5Ewm9mN9a1tnwNqVlh1jH3BlN:wwZ5Teh1twNqVlfXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699992607, "uuid": "092b5d68-eb3c-4fc6-b03c-f052ff7ea265", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699992607, "uuid": "2ab64c17-7738-4e97-94ae-a8211d06c8df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699992607, "uuid": "5143512f-28c5-4330-9ef7-c508a9dd70a1", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88dc3e3-82a6-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1699936387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936387, "uuid": "106b7342-1bba-4b43-a314-08fe26120116", "comment": "Malware payload (RaccoonStealer)", "value": "2ee11cec1aada0b6967ac085a7c9899b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936387, "uuid": "98c31816-7064-4c4c-a8b6-cb033448f384", "comment": "Malware payload (RaccoonStealer)", "value": "c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936387, "uuid": "c579b709-8656-471f-996f-aa0a8bac88a4", "comment": "Malware payload (RaccoonStealer)", "value": "41f55e5332de55f0542e615b5ef9ace172339625", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699936387, "uuid": "ded470c4-257c-4bd6-8815-dcff53670164", "comment": "Malware payload (RaccoonStealer)", "value": "7a546e67cd4fa63a8179e864e20ee7d6c06eab6a7564e57686c81f48771e125fa1e5b9b4014f0d08efc6e93506dc9aed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936387, "uuid": "e275a0fd-72bc-439d-b8a1-88c9bfd01a20", "value": "T1E38319C054B54506E090A87303C2D93A969AED3E19177D83F389E663816DDC32DBF7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936387, "uuid": "59005635-d7c5-4a46-8f55-bcbdd0164472", "value": "52fcc5c1bcda70fa4759c08995c5a5fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936387, "uuid": "601be8c0-8c64-4744-bc92-49cffc3a82c6", "value": "1536:WRLNQIfcBuof7xJPYuPfwO3dL7C5aq5v+E/LtRWIOQA3zMo7BlQdH:KLN3Iuof7TY44O3dL71KRRzOvjfsdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699936387, "uuid": "fcf99e93-7f5d-423f-bf3a-063400951993", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699936387, "uuid": "7544e164-6a6f-461a-bf41-6b81a63951f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699936387, "uuid": "532c1dbc-1be8-44ad-a28a-63cf752cf5b3", "value": "2ee11cec1aada0b6967ac085a7c9899b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65db01a8-82d9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699958072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699958072, "uuid": "1be73b00-7c76-401c-9eb9-e8330d8acaf1", "comment": "Malware payload (AgentTesla)", "value": "897c78d5b9c1bf368fbfbb4f33c9caaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699958072, "uuid": "a224977f-4ff4-4f32-ba2b-e11f91e4e991", "comment": "Malware payload (AgentTesla)", "value": "c804d3785acf26364471c13ee7b8714bce6329666877dff5541252ae0613af55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699958072, "uuid": "8811ae5e-26a3-4e21-af23-eeb4e58364c7", "comment": "Malware payload (AgentTesla)", "value": "3e24e1c61d6a3cd237af4080ab5592a178cb5373", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699958072, "uuid": "30ed4dcf-e8c5-4f49-bc3d-34033ee62e62", "comment": "Malware payload (AgentTesla)", "value": "a2d5fb47fb57430daaf4f04c9d767de8c068517262888a61b54261e1e92be6eb98913b8163f0db5f25cdffa0b40b12cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699958072, "uuid": "6248e4ef-3132-4164-a17b-8502146035da", "value": "T181152344B5F8BB36D0BC4BF556381A640379E16B7850D38D8CC838C73A67F960916BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699958072, "uuid": "e9825683-8f4d-4d88-a857-a7432e51e899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699958072, "uuid": "4a677822-2222-4134-953c-d60efaf7bf4d", "value": "24576:HKtA9V2+7m7Xuhux7ec37unKoihobbJnnLqS:HKtA9V2qmau6yeKFobb4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699958072, "uuid": "6b583446-6b1d-4b9b-b087-21b62f07560f", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699958072, "uuid": "d831011d-1cce-4a48-a6b8-ac2757a8edcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699958072, "uuid": "5412461b-7c9c-45b0-b849-beecb50b00e3", "value": "PO..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f396bf81-82d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699957451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957451, "uuid": "198ba7e9-0750-4b45-be90-9bf4048b4e22", "comment": "Malware payload", "value": "12b15de842a3000fdcf2baa560c5f13f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957451, "uuid": "21ce0f9a-f2af-45a1-a245-d00ca65bf536", "comment": "Malware payload", "value": "c9a332638e2409f1b8366c9f4ede9b939540c367eab9eba3aa2f935ad74c2a9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957451, "uuid": "0ffbdac5-36be-499f-b6ba-8787399e4c5b", "comment": "Malware payload", "value": "edb9cf7a9f09be18dc179cdb575fbf1b2a429a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957451, "uuid": "0b210a6c-2a5a-47b2-9bd2-9b081796b6ad", "comment": "Malware payload", "value": "41488d413c7ae8ee12aff992f57ebd97b74545c546f88b8aa8ee6c985ddc4479dce67dde19db089cbf03f444d0ccf40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957451, "uuid": "73a173c3-b5c9-4e75-88ee-13e94a146509", "value": "T1F3A63B87FCE741A5D8A6D3B088614122B9317C5C0B6973DB1B61BB242F327F49EB6B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957451, "uuid": "e8d6c417-1612-4f2b-8d94-a0da21cd9f22", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957451, "uuid": "27e752cf-09a1-42c2-950d-97b1c111c162", "value": "98304:D6PXZ7AlWmNtonQTthVi5ATqNzGQjSVFEwkG98fpqp:WZLmzonQ5i5ATqNzGQjY2wki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699957451, "uuid": "97a3e32a-e650-478d-b3d7-cbcee9c00345", "value": 9647616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699957451, "uuid": "1698e5df-3b0b-4896-ae12-0108ab30f509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957451, "uuid": "0daf1b25-d0c7-4eaf-b82e-5a8a315d2dfb", "value": "SecuriteInfo.com.Win64.MalwareX-gen.5025.30686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc262d4-82e4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699962942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962942, "uuid": "8404b17b-08c3-4b62-adc3-f17608256618", "comment": "Malware payload (RedLineStealer)", "value": "d7330b5bf5d11776b9e85f164ed4dbac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962942, "uuid": "59022af1-a09a-40b0-ae10-3365f236cd6c", "comment": "Malware payload (RedLineStealer)", "value": "c9c5798e7a3d4bd33f48a62c21591a50d890d25d509aa359798720ea4ba3fb14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962942, "uuid": "5e8d2946-fc42-4ae0-a1ae-4f6d873a9fb6", "comment": "Malware payload (RedLineStealer)", "value": "015c901c53b25b57dcc87b3717ee551bc8e20d77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699962942, "uuid": "8c68e217-cda6-4133-98ca-b75dd8f9e642", "comment": "Malware payload (RedLineStealer)", "value": "a378ef9d1200580074ba29a18a11f60468f27e3d4d03c7d6d04d7c736fb70b9d7440229f3db26ca2cea5789abb6ae578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962942, "uuid": "53b37d0f-37e6-4b9f-b4f6-9292e4d51253", "value": "T1BF652362E7E54436ED722FB046FA03D31B347D91A879E7B63304AA8B0C71BA45225737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962942, "uuid": "839df913-c564-45e6-99b8-60cb162bde7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962942, "uuid": "d295f404-cb5d-4421-b23c-5394087f89d3", "value": "24576:vy4U3y8WzlCuqdxiatvvNgx9S7cceR3JYeLZk7dLdAgPe5shtj5uTmBeiz:64aazUuUiat3FwZ9vdkFOg/tluT+ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699962942, "uuid": "748e6770-c04a-475d-b31d-e067c64910a2", "value": 1438208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699962942, "uuid": "1179d5a0-d79f-426e-937e-03c338415319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699962942, "uuid": "1635e84a-5861-4a5d-877b-7c654761bb19", "value": "d7330b5bf5d11776b9e85f164ed4dbac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863ff637-830e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699980890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699980890, "uuid": "fcbea41f-b7de-4bed-914a-2b20f83eaba6", "comment": "Malware payload", "value": "f746a85c5421c9f55befe9d69c3cd183", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699980890, "uuid": "e9033303-48f0-4837-ad91-ad6f079cad18", "comment": "Malware payload", "value": "ca4a43510da2087936b6a7aa6790d506f4aba6b1ff1f1d9fcc8fcba37fb47749", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699980890, "uuid": "2de59f85-d3ef-46f8-819e-c853d1157bac", "comment": "Malware payload", "value": "5b17db6435022142944b1b5bbecca88543f227c2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699980890, "uuid": "2bf0a8ce-89f1-4783-847c-abcde2b522bb", "comment": "Malware payload", "value": "0d96a7a85b5f852a55663d93cff032338beed8901fb710686448fdfa6e7bdd4758b34034deb92df5aaa7aae1e5fbba40", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699980890, "uuid": "16a471f6-7ae7-461c-b9e8-aac0c3af046e", "value": "T128659D1076D6C036C4BE05703A6ED76B157EBE700BB188EB63D81A2E1EB15C25632F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699980890, "uuid": "c2fa6271-9fb9-4f98-ace0-609d5f04d27a", "value": "24576:zBC0NC63vosTi0cNOAqJAkMpYkgztdfG8NQGa2AbIvn9pBo5MTGq5YVJrTsgsFHS:NCLCvosTi0sOAZnWk0fNQGRAbIv/Boak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699980890, "uuid": "9319b8a8-fe12-4d8e-8dee-0af270468fd4", "value": 1429504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699980890, "uuid": "2b989964-19d6-467f-adc9-b38d3fb19e60", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699980890, "uuid": "0e0be86e-212e-4238-84c1-6d8439302d9d", "value": "nf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d0eb29-82c8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699950670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950670, "uuid": "f13bb0ad-3292-4701-83b0-40407dda090a", "comment": "Malware payload (AgentTesla)", "value": "b583c024aab6bf4efea7b56e2d018abe", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950670, "uuid": "2a650da3-f06f-4815-9c21-79ece6f7732e", "comment": "Malware payload (AgentTesla)", "value": "caeb162a67c1946c9234161ea37cc50fa5956fce5a3296ef36b7f9a6ba68f889", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950670, "uuid": "b039596c-cf40-49ee-8fa0-ccef078d7b91", "comment": "Malware payload (AgentTesla)", "value": "5c08b63ceb667f5789eb3badaeb380406b4804f0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699950670, "uuid": "4a12fbb8-eb77-4f80-9d30-bc596dcb432a", "comment": "Malware payload (AgentTesla)", "value": "a57391f451cbaba80ed05d3a859cdc79a411c74f2737d4a9a14fbdb646564e4680bccdccb4915eb4fd0a0894d339f5a5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950670, "uuid": "ac26b7b1-5c53-4216-baf8-b34c5adbfcd7", "value": "T1C8E423B26F86F128A021A0764D847B4D7529003D96688D2FEFFF0ED22ED7BF95854247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950670, "uuid": "066a494f-e608-439e-a072-378cc88916fd", "value": "12288:mLpCqP9P1feS5m3Hyc1adApM+PxE55p6XBqbrDQEozO8hR9FUtoO4fZVkdbL6uMH:mQ3Sc10CJMK0brD5uRktT4fD+nqBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699950670, "uuid": "69ca8549-e5d9-4ebb-94f0-84ceed8e089a", "value": 658191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699950670, "uuid": "a5119866-a54d-4b0a-9b27-82d89b22c466", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699950670, "uuid": "743767d2-0be8-418e-96e4-c00656155d66", "value": "PDA bank slip.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae717c9e-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699964636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964636, "uuid": "ff41b290-d36a-4526-9b85-33328e61b87f", "comment": "Malware payload (AgentTesla)", "value": "4e0bacb1239a843bcbc3e9f182a5c045", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964636, "uuid": "2766f2c9-ea15-4b1c-be44-6d329f7cadb4", "comment": "Malware payload (AgentTesla)", "value": "cb15630de2fc38b0f07691ab16cfebcc1a6a940c867c0fc41a811c26525d9fc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964636, "uuid": "fe1c280f-9ce6-467a-935c-637f0a186745", "comment": "Malware payload (AgentTesla)", "value": "4662dae2ea1542447434616ccc609fc8ef87d73b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964636, "uuid": "10d9f0dd-43d5-4c0d-be6c-af00b6a5085f", "comment": "Malware payload (AgentTesla)", "value": "c348b7b153e5b86398b8fc9495c439416b870be4a127a24b24891db5bea81bc55cf61d06d3d2177a4fca10555e22fdf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964636, "uuid": "efbace87-eb5e-47ab-a52f-753ec1fdfb82", "value": "T114C66C90D2F1A59DE8DA85368E6063F8B27298237713E3D5CD18E911783D3EB8EC4563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964636, "uuid": "f16a6d85-75b0-42eb-9dbc-46edb5091f0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964636, "uuid": "66ed2aab-ff92-4618-aa1f-d99cb2e9d427", "value": "98304:JmjrwUzdnYr4qzJVAf2t4T3Gkn2CaVkkF3TgJ9FjgmDvw20gQ5sfYv+Tbmbj19cV:J0rwUBYrDzJVAf2t4T3GokFcamjBk8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964636, "uuid": "464c595f-9456-428d-af26-e5cda8ef4bb2", "value": 12166656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964636, "uuid": "842048a5-cdc2-461e-af88-5534387627c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964636, "uuid": "158be957-0a41-4aa1-8c9b-91103613031b", "value": "PO31100045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a54254-831b-11ee-8907-42010a9c0042", "comment": "Malware payload (CobaltStrike)", "timestamp": 1699986628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986628, "uuid": "3094697d-a960-4330-a08e-95a94ad7b13d", "comment": "Malware payload (CobaltStrike)", "value": "b868434f63e755cde6c30c9ca7fc37c0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986628, "uuid": "1c5c1d0b-629e-48d2-bda5-de47bb96a0f3", "comment": "Malware payload (CobaltStrike)", "value": "ccd3670ca8758d4f9ac1cd1642ae94348a325b8836716c0c2195c56ed065d714", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986628, "uuid": "a654ad02-0e0d-43c7-9014-b984f0176314", "comment": "Malware payload (CobaltStrike)", "value": "7dcb6bb334f0465da4d48b99873d9c54c709e848", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986628, "uuid": "14b1d071-df28-4d9b-9418-78f5fa85c19a", "comment": "Malware payload (CobaltStrike)", "value": "46fb7800aea9c58021da298d9f76b142797aeed0ebf7520a5e802854ed67ed2724021e222651b6ab6d786a86723425d3", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986628, "uuid": "0e393630-98c4-4d46-839d-9c489253b889", "value": "T13192E97FE31368E9C106D57845FF7773DCB13DB285A6932E2734D2B42E105A42EAAA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986628, "uuid": "4a1e1c21-c46e-46c0-81a8-5cd92ab57cbd", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986628, "uuid": "07b3a1ef-d243-43de-8ed8-08b7a5395399", "value": "192:gV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/20jwqWF8qa1Dojjgi:CqaCF31cix+Dc4zjJczFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699986628, "uuid": "88bbdc2b-f84b-4fb0-a494-315f86312840", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699986628, "uuid": "3032bb4b-84e9-4222-bc7e-5a3dea5ea6ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986628, "uuid": "e9deee58-c432-4415-979b-14bcbbd3e819", "value": "b868434f63e755cde6c30c9ca7fc37c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5aa9d0f-82f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699971950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971950, "uuid": "8ad290a4-2d77-4d1e-8467-74b978e024b5", "comment": "Malware payload", "value": "2ef4b462085b76741fc850024b75f539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971950, "uuid": "1b49554a-b8f9-43f6-97ca-a0ff13ff4bee", "comment": "Malware payload", "value": "cdd3fc19ff6129cd6a4ce32c48a2eceb0ed91e3f129e6f660bcfcebeac1296bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971950, "uuid": "71b57180-3fb2-435f-bcc5-b367f15f19e7", "comment": "Malware payload", "value": "328d8dbfac41b38efd029f5bf498ef8861741ceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699971950, "uuid": "1bbe3b7b-0ed1-4baf-b947-28e8540d0a2d", "comment": "Malware payload", "value": "a28260845953984c22e7722983f87d66e93c8346aacc9975fc54489b91f748a3a90b8dbd951ac623417e03ae14a4858d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971950, "uuid": "19c4f3de-aafd-4e0e-9e81-0be791642067", "value": "T19E944B44FEF34075CD6B5931CD9ED2796C3D28180B76EDAFE6A01E1C5BAE281D1B2602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971950, "uuid": "6ec3d72b-ab17-4869-933c-265d9209f8e0", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971950, "uuid": "2e8d1534-b4e7-4883-b0f7-d874966864be", "value": "6144:NyUnkAlR2SaOmUPvbeAOaTdE5H58+tjUJMrC14T2mPokQ1LWnij+IAl:7nkaR2Vkel8+tjU4T2mPoXinij+Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699971950, "uuid": "989f38ad-4886-4551-b59a-e33ed5787ca1", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699971950, "uuid": "655cc95d-465b-48ed-8bad-21d7897eb002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699971950, "uuid": "380d0484-4244-42b3-adc5-1119aefebf4c", "value": "SecuriteInfo.com.Win.Trojan.Stealerc-10014035-0.25106.25166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120a493c-82d7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699957072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957072, "uuid": "ef194150-4cb7-47cf-9d86-49bc30bada7b", "comment": "Malware payload (AgentTesla)", "value": "4ecac8d5da007a34f0e35629960a1315", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957072, "uuid": "63c50659-440f-4202-b6a5-46596e10e541", "comment": "Malware payload (AgentTesla)", "value": "ceb734f8c9859a740dc419596343529552f55f8956790a001b33850ca5150c35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957072, "uuid": "102db4be-612f-4caf-b0fc-404d64257bfd", "comment": "Malware payload (AgentTesla)", "value": "044e2e76ffa91ec24fe43175aad648e1b0a459d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957072, "uuid": "d0548d0b-b725-46f4-a3be-ebb689972a3a", "comment": "Malware payload (AgentTesla)", "value": "11002d104de38a9881f3735caee739e67620dae2e004cc0559703f4bb7657c7c39e83f4a5663770eca04f37dd9948824", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957072, "uuid": "472ef3d8-a126-48ce-9692-a2239f89bedc", "value": "T151C42319640CC794BABFC53B77F116FBBC22E7E71A12AE0269CDC159A654293C087473", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957072, "uuid": "c1072856-a652-47d2-b396-929158c5f8ce", "value": "6144:ZYuZgIvW5m1ALtU2NFm6sgOPTglEfNz+RYiRjRtom5vyj+/XDNDe/3jvF:Cogq1usgOPYEVz+66rdCGXDRU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699957072, "uuid": "ec93d488-bc5b-4fd8-b838-8e9aa78c9e05", "value": 566278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699957072, "uuid": "9f82d259-cd22-446a-a85c-d2283bf21060", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957072, "uuid": "4c9ac63e-c533-49e6-af13-fd645567d367", "value": "RFQ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa430b1-82e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699961551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961551, "uuid": "5ca9ff6c-b216-430d-bfea-f0ec5c4ae560", "comment": "Malware payload", "value": "19e331c85de973881a51c176ec1e5f89", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961551, "uuid": "2e9cf4c3-21a7-43d7-aee7-485fa1d16419", "comment": "Malware payload", "value": "d1fc6f72efcb3534ded2e3b870fa01ab945babf2b30d3505573f9f6bb81979eb", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961551, "uuid": "48c2c3e4-0ba1-43ef-b02f-536d7679b24a", "comment": "Malware payload", "value": "43b90a1d3742b4eaaaacc4c21b89c5ac07e1db1c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961551, "uuid": "6f81a951-589f-476b-b5f6-7a41d19c4117", "comment": "Malware payload", "value": "c235e27362ef460679442cfd7bde48689109f729c25e3546c10c4c10f67b0663b9fc04bc96bd186ad56faec6f72f365f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961551, "uuid": "cf30b89f-6b28-4995-a778-afba04b501fb", "value": "T185B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961551, "uuid": "31780c3d-cd65-49fc-b009-77be5714c8ee", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961551, "uuid": "5a08b74e-db23-4050-b86c-3b6298e1ddd7", "value": "6144:NexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O74pUlLaEx:NeZeWSpda70ADIgSoxgUW/zFun7OYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699961551, "uuid": "66ac3f2f-f331-431c-b25d-b13c247f2019", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699961551, "uuid": "ba576a40-f0f8-4509-8aa9-c68a009a78d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961551, "uuid": "e6e9eaec-a5d3-46e5-8711-7b538090834a", "value": "notificaz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bae9e2-82ea-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699965418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965418, "uuid": "99e9024a-04be-4ba0-be3f-63d732ab0f6b", "comment": "Malware payload (Formbook)", "value": "ed9b4cfffe81db84f78eccdc9ba2de08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965418, "uuid": "9be04518-577d-4cdb-9ebc-a697029bfbb6", "comment": "Malware payload (Formbook)", "value": "d2799bffc4e285fb9472cdf9e68b4637288c44cd7ed7d5ff7680228c63d525b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965418, "uuid": "f24e7e84-f021-41ab-b272-fd67a4696673", "comment": "Malware payload (Formbook)", "value": "d5d12e3eece9cdf2c0bdc5245bba522715cb6ef7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699965418, "uuid": "36848f02-c922-43a3-98b3-43bf05dab4a9", "comment": "Malware payload (Formbook)", "value": "8c2c7ab7e11bfa21c285fe739fc262e8b8faf3102e13d079512c3714d7dc2bc0ecd14ad38f96f3ba8b291f03cdb0abd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965418, "uuid": "d03224e5-076f-4805-bd45-53057641f987", "value": "T11BE423012F5EA731FBBD83BA153911F013B3B11B6075FA1CECE3A6D54A4AB1A05C196B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965418, "uuid": "b9e95a39-b2b8-400d-9abb-6c3f7d744320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965418, "uuid": "f661ecd4-e451-4df2-b0f8-f98ecd6d302c", "value": "12288:H4AFnS2cHZL4mlAHmGZ7ujde6HrD75v+zG2HmvjBlaFjQhQrajzT7wjx:YqS3U396dNr/YzGsyjIFcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699965418, "uuid": "cd1b87d3-23aa-4205-83d9-53c50abec7ac", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699965418, "uuid": "f7955c51-ea6e-47e2-84ce-2a1d715ce638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699965418, "uuid": "a755d84d-7a38-49c6-8b26-9cac14f0bce7", "value": "8YR4efs2RpFwopI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8d8ded-831a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699986078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986078, "uuid": "fb301bbd-fa69-4ac5-8ac6-c38e677d7698", "comment": "Malware payload", "value": "63f28f4cf51df1b54f428e7802896eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986078, "uuid": "31f09107-c285-4587-b0c0-8ffd41196425", "comment": "Malware payload", "value": "d2a5bffc667647e9ba8a0d1733f9a27df01af72b9dbc7193031aad4c8853c6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986078, "uuid": "16a9d55f-4a97-408b-b03b-f55021a71ff0", "comment": "Malware payload", "value": "5fbb5439204697e9862787ae97836f52f92606e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699986078, "uuid": "95b645c6-5e80-470f-820f-75f18a3096be", "comment": "Malware payload", "value": "1c3751676bacc2c3d986eed00d6a7a949ebbd92678f2839dbcb4b67da13db7c852b89732282ff31d259d46f184a88e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986078, "uuid": "10078721-8aec-47f0-8be6-207b7a177c7f", "value": "T17A14D02277E5C071F22344344AB2C671AB37BCA24BA2D9CF27C41BAA5D352D1DB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986078, "uuid": "df959808-3f1a-4e66-bc09-d06a73390c66", "value": "ba186f9708e8f42f44c50313fb8ee602", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986078, "uuid": "7e7bd479-6bf6-44ee-874e-350052d55796", "value": "3072:hW7BjeTrykiRvB/Kf0Lt2P3hCYTjht+X32Xb87+VFdVgc:EKqkil72ZCYTFt+n2XbtV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699986078, "uuid": "1a59c1a2-dca5-48eb-bf79-dbe101ceca70", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699986078, "uuid": "f6adab28-5c70-482a-80c6-002ede785c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699986078, "uuid": "db88b262-c4e4-41ab-ac5c-e3423bfe1323", "value": "SecuriteInfo.com.Trojan-Ransom.StopCrypt.20113.22578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b725e93-8326-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699991045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699991045, "uuid": "86626c0e-877d-4265-b076-51d3e88ffd2e", "comment": "Malware payload", "value": "f108227d38726fe1d83281f8c3a6acd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699991045, "uuid": "7425c9ab-ac98-4239-aa09-79d80b06deef", "comment": "Malware payload", "value": "d2c19e15edee855176d5dbf18b19833779e009573573b419c0513e3cf82e6650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699991045, "uuid": "4cf5a0c3-58c2-4a27-8362-24fd09e0f8d9", "comment": "Malware payload", "value": "00d1693cc5ce29e97e1dfe598a6803b1066cbf10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699991045, "uuid": "0944238d-4e6f-4091-867f-7b1535c3cd26", "comment": "Malware payload", "value": "069087fc2ffae7ae9c267c98a9f103d196174c8654969c04a94c0b86cd31b486eb41a33cd48a59652286ac7d8400bf51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699991045, "uuid": "28a78279-938a-4732-b02b-41d3bed33389", "value": "T16E8429F12FA66EB3C183F7758B6A6854503219536D2B701838BB0E342533798FA59C7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699991045, "uuid": "8d90b051-29b4-4cc3-b225-cdf6dfe8808d", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699991045, "uuid": "bb17c212-301d-44a8-a2fa-1cd84bc408ba", "value": "6144:Bx+TY8UHBfSZ8lBNRT0/dolaDA3thSAlS81Dd4WQ+7SpI9EP8krErwaX:B8Y1UEt4ODdLNIi1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699991045, "uuid": "c9b45cca-eadd-407c-8a4e-d6df04ea6522", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699991045, "uuid": "b7518f09-d949-4f5c-97c9-fcbeb04dd75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699991045, "uuid": "6fd4d939-1580-42a4-ad71-505616c017b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6ad5dc-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699964421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964421, "uuid": "86a0f035-9f2a-4204-b699-34fb1d7266b7", "comment": "Malware payload (RedLineStealer)", "value": "78c6f20eed2f7f7aa2d279d1db9ac535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964421, "uuid": "3c288e17-1343-43cc-8388-96224ae74637", "comment": "Malware payload (RedLineStealer)", "value": "d2df430d281ad78bc0690d63df9896fe195e2df53f2e9182c6f459094f70aa45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964421, "uuid": "04edfad0-1e68-421e-87b1-f0fb4e08dd20", "comment": "Malware payload (RedLineStealer)", "value": "aee26a4d63ce255f7d3d8c2a0946b0b747ec15a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964421, "uuid": "125feb8e-3620-4324-8bf4-82c9237daf75", "comment": "Malware payload (RedLineStealer)", "value": "3bc60a2a5c89ae1ddd7307d59009f9b7955c775be4c6eba2d9f4672907b587ceaf22df45cb50024e1ba3e38616708a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964421, "uuid": "3c184386-59d5-4362-99c9-0fef2ceda2f9", "value": "T1AE54D4F4EAE4BC75E0100432B416823DB5E3AF86DDAC445AF2EFE50867322C665E5D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964421, "uuid": "006b30ff-3035-4b94-b5df-6784d03179ef", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964421, "uuid": "74858570-2539-4e45-a1cf-27e3a0ec48d4", "value": "6144:YZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy6Zdshri2f:GANwRo+mv8QD4+0V16ZdshF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964421, "uuid": "353ada3b-8b64-4766-b33f-dec0597ee233", "value": 282766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964421, "uuid": "62d1938c-2b44-4be3-9906-e437a8d4791c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964421, "uuid": "ee0e39ed-8f2e-4e10-9f6f-fb543c7ba38a", "value": "78C6F20EED2F7F7AA2D279D1DB9AC535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7a2bd9-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982697, "uuid": "c2b435a4-24b6-40de-a295-e48a1b8d1331", "comment": "Malware payload", "value": "c614eeeba2ea73c5d8c99c4b71f7ce30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982697, "uuid": "d78b9ff3-a10c-420a-ae5c-cbd0845af6cd", "comment": "Malware payload", "value": "d363c2dc7eadf1fbfc9bee1983f948677d4495ec13682c6298cfc8647fa47b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982697, "uuid": "605f9ec0-cf59-4671-ac8f-1bf80bb399f1", "comment": "Malware payload", "value": "f02dba3b0424fac5e7d753ee7770305550802b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982697, "uuid": "a9deb6ee-850b-4eb9-8203-0fee92e35557", "comment": "Malware payload", "value": "f65f9af6a7843ff2c8c0456c46af1888e6c2ca0c57eee3ccdc60a21fef47f6a57f428edf0227f22c0f4685eb09975541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982697, "uuid": "b7c47b09-e720-4b65-931b-3bf7245be763", "value": "T1EE357D637284873AF1B206307F7602608672FD3D5935D94BB2B8370B5B769F1AE16B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982697, "uuid": "c9b48574-2c8e-44ad-94f9-6cf41d7f7d8e", "value": "466e22e9276767c400bb06eb76531f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982697, "uuid": "b29587c6-af7e-46d8-a753-33db85e95a61", "value": "24576:F0DATiNHrdQUwAVOjoRRDTfiNjw8HCuyiNF0MLsN8qIRYrz:F0DATiNHrdQUwAVOERRDWPieTLsH6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982697, "uuid": "1ede56dd-8265-46ce-9e58-9650ff2c692c", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982697, "uuid": "5a81e03e-f214-4246-8c05-6d3e00503718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982697, "uuid": "13f08cfa-8cff-4ead-94fd-fbafe6d56952", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.13012.29756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81822df3-82cf-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1699953823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953823, "uuid": "140289c8-cfc7-442d-a771-82c8d7d938f8", "comment": "Malware payload (Amadey)", "value": "1469e905f3ce6bd98f075df0293320b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953823, "uuid": "6b0092e6-d747-40ce-83e2-b7ae58ab8552", "comment": "Malware payload (Amadey)", "value": "d3a40144912dfa3f095ab0526aba7c0ce4950793090a632dc76f9fd93be815ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953823, "uuid": "b7f8e9de-8925-44c0-8c64-35ea5c9ea2bb", "comment": "Malware payload (Amadey)", "value": "c772609057ac464a043fbd657212c24718e56d66", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953823, "uuid": "a329b1f9-61e3-418c-9a6c-1c40ef0f4e29", "comment": "Malware payload (Amadey)", "value": "cf08979a3a29e3f97547425f80621cb01fb11d08b45b5ddb39882d38a423ff5674881fa354ad5b7488642dbabc262555", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953823, "uuid": "d0823e60-2454-4589-a4c2-0ae4e72b4f08", "value": "T1947519C17E6B1BB2F3F12531806B041C96DCE9D322E1A43FEE9947CA91019E74E7B625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953823, "uuid": "39c3d545-2c13-4520-9fd5-a06a09d258f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953823, "uuid": "fe7accbf-042a-475d-82a9-6c579652557c", "value": "24576:5o7+CLbKTeQd9XAPaMxJ+VAt6y/Gq+T3mlkjqObiXQSIEjNjp3TyQ:g+CH8d9QPfqDqU3mlu01jpjyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953823, "uuid": "cf33cd73-be9d-47c5-9c1e-21110aa6b26d", "value": 1619576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953823, "uuid": "6af7a938-4d2e-4c48-87ef-b23a1f968bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953823, "uuid": "078f57dc-3405-4894-bd35-b3418e5769f9", "value": "SecuriteInfo.com.Trojan.KillProc2.21331.3174.9298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c872092a-8321-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989161, "uuid": "10958f0c-3345-4246-ba14-be7e1b19a78d", "comment": "Malware payload", "value": "3ff9e2d0797020794e34365c37e9a963", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989161, "uuid": "55662944-cc7d-4655-bedb-d4de14b45740", "comment": "Malware payload", "value": "d511c100966b936df679e667e2cc18bd4bdef37c2d65ddd5ff32932b4815309c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989161, "uuid": "8aec00c7-c6e1-4e4f-8292-28d7064e0bd2", "comment": "Malware payload", "value": "c799213eb3c4fa9a00df87b6a929814ba291b36e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989161, "uuid": "dfa70720-894e-4a85-8da2-64b9e756bf21", "comment": "Malware payload", "value": "b0f8a2f3ef0a1d1b6eae94f436f8c80a0c489032c35d7808dc36a2910bd9bec9817d3d29b220d580b20ef858cef00e77", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989161, "uuid": "17c344c4-6487-4be6-9191-f997f4e6694e", "value": "T196C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989161, "uuid": "2c86c554-4ef7-4fa2-8f1c-c3282bc6def5", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epk+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EK+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989161, "uuid": "523314fe-02c1-4ea9-9c3e-43b6d7dc9153", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989161, "uuid": "216258fa-fb24-4455-ab45-336995a7ec04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989161, "uuid": "968ea0c4-2e4f-46e2-882b-9a9231e48dcf", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af17dbe4-82fe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699974086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974086, "uuid": "bdb967d6-2f7a-4dd7-ae3d-19715cac1d56", "comment": "Malware payload", "value": "475002ddffec7457e9aec70668bee174", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974086, "uuid": "ffaee494-6e0d-41f1-9745-b844f7b54411", "comment": "Malware payload", "value": "d8a012a24aa805042bc416d6d72694d6c3c0b726b571f5ef57ecab8690b87b99", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974086, "uuid": "8d12aa68-a2bd-44b3-89a2-356386ae4272", "comment": "Malware payload", "value": "146aa60f346167db1bebe0c8b188ba14d429f428", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974086, "uuid": "c637e25b-e886-4f0b-9f0e-e06b28d27da9", "comment": "Malware payload", "value": "5529c9a9a787710fda94ee298c953068268b1bc00662f03dc3d3b950220d05910ab11e60037ce186c1a896a9ba4c9793", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974086, "uuid": "f5620f3e-f4cb-4254-bc4f-5afbf3e3a00e", "value": "T1C352AF3EEB197050EAD2A97D674008DDF1084427E3515AAF6090BBCFDE208A35B57DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974086, "uuid": "233c1f3c-5826-43c9-a12a-2842665cb06a", "value": "384:dzqi4vDaSdmMce7ZPkJT09MqtCHlmV/VAL:oiMh7ZPkx0WqtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699974086, "uuid": "9815dab8-08b1-4fc2-ab61-6d8e5ddfa857", "value": 14192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699974086, "uuid": "70f583fc-4efc-4c13-93b6-8e468af0c98b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974086, "uuid": "56203c47-158e-4bc3-a986-6d64b074eeb2", "value": "\u0417\u0430\u044f\u0432\u0430 \u0434\u043b\u044f \u0441\u0443\u0434\u0443.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f41766a-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699964611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964611, "uuid": "133f3080-1a75-4094-b48e-25ff6e4d9af9", "comment": "Malware payload (AgentTesla)", "value": "4f8bfa159936b3be25856a5a46cd980a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964611, "uuid": "1e8281e1-1e80-4593-b29c-e9a2c0f1e73b", "comment": "Malware payload (AgentTesla)", "value": "d8c86642c4e7e86d3591143c9bd7a7ca0278ed8812908b81e5633948ebee2eee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964611, "uuid": "1b669b6c-a5b9-4ee4-88c0-73f738401e50", "comment": "Malware payload (AgentTesla)", "value": "49e41a9f9e6743dbe1afa8037ea6a77f98300d30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964611, "uuid": "693f384b-1387-4402-a1fa-13a12ea33126", "comment": "Malware payload (AgentTesla)", "value": "f33bed49f9460dc9442dd0e1b9556e3ddbb417fed0d37646fcc530a975877e1a5274ad306ef0bd395d77597eb84f32ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964611, "uuid": "60c966e4-6e94-463c-a0a9-d33433559cc1", "value": "T1EAB4124077DDDF62C96E9BFA58D6221017F062AF1903E7419DC5A5ED293B3008ED2BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964611, "uuid": "18b52691-065b-4367-9dbb-a00d25a8c905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964611, "uuid": "c829af41-a1a6-4221-b9fb-bb18bcabf06a", "value": "6144:iQQHdq9bG0g6PTk2pXj0olT5Q0Qbaapoqgr/1teEiMgyusJ+FN+ODVd33LJPO0x6:9cd0gP2tj01+QoqblsaL5u0xc1r1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964611, "uuid": "88005465-024a-4bd6-a3e5-8b0a2624a297", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964611, "uuid": "2fc938d1-0a17-4aac-9b36-a955fd4b9239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964611, "uuid": "da90fcdc-ac10-44dd-acc4-d433c82f0443", "value": "AD9613BCPZ COOPP03.23.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feaef9dc-8310-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699981951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981951, "uuid": "b9674a77-be72-4497-af65-6da645f46175", "comment": "Malware payload (AgentTesla)", "value": "a0ed8877034726640ae0ed6597a70396", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981951, "uuid": "99239ae2-c3cf-4406-91c2-d5ec00e72af0", "comment": "Malware payload (AgentTesla)", "value": "da21ece2f4aa50ee504970a2fefed88038ade14bb3f68b0d6e388da6f40628c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981951, "uuid": "501507bc-a62c-4bbc-9088-93d1fcce0bf7", "comment": "Malware payload (AgentTesla)", "value": "df251905c9b79175ecd6e31eb524f5a5e83b7614", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981951, "uuid": "63cdf1c9-461a-43bf-8d12-84815077b65d", "comment": "Malware payload (AgentTesla)", "value": "d3c4c729f114dbe6f516bae4baf4a6c70567f65720f7d3e8cc5b3cb9fa8d65bc2f186051dbeb53bb372f47752bf11d20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981951, "uuid": "322c9b2a-a458-4493-98fa-7c9e1025088e", "value": "T10CC401123378982BE46C06F9646211D587F2EE17B160E7991CA77FEE2BF2B414702763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981951, "uuid": "0ddf73fb-441d-4760-bffa-14568519627c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981951, "uuid": "e89642ea-8003-4692-81e2-5192ae8446b6", "value": "12288:hjHTLlfbpuZRV9s6Othh4gKcpTexCdtJJmTHYu/LBQ+:9hjpor3dhiNdtJJmDYu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699981951, "uuid": "fb30ab6f-aebf-47a9-9519-8cd45b567772", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699981951, "uuid": "398d6920-a681-460d-b218-b01dce3a653d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981951, "uuid": "e2c06628-1e8a-4605-877d-b84217335c95", "value": "a0ed8877034726640ae0ed6597a70396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0438d5f6-8303-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699975947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975947, "uuid": "65672195-70d0-4a50-9c6b-55b01c5d506c", "comment": "Malware payload", "value": "d0a4a3eb1863da4e20ed5660a9ea0f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975947, "uuid": "41421110-cbeb-4215-b748-bdf874d8b069", "comment": "Malware payload", "value": "db5791df9f9164152525e6564a5984cc23ff98593c92d0ad167b8d7fbb0e3111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975947, "uuid": "eeccd0c4-880f-424f-8423-49a0ec7cc51c", "comment": "Malware payload", "value": "f439f2ff1a9970f342282a9df95672fdf209b98c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699975947, "uuid": "a5870ed9-c4c2-4947-8429-bc5efc382ee7", "comment": "Malware payload", "value": "9055ea41fc35eef9ea9f27a5827b8e2ee592da89f2e7e84de7842546bee1ec086457e430aff85d39798eb7151c304867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975947, "uuid": "6be28d19-f8ca-4ba6-9670-0c18d530d82f", "value": "T1B805236A9D874D71CEED067ED91051E4A370818FA322F39B5C80637B8E933C2A9145FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975947, "uuid": "d81dc8e7-90ce-471f-b632-7f69c07bfee3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975947, "uuid": "e705d8e9-8b28-46a2-a1b8-c4704b25222d", "value": "24576:7sztEQe9GGIhZVjNDnWkAeK/y7Fk9jmNjjF2Va:7ut+HkrxnWkADiuGF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699975947, "uuid": "ace589ea-6ea6-4dea-9337-e62dd573d4c8", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699975947, "uuid": "6419fba4-b907-44d9-86ec-9ff824e3117f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699975947, "uuid": "416477cc-b531-45a9-a03d-c5d1dc3fa9f5", "value": "ZAM\u00d3WIENIE_N.2311511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced36cef-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982729, "uuid": "0c1fa974-66ad-4e1e-ad5f-0c7bf15b2a15", "comment": "Malware payload", "value": "9b4868c326f73c0ddb895ad13c6f45b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982729, "uuid": "fa7e7da0-6fc7-48eb-a80f-119a36008ab0", "comment": "Malware payload", "value": "dcf2b30da73634394e398e44c84ea1f525a6e2b5f29114a0c504c50e119515b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982729, "uuid": "e2144b70-8983-40cc-badd-59286c94be8f", "comment": "Malware payload", "value": "1b0125041eb3d04c2705f6fdc395f6c953f6e0fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982729, "uuid": "4881fa1c-ef92-430e-8fe3-63b834390daf", "comment": "Malware payload", "value": "749029370e77387c2cc1884c20b0321e52f1ce929c366722fd8efabc5e870ba6e017d899f29305130d71fb21956df2f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982729, "uuid": "5d55473b-0e47-4a92-96eb-84d80282a3f9", "value": "T142256C32B2915437C2A36A345D17BA695432BE815FE8B48B3BF83D4C6E366C17C31396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982729, "uuid": "500e8f80-6c9b-46e5-85ff-53d9cbd5e70c", "value": "24576:JzigsKFZzJzZb5JgHCJSRU4N8R7Cn/vmlETbL:liUhZfFmrGEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982729, "uuid": "bf8203fd-04ac-412f-bc4b-016e3672dff4", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982729, "uuid": "c0bd76e5-4e9b-4362-ba4e-dda3f234cca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982729, "uuid": "b842fd83-30f4-409d-9864-91aff478f98a", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.7670.13973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b05348-82c2-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699948223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948223, "uuid": "7b9daae7-9552-4cb4-91a8-094c1533d370", "comment": "Malware payload (njrat)", "value": "2b7f57acb70c816b7d1f4dd6adf7a708", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948223, "uuid": "ce3cafc0-fc60-4a1b-bb52-f833bbc3232e", "comment": "Malware payload (njrat)", "value": "dd1200655c6acff2c7a4d4d3a0c86399a9f23823535e9e6224860a521f360678", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948223, "uuid": "d5cf0cd9-e4c8-4553-aa43-8cc8b9afeaa8", "comment": "Malware payload (njrat)", "value": "3ed5f35141566dce843ffe38b93e3e3a1bf507cd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699948223, "uuid": "f10767ce-009b-455b-a598-6d2d28f3e6fb", "comment": "Malware payload (njrat)", "value": "a55d561ff1f0a124ab92a735395828f270334644995377bb857821d8735483c929fa489be1b6c329f14d58a33c303612", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948223, "uuid": "b095c4a7-35d4-4176-b2ea-1c4a691a0135", "value": "T120F42312E16AEEF6CB4262F0C471C6119B69A153B428BD03FE4D04CFE754D991EAF6E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948223, "uuid": "6ef03c51-4aff-4346-a0df-7d1facdea1c1", "value": "47bc3e92e82cd9e4341a7101e4c32da9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948223, "uuid": "3189a878-5396-4f24-8d84-9a7a3c3843d7", "value": "12288:CoQmTN46xNTvp5VL6HKjnowj++nU6YaeDVekMzDY+yXLQY3CYwGiLb9BzLu2P43z:xQmTd7zVywj++nTLYekMzMVLyYwGiFRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699948223, "uuid": "53f177ba-3ff1-4f74-a155-5b210caa71bd", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699948223, "uuid": "8e6f77ee-75cf-49d5-bbb4-f6cfc985d765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699948223, "uuid": "9d766895-b4cd-4213-830e-d58f042f5d4b", "value": "2b7f57acb70c816b7d1f4dd6adf7a708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e930ce5d-82d3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699955715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955715, "uuid": "ac0dd711-392f-4875-b6d0-482b4f81ad2c", "comment": "Malware payload (RedLineStealer)", "value": "ad21f2c2aab65ee468713a3c37e11eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955715, "uuid": "854951c3-5672-4761-b33f-5b16c8530eb0", "comment": "Malware payload (RedLineStealer)", "value": "dd49ae56ccd5824fe4f6b62ed6b3b3466a40e56163c23adee63b9b26d96b09c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955715, "uuid": "b39c29a6-003e-415e-a694-0ff526a157c1", "comment": "Malware payload (RedLineStealer)", "value": "bd70a3e43882830237ce06a176b1de992928bf65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955715, "uuid": "b76a531d-39b5-4522-8459-d66373c4cca4", "comment": "Malware payload (RedLineStealer)", "value": "2fa9c74d28e0f4cf2db52d8ff610373d405c3d483308730c6d96e427ebc746e4419a498512be3ec1f53178f530f48b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955715, "uuid": "7f088566-5458-47b2-a937-f3eb2ff8fd39", "value": "T1A4252306BAED40B7D57253B024F603970A3C7DF15E7C87AB3609640A8C726D06676BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955715, "uuid": "9b72428d-5c86-497d-985f-66eeb36b1e2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955715, "uuid": "ff7b0684-8840-4865-98e9-84c60cce85a4", "value": "24576:2y/lBudt/yCWKaeIIspCnG4W1DPXdziQTdQ6fYls1EnXM:F/lBnjef0OGhxz9VBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699955715, "uuid": "30f6b128-e6d3-4d3b-bac5-817d6d581342", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699955715, "uuid": "36b61e7c-4696-454d-b519-99cd3b94c5ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955715, "uuid": "901b3434-101a-4287-b9ba-1dae4a70304c", "value": "ad21f2c2aab65ee468713a3c37e11eb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb150b73-82bf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699947155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699947155, "uuid": "3cfe1bbb-61ce-45ec-85a9-226f9c439fbd", "comment": "Malware payload", "value": "90ff3c61cdc36e62f11878150c52a7fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699947155, "uuid": "c2766f69-841a-4b5b-9bfa-58c666888124", "comment": "Malware payload", "value": "de370b8f6e1ebb2f43c5fb9ac7392cc5c70224f10c31bdad38cf369744d03d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699947155, "uuid": "619ceb68-1bfc-4a63-aa03-66b12bd1fa7c", "comment": "Malware payload", "value": "2bebc23849092eeb7ab851e6cc4c53cb41f35953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699947155, "uuid": "3353d248-99e7-448d-8bee-2334b13b9c5e", "comment": "Malware payload", "value": "2ca1c3ef5fb2cc4310ebad3479692ca54c31ffc1b8256c001978497dbd3ae1f3c48fe37ccb3f1c5901b3d45671de327b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699947155, "uuid": "94fb6847-f328-4bae-9127-c574a8b94854", "value": "T1A8448D00B5918431E8B715334DBD9A69EA3DBC500B146AEFE3D85D3ECF346D1BA30A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699947155, "uuid": "fc949c23-e182-4975-bea8-9d4365526956", "value": "3bd21c073e321959019ea60d6d842ed8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699947155, "uuid": "9ae58997-fd4a-4666-aef1-23e2bb882f06", "value": "3072:OG67a0zGupXz788zpjDRx+kRzt7Rjel1i+JHX5CHU1FPmazSayEC2lMp1WUeAg0z:Sa0Rz788lDRxLWl1XHX5z1Fqa0CAOXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699947155, "uuid": "f0ebe59f-a5f6-4d26-9db7-2deb97f9d28b", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699947155, "uuid": "a3d3864d-4053-479e-98f0-1dd433cdb43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699947155, "uuid": "3ed4de39-74e7-4c03-96be-d656d8f14123", "value": "SecuriteInfo.com.Win32.TrojanX-gen.22706.6902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a554d3-82fe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699974092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974092, "uuid": "05f60ad4-9270-4587-9293-bae4f5da61cf", "comment": "Malware payload", "value": "b27323c59498426807574a20824ac525", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974092, "uuid": "3f233035-0c47-496d-87b2-3e5549d95128", "comment": "Malware payload", "value": "df5397b08e1b72fbf42290033aa11934e895488c93b76e608542fbb49d2e0f98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974092, "uuid": "356d7ae6-d0fd-4bdd-b4c4-9c18a1782681", "comment": "Malware payload", "value": "bdee034558b4b105472e0b0c943460746910ace1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974092, "uuid": "115851bf-2345-4a03-9c98-b2de46b389f8", "comment": "Malware payload", "value": "37bc733a3adc548ee21556b6a86fe2083d4def2b4dff31931f8003ff6709632ad5d88718282a4167aae3e57d5e39b666", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974092, "uuid": "53ccd383-6157-4284-a133-11570de097ab", "value": "T123648D51B580E032E4E20431A3BE8B759D7D65201729A8D7A3E81DF66F302D2E73DB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974092, "uuid": "3b0625ea-f5b2-4615-80b1-6bca4648c863", "value": "dbe7ea52e4aa8fe765398b6553e86868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974092, "uuid": "9ceca4f4-dded-4614-b316-84f8fdca1298", "value": "6144:tE4bq2jLXveqB+HcDYjOHBhpbiQ4UdnZYrOCa0PEIfuQrk:tEwq2PXvy0YOjpbiQ3nZSPEIfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699974092, "uuid": "1355958e-1264-4cdb-8127-2e0fbc36e522", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699974092, "uuid": "6ee9b53c-5e27-475e-b866-cf9e6bf68d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974092, "uuid": "a8311a8b-b3ae-4ab1-9d4b-23e10f2cd1dd", "value": "b27323c59498426807574a20824ac525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f63f83-82d7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699957082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957082, "uuid": "10f3e826-1474-455d-92c5-2ee3317dae79", "comment": "Malware payload (AgentTesla)", "value": "6f2b2f1d2660afb4706026e7d7d23aa1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957082, "uuid": "bc1ac9a2-b772-4d35-b23e-5625f6757d59", "comment": "Malware payload (AgentTesla)", "value": "e0a14b9acddbf73d270c2eabf671ce58e1c2aaa237ccf2de320efedc947b6ccc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957082, "uuid": "e384ba5f-3ff3-415e-8e8c-8a2be714a61e", "comment": "Malware payload (AgentTesla)", "value": "923f3343f31c12cfcda499a777944ba8e140357f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957082, "uuid": "af889724-5c47-4bda-aebf-45f92384c103", "comment": "Malware payload (AgentTesla)", "value": "159b29a97e23842f94c2c80d1befbd934037ed7c12dfc1362f7e2859b3f5c3b93b8fe3a6977aa36646f1339270d5bb81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957082, "uuid": "46f4121d-bdb0-4b0a-a33a-9eb4c0e763c9", "value": "T1C0D402053328992BE57D02F9787641C597B2EE13A561E7590CD77F8E2BF27808B036A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957082, "uuid": "cf29c2e0-1867-4079-a444-b55a151ffd97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957082, "uuid": "e7f1ac32-6dba-436f-9769-0c41db263218", "value": "6144:iCvHrm8ClZP6C0Cg+5cbSfDL8twf87vi2Nzm6aY8OFTglKfNzUjYo5jN9vTYY+g5:UjDLlf8aY8OFYKVzU8GL3w8FC6hHgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699957082, "uuid": "5f909689-0bac-4981-9497-b82105f8b138", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699957082, "uuid": "613c4e5e-7e2e-45ba-8c1a-f208291853f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957082, "uuid": "2c6d50ee-1c0f-47ca-921d-c4ab39cc49e8", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269a09da-8325-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699990607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990607, "uuid": "df3c4af4-0f30-46fd-9169-a2c7bfc5c553", "comment": "Malware payload", "value": "3ef13cc1b8277e771c1657e0156bb4eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990607, "uuid": "73e523a7-5e6a-4768-96a6-3645f6e56028", "comment": "Malware payload", "value": "e1a6bd6f51a9fcae5e8fccc41554f19c431b1418dec4964947c18d643a1bcdef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990607, "uuid": "79dc69dd-4067-4129-b233-246a65bf60a0", "comment": "Malware payload", "value": "723b39234cbd8b7edcb11fa214585198bdd1e30a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699990607, "uuid": "88b36a23-99d3-4ce1-8d12-1a9283ccc9e0", "comment": "Malware payload", "value": "4e6558fa5324c9a84c1dd65727fc700f2da5c3fdeebe754d9420da60fabe7e4c2278f94b1210a6d76791381a5cf3fdd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990607, "uuid": "25d9a0a9-8a33-45e6-9b2e-0ea119b870cf", "value": "T1A7933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990607, "uuid": "6effa51d-325b-4587-a386-77a6d3917927", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8al4umXxVqDrstKfz9e:Q97vk51RcG7Awl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699990607, "uuid": "8febe1ff-6c3e-419b-8d34-82ac10f7cca7", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699990607, "uuid": "840aaa50-8337-4b37-bedf-1bf52730a794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699990607, "uuid": "aeafdced-fba6-4703-ab20-9c569bd60f42", "value": "3ef13cc1b8277e771c1657e0156bb4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628203fe-82ec-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699966227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966227, "uuid": "d1e15abc-01c7-4408-bee0-b337072c8ebc", "comment": "Malware payload (AgentTesla)", "value": "3ce6827471bc65f44fdff63081c4b57f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966227, "uuid": "08ab8667-5d5f-4d5f-8067-f1323dbd779c", "comment": "Malware payload (AgentTesla)", "value": "e250eef1eaea9092ecaa3ecd7a94b02720a9fb2aadd9c8a3b234e52ed7710ae8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966227, "uuid": "cf8b4d40-ad71-4ad7-b59d-fc02c3c12edd", "comment": "Malware payload (AgentTesla)", "value": "20864adfe461e3ea6892f5bc8ebbb50f761e2af5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966227, "uuid": "edfd4d0c-c2ac-49aa-9fef-f708602b8e74", "comment": "Malware payload (AgentTesla)", "value": "e7f1a52b71463192bd8228962717ac7e8ee4dce73e39d11d93f06f4fced08eafb37af5de9e2309e4308fb4edb67439d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966227, "uuid": "8eef9c25-764a-478b-b24e-4949842ab17a", "value": "T120F401673664986BC52C42F4A04B1185D7F2EE17A263E3D44C977BEC2BF27D09E052A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966227, "uuid": "e4dc10cd-a88a-453e-b156-40bcf85c0d53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966227, "uuid": "a6531b01-3483-49e4-bca5-9896db132864", "value": "12288:jSr9lfnWgWpOsTF9OjXgezF6dIpMVKiqaEoF/+lKH71c3GxANhZg9bF8Eo0:sP+wz0YMVKiTVZ+8w1zCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699966227, "uuid": "8da9193c-2789-4f81-93ca-2975649f9780", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699966227, "uuid": "046883d4-d69a-4ccf-b15b-bec6eb2db5a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966227, "uuid": "5f16b545-5662-4798-8c49-993e076e4391", "value": "SecuriteInfo.com.Win32.PWSX-gen.13305.25410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80bf90d-82fe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699974101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974101, "uuid": "758e3cce-c272-4b59-9723-e56be39d723b", "comment": "Malware payload", "value": "5655432921d1f7ba0005a97a19904ca5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974101, "uuid": "72967a6a-a5cf-4628-8be9-1b99ba426229", "comment": "Malware payload", "value": "e26a36702257f07a25adc0e5b1a3ceeabcbcb18b63c8d83c0ccb988f848e4a08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974101, "uuid": "3e355fd2-c3fe-4a14-99e0-f990478308c6", "comment": "Malware payload", "value": "3f8b87db9799d205b66bb219bb385261b13c6990", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699974101, "uuid": "e0b15e4a-25fd-49f4-a1a2-03fcee72a06f", "comment": "Malware payload", "value": "930fa510d52023611d22ebc7aea5dc60cc45dbd4ff293284bf8932b4603b6112e1a035053c4797778ffaf4aed25086f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974101, "uuid": "97a432e6-8943-470e-a9bf-bdc62b05f73f", "value": "T125F66C51D2F2A64DE8DA85368E3073F462B36422B713E395CC54E925743C7EB8EC8663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974101, "uuid": "a690f069-1237-4d4f-a281-c99ab84cfba7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974101, "uuid": "df665860-0b2e-4a74-ac00-afc633c35d5f", "value": "196608:yH3soW5wpjr2Wr0TFL7pftFHPEjX/KcxvRmteH:03sohszcjS4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699974101, "uuid": "ec8577a3-5a6b-40f3-84b4-6aea21a195e2", "value": 15863160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699974101, "uuid": "6d7c3905-7a8a-436a-b30a-e0bb5b127b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699974101, "uuid": "f309ea15-3628-4d2d-921f-017923bebf8f", "value": "5655432921d1f7ba0005a97a19904ca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0f177c-8304-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699976708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976708, "uuid": "8c8df002-0a64-4e68-b9f7-ba1616f18bba", "comment": "Malware payload", "value": "e38298e7c4f6fa6a1e89e9d3ddd52bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976708, "uuid": "2fe1960b-1ac9-4335-989c-0c141e6bd180", "comment": "Malware payload", "value": "e3ba3128521529aa94345e7afbff46bee7a4c38eadce2e4f3a931afb22fad365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976708, "uuid": "eecff4e4-8172-4767-877d-b8c8c5796874", "comment": "Malware payload", "value": "e67ace74f0a4b4194189c6aac2c8dfbd32943c44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699976708, "uuid": "a6158333-032f-406f-a96b-fffe5e7b5f44", "comment": "Malware payload", "value": "8a2dda9754fb40a4a679cb573d156073d9c92d0c08bcb42cf00bc2f7814d4ec36a15373eb28e20e2245a1b7e7dc68cc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976708, "uuid": "2659dd1a-3fb8-4e1e-a19e-9d8dd8feec1d", "value": "T11E946C1E6476847DEF5610B2428EE2AD2569E6A2F3419C8BF25C0ABC3F63DC245F0D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976708, "uuid": "bc0390d3-645e-4acd-8460-d9ebeb0d8038", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976708, "uuid": "e65e15f7-59ee-42ce-bd0f-b49895964995", "value": "6144:oW5gUwlREXKMmn/P3dAORXwmyqpxHfLUgUjJqLhhyaLfb9s9:DgUKRE6Tdr/pBLhyaLf29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699976708, "uuid": "b949f011-6ec1-4454-9b5c-187784f9fd05", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699976708, "uuid": "93986296-94c2-4c49-8b98-2c1e17e7dd64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699976708, "uuid": "08690dfd-09d2-411c-8610-c294d0b7573b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce195177-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982728, "uuid": "1b3913c1-157b-484c-bf00-c45bcc1873dc", "comment": "Malware payload", "value": "3415612ad95e52a7e738e02cce704f8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982728, "uuid": "bd670ee8-a1eb-4ce3-bb0f-1093103ad177", "comment": "Malware payload", "value": "e40ee5b484b1f3e630bb257ab3424acefd5b2bc9979664415774a080e69623ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982728, "uuid": "98533262-5b87-4817-8410-60cf7826892e", "comment": "Malware payload", "value": "6c640076c3932d1d6f3d6be18caf8ec5502bb21c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982728, "uuid": "1c459447-38c6-4288-94ba-722464aa0ac1", "comment": "Malware payload", "value": "bddec150fe75909e2d11785a9acc72463b870986130b6c05f1cbae37e28c2af4b4872faa47ff334197d8e5a071bc2c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982728, "uuid": "795f941b-1001-4ff7-ac9e-b4953ba48db2", "value": "T1EF257C1732815033D6B27A364A2B42AD8926FE161D78345A6BF99C483D35643FB72FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982728, "uuid": "8f840820-363a-4610-8849-979f87b86f19", "value": "24576:J6QWEI4asrFHyAOtyoDM7bq0hFsPsFSajDCL:J6fWEAOEFhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982728, "uuid": "444c1cb5-baba-49bd-a263-a13f50efc1a8", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982728, "uuid": "dcf13a3a-592f-4d59-8c37-a62969860bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982728, "uuid": "40d60b6f-4f82-4edb-8c73-a0505bc1d347", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.21081.14988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd9e9a2-82ce-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699953386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953386, "uuid": "9649f65d-9187-4c24-997a-aeed3bf432c6", "comment": "Malware payload (AgentTesla)", "value": "90de6be2a577363b08fcbf891cc65068", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953386, "uuid": "24b8c14a-70a6-4481-ab10-4b3c8a97e6ba", "comment": "Malware payload (AgentTesla)", "value": "e5a39d95388a1324e37c31b9bc6a527941dd0c0736a0971ead7ec611474d2eb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953386, "uuid": "64edf41b-0e24-4b27-999a-0ba0662bfa41", "comment": "Malware payload (AgentTesla)", "value": "666e611bd3278c3a36fa423242dca61197f109e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953386, "uuid": "a23813f9-09b2-4ad6-b46b-8e1e6328ff67", "comment": "Malware payload (AgentTesla)", "value": "1ebc00f0cfae85dc1add297f96c379a0f7675ae45c45b065257913799c9adcea8df01619e1ef143bb427a8c693d6f47e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953386, "uuid": "9f97988f-aa01-433c-96bb-054090941402", "value": "T10905DF82E944A6A0ED199B75A636CC3553237DBDA874E42C28DE3D673FFB3931021067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953386, "uuid": "bdfb60d3-c6bd-47b9-8de4-c31735f5376a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953386, "uuid": "d10bb8d0-29ca-4d3f-b7af-d66f3f082ed9", "value": "12288:v5AFnSizWUGJsLzldFXNgTSBQ8S9F9Age7lZ3n+PcP7r9r/+pppppppppppppppX:RqSi7dXmOB09HAtv3+U1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953386, "uuid": "274e377f-3ffc-4f23-b775-09a7d8273d87", "value": 859696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953386, "uuid": "932b1caf-066a-4838-82df-dd89cd8d8d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953386, "uuid": "3f000732-53e0-4e3b-9676-a93785683d9c", "value": "COSCO DN 5874 COSCO DN 5977 COSCO DN 6268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9827baf-8319-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699985754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699985754, "uuid": "ccb6f582-c474-4f59-823e-18919a4a6b74", "comment": "Malware payload", "value": "a033d9d8ea1d3a4354002b1da2f82a97", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699985754, "uuid": "9adc12fe-b955-44c8-976f-dd158681f0da", "comment": "Malware payload", "value": "e6691bb611f13af46b2d94cbcd54744df0839ebcdbbac6909b5fe612b503970e", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699985754, "uuid": "c78413db-6987-433d-b4ce-ebf6779faa49", "comment": "Malware payload", "value": "103589cf4e8edf44148236d436329cc494cccefd", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699985754, "uuid": "338fcf07-eaad-49f0-bef8-d0d385e7f400", "comment": "Malware payload", "value": "ace843e90bffd83841dbf9b704dc108782a843c8089ad8cd578ceeb9b6480656688e433505d009eada2897eeeb937c92", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699985754, "uuid": "1868ac77-11f9-49ed-89ae-a7cace609f47", "value": "T16B71FADC9C8377019BF091B42DE0D9698E62B31275A09DA3923298CDCE632D5CF036E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699985754, "uuid": "afd40303-d525-4853-ab1d-da6111ede9a5", "value": "96:C8h1wJ87CdE9GTdvktcGFZYEQQ+PkBuxNFO:fkJvCgTKLLiQVky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699985754, "uuid": "4c49b0c4-c703-4148-8629-6db6eb3e8a54", "value": 3505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699985754, "uuid": "8617da7d-7890-4205-bc34-f57639e14c34", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699985754, "uuid": "66ad337f-7122-4b74-ab1f-9e8e2ea0ef70", "value": "LETAPOGAT\u00c1S.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cf721e-82ec-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699966224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966224, "uuid": "d5bebb8e-b2fd-441a-a543-98743ab7ac5f", "comment": "Malware payload", "value": "04983d6ccbb812577fce765e11bf55cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966224, "uuid": "c3278983-9c0e-4831-bddf-e734c3d8a399", "comment": "Malware payload", "value": "e69fa17979f4dc03a37fbe37f92d686092271a6d610ae3d31d59d52441dd812a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966224, "uuid": "b3095583-eebb-4e52-aa19-c75a34512397", "comment": "Malware payload", "value": "472d9ef2b21ffe98b9b1a32eaaab20abebc32447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966224, "uuid": "05080784-594e-4aef-b698-5b6ba452f970", "comment": "Malware payload", "value": "3a4230bbeddb98db281d23004bc97e3e64d08e68ddfa1aff28dbaac02703144b915f1bc8007b402ee519c148afbf478e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966224, "uuid": "c9277b37-1bc1-475a-bd96-d5f952f17fd9", "value": "T16A94390420C3B267FA3F97721DF85B33C82F3D21866186BF96259A2C9964B5D3C3099D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966224, "uuid": "16cdaea0-4341-41ee-804e-5f741192dc29", "value": "1c7d0efed001e965dd9c0307904ea44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966224, "uuid": "fceb3c7b-901c-4297-866f-39906fd2b7cd", "value": "6144:BwIU/FKe4lNUq/Vr58AOZ0HQEYG5J4iJ8GlYVqxirYey+d1pUcXVn+U0:FU9KeIB588/J4iX40YNF+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699966224, "uuid": "f49e5037-d362-470f-9400-76b7061e3824", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699966224, "uuid": "ffaffa1f-10d1-4b62-a224-8e24e114d40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966224, "uuid": "b42a0f06-457c-49a0-baf1-3d89e7e27abc", "value": "SecuriteInfo.com.Win32.DropperX-gen.2367.17081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a903a6-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699964626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964626, "uuid": "fbdd2efd-d057-4ab3-9962-1eaf40cdc043", "comment": "Malware payload (Formbook)", "value": "e7f8749e25e9d9d7dbf2190d702b68bf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964626, "uuid": "10063d0c-2db4-4ab2-b5e4-56b389810ac1", "comment": "Malware payload (Formbook)", "value": "e71b775b4109b2c45e494f310f5599e3f8e2527f724cc8a3a1332fe306e80efc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964626, "uuid": "f9bacf20-3a54-4ca9-af07-86d1e94582d9", "comment": "Malware payload (Formbook)", "value": "2cd537d0fdaae58ff515823a2b5e3df607afffa6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964626, "uuid": "eed36616-6670-43e4-b1a1-4f5ddfa022d4", "comment": "Malware payload (Formbook)", "value": "36ae15f0edee89852946c8a066a4d3c442af7dbe3b445e5df9b75204a697c3e96dc1e5485d7a21e3b44f6afa2f428c6e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964626, "uuid": "b2c275c1-5cd8-4c34-ada4-0734b97f2f21", "value": "T1E1E423030129AAE358BF2AECB584E428FD57B5F1E6ECD206D07C75A1E9420AB5793079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964626, "uuid": "4927ddcc-ce46-4df4-913b-2b02403e8d4f", "value": "12288:XaHDT2kCkVhPLxeryZjqXzip44T/1lAxvmA8GH0hEyKGmcIeaG:/kCkzWzXK4K/1ixvmIUWyjIep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964626, "uuid": "87ad1dda-09f4-4ab8-8494-993330d289c7", "value": 662593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964626, "uuid": "e49b6f4c-57e6-4ea1-bba1-ccfcb0702c56", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964626, "uuid": "209773e3-6a49-43db-94fb-9392406319df", "value": "DMS Dilmenler Makina ve Tekstil San Tic A\u015e TEKL\u0130F TALEP VE F\u0130YAT TEKL\u0130F\u0130_xlsx.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23e5a0e-8321-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989151, "uuid": "369fb074-058d-4b0c-8ed0-d77ba3c04905", "comment": "Malware payload", "value": "9ac241f4881d95a49eee9aed40711611", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989151, "uuid": "dc2e0149-15ce-43f2-bd7d-6c6271024f27", "comment": "Malware payload", "value": "e827b2fa3363a526db964ea77b13a38edf35996619f1bf5bf5e5ecc6179b4989", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989151, "uuid": "fcb7a83c-0586-4a27-a5d1-edd18da1faaa", "comment": "Malware payload", "value": "9196c9acf7a6989fc510da61fdbb62991cc221a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989151, "uuid": "2af3643e-32c2-4646-88ad-e647455ade00", "comment": "Malware payload", "value": "776eec5c5332bec9d1fec2dfc3dcb80ff2a4cea8aaf0252c69010127be67043001216c8719d168b6cd5e581adafb1bd5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989151, "uuid": "7042aa39-6c7f-44c8-ac97-123a85e18aab", "value": "T165A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989151, "uuid": "c1ae645e-ad7d-4263-a63d-a0b63353071a", "value": "3072:VSx+i6mqaObhN8nPNKV+qKmZuqQ4DPwXXtse:y6mRObn8nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989151, "uuid": "7d9966aa-0f4c-4492-96b4-4c438f7c02b2", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989151, "uuid": "9de0cab1-50b5-4e89-a4a1-349a9827bc3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989151, "uuid": "a2928d74-d20f-42f3-b434-a9f59e021fe1", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40bd9352-82ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699953285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953285, "uuid": "0fd0b12a-0efe-462a-bd98-031f22561560", "comment": "Malware payload", "value": "b36021daaa4a90337109f56e38e9e80b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953285, "uuid": "1ae89d28-f151-461e-937e-8965ee9490d9", "comment": "Malware payload", "value": "e878a8eca5b7f4408bfbd0ccd365f04d4e7d0735a45ea3228ffc322fbb36ee9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953285, "uuid": "edefb705-1fe3-42dc-b9a8-dd630e1ebcc0", "comment": "Malware payload", "value": "b7fa564bdf971c61934f7c43909bdb63e6f7fa14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953285, "uuid": "cd77dfa4-5eb9-42b8-b7c9-24a885f9747d", "comment": "Malware payload", "value": "4c710fdd32cddecdf818c670df0ad171d0c03d2dc2285ebc5572809489e60cfc45ed67837284c4fea48a82f8f4d92258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953285, "uuid": "4a5b4dae-ff82-4e73-9a38-69c0e9d8419e", "value": "T132242A4392E13CD5F9268B729E1ED6EC771EF2509F59BF7912188A2F04B11B2C273612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953285, "uuid": "ba58fa38-bfac-4d52-81bc-6d1038367445", "value": "b9f69a119dfb935d85204ae1d9e63436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953285, "uuid": "8057d331-32ca-409e-9c0f-99776084f928", "value": "3072:P/0iy5zRLMAl9c8iFZPphq2ok6gmMQvHSSRPGkGS+9j:n0b5zRLMAl9UZPHq2oRMQvHZGkCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953285, "uuid": "c704a8aa-cd8c-4abe-ac2b-ddf029e70736", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953285, "uuid": "56ffbb68-6b56-4a6d-8b66-6fa0f56e5227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953285, "uuid": "5fa1446c-7e9f-4792-b312-86c7e375cf3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ab38af-82ce-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699953555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953555, "uuid": "8fa62dd4-8f84-4eaf-aac6-a9c2ef98f449", "comment": "Malware payload (AgentTesla)", "value": "e0e2ac64b8dbe6a3d13f748608bf73b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953555, "uuid": "e7fde990-0060-4740-b8b7-9a07d8e26a29", "comment": "Malware payload (AgentTesla)", "value": "e90446f4637905f90836fe5c684ac38531090b2f64bb561a555e09cb4af076fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953555, "uuid": "94d6d0f9-3335-4c1c-af6a-73b35d12be1f", "comment": "Malware payload (AgentTesla)", "value": "cd6f44e418a8bab3bce4e4134e3274a2af7ddba0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953555, "uuid": "f845cfb9-e6f5-4b8a-a791-22254f10f42f", "comment": "Malware payload (AgentTesla)", "value": "4337b50413dfa8c0318613ba6f858746076e1676555050cbe2d7c8f61e6326211f74b699da1c722a71029d4d5c67c0d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953555, "uuid": "f21954f9-9b22-48ac-a14c-bb4bd2243061", "value": "T1E4259D0A73A4C699F9104F7380E6C1FA1668AC29ED72D14B55F2BD9736F1B001DC2AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953555, "uuid": "70550bc1-cc87-4d0f-ade0-db5f566cdb5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953555, "uuid": "eeb47661-898c-47d8-81f7-157b6746163a", "value": "24576:E2KmotdqtKJOLDJYojkhpXS3cVkQYqaw:+TCtKQx/jkhpi3fA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953555, "uuid": "c9c63291-65e2-418a-bfb5-252b9559e558", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953555, "uuid": "82a49f45-c246-48e0-b508-171112e8a4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953555, "uuid": "485512b5-5f39-4810-a615-d2e158911cfc", "value": "050300933506_DRAFT BL.exe.gz.001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b7ceaa-832b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699993235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993235, "uuid": "d65f0b48-5cf1-4471-9644-f322640660e8", "comment": "Malware payload", "value": "f68b395a22711ccf4cea2273d7a30b30", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993235, "uuid": "a2bc86e8-5005-4695-8e8a-4f409c1983bc", "comment": "Malware payload", "value": "e95c03486d63185ff6fd0996865d1437f3a135d0da2b268e529eed0d3c4488b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993235, "uuid": "2f42969d-f618-44b0-9d3d-a539d68f87c9", "comment": "Malware payload", "value": "3cf13e01df14978e4a234e7aaada53825b793865", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993235, "uuid": "45784ffb-a57e-4e22-95c1-31603edcad3c", "comment": "Malware payload", "value": "80274895791c086e187b97f70c92a4dfafe3f8071ed9848fd16e60dc24e104bde007361cb87c3d32cf2b754139c5868e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993235, "uuid": "a227fec8-09b2-46df-8d5f-8c475b664fef", "value": "T16EE4CD143B64DC109B6C16E869DB57038B2756A7EEEFFF170AA291301A2B86357503CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993235, "uuid": "658207f8-2939-498a-a59c-2e881da73903", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993235, "uuid": "f395495a-d720-4611-bda8-5428c06f999b", "value": "12288:NC46GwwMjNElk1S/TILxX6I6yLTbQrgzt+i1ufV2S:NHZlk11hcRIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699993235, "uuid": "33bc0900-c5a7-43f1-82f7-6dab5aaf8be0", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699993235, "uuid": "c707ca47-8d7c-4a02-9528-dd5feb28ecbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993235, "uuid": "2b1e05d6-0936-44c7-a6bc-4175c675d62e", "value": "RABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZdVtAQNw1SF7qEtWBGpXMpp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09fe340-8321-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699989148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989148, "uuid": "929e1114-f917-416f-9ee7-660aa66bdc67", "comment": "Malware payload", "value": "3df0019a19de826cb82dbe55c5564c81", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989148, "uuid": "934e9a65-958d-4e62-815d-ce7f78a005a0", "comment": "Malware payload", "value": "eac009df353d224b3a564310e10e1aea77e0cb8806e56ec0c8dbe84a3af4747e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989148, "uuid": "753a3b2f-0a2f-4396-beac-2ab0a3e6c8a2", "comment": "Malware payload", "value": "2fd974c5d0124ab973f1e88972813cf74ee911b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699989148, "uuid": "2de85a3b-b10c-4cab-971e-14aee8e6a8dd", "comment": "Malware payload", "value": "0a3c754b4af3552cfc2829abe15f1b065ebeb062f2efd96809eb86eaad87a5f1270436956ccac64602a1f773ed8d1b64", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989148, "uuid": "732e450c-8c68-4c25-bb00-23a3a342539b", "value": "T1DE833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989148, "uuid": "77db0d4f-cb42-4b13-842c-e8e9cf0993bd", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LnWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yz2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699989148, "uuid": "188ebe59-e585-4ae1-8647-101e245e993d", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699989148, "uuid": "8859784a-72de-4426-92e1-da5dc686f5be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699989148, "uuid": "89834b23-e36e-497b-a324-e6f458c6ec41", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418cced0-82d3-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1699955434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955434, "uuid": "9183b610-a268-4d9e-8b37-6213bd15cfd8", "comment": "Malware payload (AsyncRAT)", "value": "7f34f396c23c89adf6c24092553d37ad", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955434, "uuid": "dffb412c-fcfc-4623-8ca0-acaf63386dfd", "comment": "Malware payload (AsyncRAT)", "value": "ebb3a5afeb6a34fd0ca7e4ee234a04f66de5b7a38fbc4171ff5e8bcaeec8e100", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955434, "uuid": "11bfb25d-b659-41b0-a415-6bdb89adb77f", "comment": "Malware payload (AsyncRAT)", "value": "2a1f3891876c7a1faae11986d8861ad953447850", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699955434, "uuid": "672c1030-b9d8-49e7-a261-0d000c63603c", "comment": "Malware payload (AsyncRAT)", "value": "b23b416026726d1e59693b302968f3169f0ff7d0afafe8807afe93a9d92a0186757dbda3845c54a08412b81c377065fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955434, "uuid": "78bae5e3-a79f-4386-b876-9b9d9d84c966", "value": "T1862512063378553BE96D06F56466A1C017B1EE23A0A5E79D1CA73F8E2BF378147026B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955434, "uuid": "5dc927cf-4953-4f0c-8522-cca99b728c7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955434, "uuid": "089f122e-5ab4-409c-85b6-bb0a295c645a", "value": "24576:sh1sHVJwxIM6k8ZMhvlb3QAae3QOoE4m7xhABW1ZO:sSVKxv6k4uTDAOohm77vO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699955434, "uuid": "8a761077-19a6-422e-9d13-bffcaab62016", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699955434, "uuid": "5aa98a4b-9432-4366-8ca7-3f581c2ee477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699955434, "uuid": "8c7c6437-1825-49e2-a78d-0d37d050c125", "value": "PurchaseOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73d4d0c-82d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699957457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957457, "uuid": "c974a559-31f4-4f5a-b41f-a66bda864acd", "comment": "Malware payload", "value": "dd65c1f58db171119e35237d3658680d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957457, "uuid": "997c5179-b562-4318-802d-25cf61ae22df", "comment": "Malware payload", "value": "eec68e0190cb6b7683556b3fde3922936b0b0a70d0efd2062c53c87f2adfdb1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957457, "uuid": "a2f06005-d38f-42c7-83b1-07bc8bc283f1", "comment": "Malware payload", "value": "6ef395588f63f93bfe89de7b25db4e4808ef56ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699957457, "uuid": "d01f5757-a426-4c51-96a1-fd061e51e279", "comment": "Malware payload", "value": "43a45a2bf75a3281cd2c6594a75c77edf124d098f8bf053fe4d16a342651dbeb2bee82f9ebf28131e122ca25d31d732d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957457, "uuid": "a8141df7-6244-4a61-b444-5e2ca9493b5a", "value": "T1CB72D0A123823948E331CF793BEC340FD06C4517717997146D95A20AD92BB245CBAFEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957457, "uuid": "eb7e2c8e-d2f6-496f-bb3f-4f867a6dea68", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsDdvrY6jdE7Ff:yb2eX3zAKuiNPZRwwqdvrrduMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699957457, "uuid": "b46f7b38-0802-4532-bf14-5cee058908a1", "value": 16320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699957457, "uuid": "cf17f17b-903c-4515-a207-ab6f56b63c1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699957457, "uuid": "5eb30e7a-0142-4ff9-9b0c-ff2f9f7ad612", "value": "SecuriteInfo.com.Trojan.GenericKD.34055387.23798.8059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f947b2-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982679, "uuid": "7d541d13-0278-45e7-a20d-7c335f1ee1b4", "comment": "Malware payload", "value": "c91a85151636fe8fb74c4e0da77de959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982679, "uuid": "1e798ad7-df6d-47f0-b3bc-c41786dfbd7e", "comment": "Malware payload", "value": "eec69f942751816a1f48afa25f329d5ea8e630fda1604be8e1a688046d63338a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982679, "uuid": "7757d6f0-d813-4a95-85a0-554a489b61ef", "comment": "Malware payload", "value": "aa57e1d2e4f0e4f766e9ff2bd2b0aa1516068c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982679, "uuid": "2bcf959f-ab28-489d-aecf-371fe1e04851", "comment": "Malware payload", "value": "3795d40f479da2abe525514f59f88ce63a78fc456c5f03a008b778196a2962c50d78dd47a9abfe85cfbe7cde3eda8f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982679, "uuid": "e9a62fb5-cd28-4153-8374-783ea562e45f", "value": "T190357C0732915033E6B279364E1B42ADC826FE261D78345A6BF99C483D35643BA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982679, "uuid": "5c036771-5c93-4e97-be48-1243a5b6352a", "value": "24576:NQwunH3emqFC03qydo/K0QxjYGL0FXHJ:NQljM3qipdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982679, "uuid": "7ceb43de-97c3-4798-9c9f-34a69d960cfc", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982679, "uuid": "34d4731c-3e6a-49fb-a3de-29bee363730d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982679, "uuid": "f017f846-255c-4fe3-b4db-e7af02ce1cb6", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30224.27553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b1d8f9-830f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699981211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981211, "uuid": "981de181-afa2-448d-bda5-917c861cedf2", "comment": "Malware payload", "value": "ef43bb3a699955fa82798d9fa451ed08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981211, "uuid": "c7fdaa10-bfe1-4356-8415-62e164d4ab69", "comment": "Malware payload", "value": "eedbc0caf5c43d780e840abda5c3dc64721dfd24c0da7143440418317ba1502f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981211, "uuid": "70839342-1ea1-4b3d-baae-214dac3862ec", "comment": "Malware payload", "value": "82e890e20da14c8d42cc5d71ec85925c131e6045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699981211, "uuid": "47bb24d0-41b8-46ad-8b77-488dad4b51f8", "comment": "Malware payload", "value": "5dad51840f78a4445363c5bc2dbfe1f0965c9607fa6fbbb275addb975ce18e1b35e2cf4b8fbc86c06dd6ffc65ce88e35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981211, "uuid": "b85d47a5-3174-4c59-a270-4502b7e0e74c", "value": "T114F48B97E890BF77C26DC1BAC93A019AA7510606BF433E97A61D8061B353B4637E734C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981211, "uuid": "dcec6fe6-a82b-43a2-908c-166c641c34e0", "value": "d2ea187d5ea6ab25944ba043879a899a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981211, "uuid": "4557a661-c82e-4a15-9c76-5a49d40d0902", "value": "12288:iUglwHYgZ48KfmTjCmO17KBAUkIQDcMh/PQ3j/KzfbLt2/wK:itQD48RmmsKBQfZqSfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699981211, "uuid": "ca15fdfb-33b6-4350-9619-e776cbcff7b3", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699981211, "uuid": "eea77df3-6e58-414d-95c6-f22296e0e64f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699981211, "uuid": "cc2ece1e-c012-46aa-b9fe-bee2149abe07", "value": "eedbc0caf5c43d780e840abda5c3dc64721dfd24c0da7143440418317ba1502f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc53c5f6-82c5-11ee-8907-42010a9c0042", "comment": "Malware payload (Stop)", "timestamp": 1699949654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949654, "uuid": "a06be481-83e2-453b-a934-c73d95b46b85", "comment": "Malware payload (Stop)", "value": "1fb4633d2956759c7c43e054eb5f5028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949654, "uuid": "bcbbd4ef-8dd6-49e5-9431-5b897d864a6a", "comment": "Malware payload (Stop)", "value": "ef4490618651a76bc4c7a544b98afd3be7724d494760170127520504de24602d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949654, "uuid": "9e81be4a-d81f-4862-a708-6dab86888939", "comment": "Malware payload (Stop)", "value": "9eac9cb63bd1db25d8dd939ddeeaddb2b31c5487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699949654, "uuid": "2f2470df-44d7-4b0d-9e72-39633a606d94", "comment": "Malware payload (Stop)", "value": "4d11e689d62b191424566c4ec76a7ee50fa2b8759255914a08072b2ceae1cf976dfa6376d74879e156f0b78f11678ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949654, "uuid": "1dc84559-55a0-4eca-a9c7-e8a0f1c72e5e", "value": "T1CDF4E11392E07DD5F9658B738E1FD6ECB70DF6109E69BF2922198A2F04B11B2D163312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949654, "uuid": "6226517e-e7ee-4ed4-95e0-079ad1acd71e", "value": "b9f69a119dfb935d85204ae1d9e63436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949654, "uuid": "4dd4f08b-10c3-487b-9626-11ec6697df16", "value": "12288:mYcQK5iBgANulzSzhRddhzaxp7EGiCBlp8cf26/X6/Q0Mi+CNjkfxN:s5iBzNYsnddpaxp7EGiW6026/XuMi+yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699949654, "uuid": "4dd0d41d-49cd-46d7-ab16-d9196e45a3a7", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699949654, "uuid": "cf7faec7-a1e4-4f1a-86a4-ed923b461d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699949654, "uuid": "8ca5d613-93f6-42bb-b6d9-8c41c4006ea9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019f139e-82e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699963487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963487, "uuid": "46b8b53b-2f6f-4463-9068-153fe2602f64", "comment": "Malware payload", "value": "7fd440064df178661b042a375d72da7c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963487, "uuid": "27b51465-304d-4f61-94cc-9266ef663484", "comment": "Malware payload", "value": "ef9982ce0b9a6a27c0fccc7017093b567663e1ab30bee707bb4316dbfa5e6793", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963487, "uuid": "5bb7955a-7822-45ca-b84e-f0f845b9c44f", "comment": "Malware payload", "value": "4e82b4108efd2ac626033b56a4cc47ca8f9849c4", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699963487, "uuid": "246034f1-6f92-40bd-b43f-72b4a49d0c35", "comment": "Malware payload", "value": "b983224af1f2a589b6ba6215dd30392a5164c69f448618cff80adc8693b849f993ba9c071b042ea624466e3bc6d7079e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963487, "uuid": "73034215-da3d-4de9-a594-b63ffc3f5fb5", "value": "T176B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963487, "uuid": "ce650faf-f190-4166-acc3-762513843fd8", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963487, "uuid": "94345e6b-0c89-4eaf-889b-aa53fbebb6ad", "value": "6144:nexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7PpUlLaEx:neZeWSpda70ADIgSoxgUW/zFun7OtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699963487, "uuid": "b7625a5d-5fb0-4e72-9bc2-29bd582635f9", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699963487, "uuid": "e00110c5-e8d2-4142-a610-db2549d4ddbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699963487, "uuid": "08ea46d4-35fd-4879-b07e-31ceda3bb643", "value": "misure.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25c5453-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982682, "uuid": "c2415c70-5af1-4fd8-a1d1-59ed5ee10a36", "comment": "Malware payload", "value": "1977738edd299a4b2f695deaf47bf4b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982682, "uuid": "e4813faf-b5be-4b17-b748-28c7dda28b03", "comment": "Malware payload", "value": "efc9826c30aba11a06834d0e31c10f7ddb804fda6c05a02b796f4084d3e2ffab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982682, "uuid": "793c19f1-ea9a-4d7f-aa89-1f5d82d88dc6", "comment": "Malware payload", "value": "5e190c2aae3e620871937a0c5f50e939d4f02dc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982682, "uuid": "c0576994-ebca-4d63-9819-69a8cc7c6616", "comment": "Malware payload", "value": "4f55cccf36d13e279342d9af738e642affeb53201ddc89f321faac7d35f4fef1ee3db3a2ee28d0ea013165585c48b5e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982682, "uuid": "04018fd1-c7b4-4dce-8f04-9802e6d14068", "value": "T190152A14F9780331E4A299FFD2B7EF59D5B135851B708ACB02028BB61E376DA8531B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982682, "uuid": "9a56d06e-bfb6-43e2-8d49-45ef334aab45", "value": "ceb920209f99ac3a5c67dbf30edbb1c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982682, "uuid": "718a5a18-5db8-49c9-921f-9f62a8156c27", "value": "24576:6sxwSoPdVoBjCvuF17+2NdJff4pxroa6MvTmAwd:GSoPdVoXf4p+a/y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982682, "uuid": "418d5054-7002-4b90-9875-2856ff989e98", "value": 939488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982682, "uuid": "099d6106-c66a-418b-adaf-8d88a6cc2472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982682, "uuid": "10ff6198-e42d-4b29-9553-8fd5310fc430", "value": "SecuriteInfo.com.Virus.Win9x.Merinos.29455.26545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9c16af-82df-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699960798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699960798, "uuid": "ed95a76c-1e32-43c7-83eb-b42f4673f4b1", "comment": "Malware payload", "value": "006c6422df4dbab67ae81a6e014933cd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699960798, "uuid": "4c09e92e-f0b0-4113-b477-d0943be39505", "comment": "Malware payload", "value": "f0b55c8e1cc3fdb6e83a7dd6fe35da840db08e416294c90bb45f04b32b42f4f9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699960798, "uuid": "b1c3b024-90c9-4a85-ae72-71dc98283654", "comment": "Malware payload", "value": "7713f230f9c6563534184c14716a4ac5cd4adead", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699960798, "uuid": "f1e50ceb-3a55-4466-8d0d-7fcdff200070", "comment": "Malware payload", "value": "9507daa99a9e3fb11532cb777062081d2a4b6aceef98d0c60f2b3a4d29ad9a3891c127f90cf94a78880f1b69f77aff5f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699960798, "uuid": "2f901e3b-feb4-40c4-b29f-734df36ed06b", "value": "T11D4533304A3E0A7CAE1DFA35959C7D369EEC345A4F101CC1F8B38BA9886406F9713667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699960798, "uuid": "a22aa896-3b69-41c0-9515-54009bd738e6", "value": "24576:15rNBtsBO+NWK9cQMMmnXP7fTG11B5O9cOtE7nBljusE:BK9YdXPjTI2cOeBljuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699960798, "uuid": "bc58480c-0312-40c8-9e52-1a18eac20c99", "value": 1206418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699960798, "uuid": "acc3d94e-8e3c-4168-8681-05534a948c22", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699960798, "uuid": "da85f605-5ffa-45cc-84f9-2e7e4e5afd7f", "value": "Oder S65392.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8eeb5f-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982700, "uuid": "d2038056-856e-4459-916b-55e3715f3e98", "comment": "Malware payload", "value": "5598835cf0f9e5521ab14c75ed0f6bf0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982700, "uuid": "87d42994-5d0b-4866-a584-3c9d2bea8b14", "comment": "Malware payload", "value": "f122b4ab576902c76b6f127399d6fa51c94fcc90a87c4f870acb6aa2c74fc2be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982700, "uuid": "3bb361e5-c339-4d68-905e-f66b8c8770a6", "comment": "Malware payload", "value": "bfa3bc91e48042db136e6ebb6b17409655dd3340", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982700, "uuid": "cbce90d5-5ee7-4f0e-8c4d-57f7c955afaf", "comment": "Malware payload", "value": "c3c02801f49983cccff4ccc9203c62162dc27d54545acc78c2a0353503654cf3835010d7e69af0fb62267352c104475c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982700, "uuid": "db7cd2b2-86e8-4458-9c2c-2c64f721af0f", "value": "T1819423E8DBFA4D24D9C272BB1F69480165A1BC24FCDD0EE73068E5A18D8586C6C4F9CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982700, "uuid": "8c1afb8f-a76f-4244-a940-101815c4c0d1", "value": "1a391e343275627c81181e99091686a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982700, "uuid": "ea3b3748-9da1-4514-9878-68d9e9b71097", "value": "6144:IQhz787QsKxf/h355gOQYlTKxdBCmkGymUnebcGNxz3tx0ic5CmsIPDZ:rIXofpgOKlOGBOYtz3tg1LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982700, "uuid": "12eadd60-0a17-428b-a14b-5f5575a27ec1", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982700, "uuid": "c12accdf-0673-4574-ab19-95421a01dbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982700, "uuid": "c73b3d58-a8f1-4561-92f5-1a90db967a50", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.21500.30399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a3b7d6-82ca-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1699951525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951525, "uuid": "141b3d53-a026-4fe0-995a-21aee8c4f212", "comment": "Malware payload (RaccoonStealer)", "value": "ab8fa91945810d20ad825e5a65f6f0fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951525, "uuid": "54faba19-6d43-46df-b58a-92a0668d64ad", "comment": "Malware payload (RaccoonStealer)", "value": "f14734d04f355fa903c6482fc4f3662c3ac1ab892ad14f2f135ae357d1f04db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951525, "uuid": "11614e43-6733-4eb7-add4-5c5aa9a5922d", "comment": "Malware payload (RaccoonStealer)", "value": "522783d0897555e724d7b04073ce9d04b171be09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699951525, "uuid": "65e10413-23f3-4ef3-91a5-ca5289cf3b29", "comment": "Malware payload (RaccoonStealer)", "value": "ecde549614ea3382caae5611fbf7157385c3dd2142601c808fdd35dd0ee8572ad9001ac81a904e8364459c2b4daed125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951525, "uuid": "a75f3de2-5947-4852-b21c-0d8f649a75f4", "value": "T112547B0A75C18873E567103A95F7BAB6983D35218FB258EF97A48F7D0F202C1D638E16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951525, "uuid": "f938d14d-d0c6-4654-b568-cd6870880bcc", "value": "1c7d0efed001e965dd9c0307904ea44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951525, "uuid": "2a4d8198-0a93-46b7-bda7-bdf62c557dff", "value": "3072:uKv9R0UoknF0m8eW/lNUq/x3nrlKgELrjuxOAg0FujQGS2vmqFKy3vtZ8xB3/j6S:uKIU/FKe4lNUq/Vr58AOUGHOqwiu50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699951525, "uuid": "dedc8589-281b-48b9-b51a-77fcadf8ae5d", "value": 294224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699951525, "uuid": "d4d25aac-1fde-496c-8a6c-184c3e60cc79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699951525, "uuid": "14061525-484f-4183-9265-c9a2a51eba59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6495a999-82ed-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699966660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966660, "uuid": "59ae68ed-7cfe-4232-b57c-ebc1610308fb", "comment": "Malware payload (AgentTesla)", "value": "02f833708e72007026ce13ca0c05585c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966660, "uuid": "a9c6009c-d2ba-4456-888f-f7bbd2cd2fe4", "comment": "Malware payload (AgentTesla)", "value": "f1a6e53beb7e03091a732ba8d1093eb5162dd620c85f7ee44bdc6efe25c3c853", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966660, "uuid": "73071690-451c-4ca9-95bc-7cb64b0ec746", "comment": "Malware payload (AgentTesla)", "value": "289be283f058154544134582da1cb43f9ee510ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966660, "uuid": "2349af20-ce8e-4021-aae8-b95a3236a1ef", "comment": "Malware payload (AgentTesla)", "value": "ea6bd95a27444bc98760b20cd1e0ca8c1bfda14b16652c498d9370f1e8be78e33e920a2660ac567093bb6063aeee458d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966660, "uuid": "d2d70b69-087f-4050-8005-a14d06713043", "value": "T1F92502B17D324852E53FCBFEC822928586B4901B7123B1EF70E971242C5D98D5A4BA7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966660, "uuid": "9440d306-976e-4cb4-8e88-8abfd6bae211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966660, "uuid": "b2beb0e6-7ba8-4108-8fed-b50c8d470309", "value": "24576:RqSJlpuqpmJ5XktMXvpuG6WoFa4B2da3QDZ4izM:kSJlpuqiXqMXBur47a3gBzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699966660, "uuid": "159a895e-f455-41e7-819b-fd06c73e6a7d", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699966660, "uuid": "6427bff9-70fb-4ab4-9a67-de1c3bc4de12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966660, "uuid": "e2a08fe2-92aa-46c0-85af-3db19c170111", "value": "SOA SEP.OCT.NOV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54f5c1c-82e8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699964648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964648, "uuid": "8aa3f66d-622f-4847-9179-1bbf2fc30904", "comment": "Malware payload (AgentTesla)", "value": "1cb1caf458eadff4c2a872e1cd744cb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964648, "uuid": "52522e89-50aa-466e-8a0d-a6ce13198e28", "comment": "Malware payload (AgentTesla)", "value": "f225748d809c050133e79a599b01e18472d8bd66591e679c54e66c2b33c43509", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964648, "uuid": "34d63543-d9fd-4252-98c1-022c1bdb83a9", "comment": "Malware payload (AgentTesla)", "value": "855789fab97ce4690812b5070ed6c11d121b0c25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699964648, "uuid": "c3ed8c8e-8cf6-4aa2-b08d-7c4e1c6374fb", "comment": "Malware payload (AgentTesla)", "value": "81afb3135f47fcf56ca247bf447ca29da461e4d54179d56e6e071a2773daa7d9dd465a8e6cf3c865d5ca84ca19298bdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964648, "uuid": "df3466a7-8717-4938-8e89-f99a571a620d", "value": "T1A6E43359C25D66E5E2CC7BF1530B2EADE2C3A190AA371F4DD10E1EE716C72EC84518AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964648, "uuid": "64e285ca-4fea-4ce3-ad45-6a1b298b37a0", "value": "12288:cGn7C429pOn3ybCS5Wrjko6mtK1qO3F6Pa0maBBAlNTwhWYo1yDlVGU:ce7C42/O3xS5WrjkeE1qO16+aHYSoYx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699964648, "uuid": "5248197c-488a-4e42-a3d8-86d20f63e944", "value": 717693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699964648, "uuid": "21c08bf3-c6a9-41cc-89c1-cee18bdf9be8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699964648, "uuid": "37394326-68bd-4880-8988-f34390011f38", "value": "RFQ #SBP231211-006.Pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7b4c48-82ec-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699966222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966222, "uuid": "d04878b7-dff3-41ce-8319-9399960be8bb", "comment": "Malware payload (AgentTesla)", "value": "f7c5db5d1a5d5bc81cd2e30cade9d4b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966222, "uuid": "cbe07d6c-19c1-4977-850a-a443b0575054", "comment": "Malware payload (AgentTesla)", "value": "f29177a4cfd69578f868616ce53b974ee5c362b2d43e70a17277ac18bbe4d125", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966222, "uuid": "b99161ea-8fbe-4502-88ce-308805365a2b", "comment": "Malware payload (AgentTesla)", "value": "c5409e36c2e97612cecd087beb0a12baed920550", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699966222, "uuid": "778d5cab-0377-49d4-a5d8-64bd3fed7fa0", "comment": "Malware payload (AgentTesla)", "value": "c20d66dfb5541ca670434d4b1d2316a7a6b299ad58927d2eb8d8e82c6a69cf72dd2acca233cc91ad0f57aa3fe5569c52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966222, "uuid": "2ab7f4e0-79a5-4c2b-835c-e6846d6c384f", "value": "T1FDE4021632784527E96D02F8646661C15BB1FD13A460F76E1CE77BEE2BF3B8047026A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966222, "uuid": "a700e21a-5ffd-4f69-b907-6dd90a5b9ab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966222, "uuid": "64a06b71-dbf5-47ba-a7b3-138826e98c87", "value": "12288:ujfrLlfuSIN5oIVWDQn3/2KJTahrHtfdpvunCWh+0y99q3mvqFsc:EThxjIVoQP2YTahr3eCWby9wPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699966222, "uuid": "a9734f82-ece9-4a17-a1b7-4dd5683d253d", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699966222, "uuid": "02f9c65e-cd4f-45e5-b71f-d7746089297d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699966222, "uuid": "98e4956f-5bf8-4e74-8fdd-94906036c19d", "value": "SecuriteInfo.com.Trojan.PackedNET.2525.13170.4622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a7eae0-82e2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699961992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961992, "uuid": "d1d6ba29-0491-4c65-bf7b-eb05d1af3df5", "comment": "Malware payload", "value": "c96b50cd072d1d1a556051adce915c73", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961992, "uuid": "06e6871e-ca58-4965-a880-6b2e2ec3ca56", "comment": "Malware payload", "value": "f366d535c63702f7412cfe4ec1c63edc3dd86c44f2d42ce9e6cfd63cec78d930", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961992, "uuid": "2bdc19c7-23cf-4ad4-8be5-56035d07a941", "comment": "Malware payload", "value": "84d7c53e64c9b3c900f78d0749196f5c61c78e25", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961992, "uuid": "b64abd39-ecd4-4600-9738-4ae74d3d7a88", "comment": "Malware payload", "value": "5d8272fb53a91eb14c8581397db59614a4deef6773b763d0bbf5d734147834e73ef44b10a0f284602d8965ecfcb24044", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961992, "uuid": "60ce929c-300b-4286-a21c-66865fe06f81", "value": "T16D04AF11759181BBDB9E223454FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961992, "uuid": "46a2d71e-3090-427e-b5ef-fa8e9c3d6087", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961992, "uuid": "e167bc36-b290-4040-b83f-0bd36fa2981d", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlL3bVaKoXAxOPYe:I74elpowsxizqyStZlpel5jyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699961992, "uuid": "bdb1b24e-d8fc-4337-b0f8-21221d8b39e1", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699961992, "uuid": "5c75db6a-0d44-4b91-8353-f1e7e27522bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961992, "uuid": "e62a2167-4f48-4628-a5ac-19c90f93b668", "value": "WCUtil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172df8cb-82a5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699935606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699935606, "uuid": "44ab8ac4-c2cd-4af2-b025-44fe93c3a68c", "comment": "Malware payload (AgentTesla)", "value": "db20021ef37f8a25498fb305c93e1001", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699935606, "uuid": "68f74b12-3087-4760-bb58-1dd6a61d3dff", "comment": "Malware payload (AgentTesla)", "value": "f45cce1292aa30dc88decc03fe81e7c10a64e4302eb1e3faa81c385e36d2a1ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699935606, "uuid": "ca171e62-7c69-41eb-b8b6-289645200bd0", "comment": "Malware payload (AgentTesla)", "value": "8df8292eec47a50290514320a9a909dd8da32c89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699935606, "uuid": "b23596a0-24e8-44cd-96ec-9d468e13c229", "comment": "Malware payload (AgentTesla)", "value": "331e9840fea8d08a3e95191119e909da0122bad4d25b7d906bdbb21238819aa403acead6089de7513ac82e1d97f809dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699935606, "uuid": "2ce47550-2a77-48ca-9559-b5add3bc6eb6", "value": "T1ECD422137A6EAF72E7BEA7F8601650A01376B69775F1E3984DD720DB163E3021381983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699935606, "uuid": "5f40207c-acf3-4be9-945c-668ac2100f13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699935606, "uuid": "abd6a9ab-b1dc-40ee-aae7-6113f3908385", "value": "12288:3JAFnSmP3pr2jiRtGnZjrXM31m1NWtvJFcNBW4HzSGPX7Xgi4HM:5qSmxrtRtGnZjLmmCF4BBZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699935606, "uuid": "be8fd768-674d-4758-9f63-c11cbb0f934a", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699935606, "uuid": "d9493baf-6ccc-4b46-bdbe-189f646e8428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699935606, "uuid": "c09bf859-9a5a-4e49-aadf-09c8a33fdd1a", "value": "SecuriteInfo.com.Win32.PWSX-gen.27297.29099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c956215f-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982720, "uuid": "df315037-7e3a-4536-baf5-0e26f292a8ca", "comment": "Malware payload", "value": "5ba487dee668508c9f96acda32c5d84c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982720, "uuid": "647300e4-6a40-43bb-a3e0-f1ad5cb69f84", "comment": "Malware payload", "value": "f4b90e1ceaa1c88458604f34205b55f5cc7bbd11dc9da6e5fb0b2dd20215774a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982720, "uuid": "4f680825-9c69-4358-9cd0-f450054abad3", "comment": "Malware payload", "value": "02a6f24bf056fc8c10200c3a85bc56cf12d9b7dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982720, "uuid": "52dc4b3f-ee45-4042-a334-8a6ef8668dac", "comment": "Malware payload", "value": "3c726972ae46923207be8ff407d8e25628998d05f54108c8b56d6ead92eb628760cdd2a3424d7ceec3275570d1a5508e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982720, "uuid": "b39e88c1-56c1-495d-83f7-765bc3491558", "value": "T19E544A3536C1FE72D0194A326EC79EA89963B4144D3387FF2AA453AD3DB63409E33265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982720, "uuid": "cd20d6bc-03bd-424e-9722-cb0de09581b6", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982720, "uuid": "e2ebda06-2c2e-46eb-9de0-6070a5cbdff6", "value": "6144:+RR5rhZFQGrsUwF7vlPoSyHAV2A+lPM6u:+R5nWFpPoSKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982720, "uuid": "f1987ed0-6bf3-4c43-8bf3-407afeaa69f2", "value": 282113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982720, "uuid": "c3a53aa1-8d19-49b2-ae26-094fb574b4a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982720, "uuid": "f13fb306-8a40-4149-a012-09a1763d37eb", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.11834.13355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa1b3f9-832b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699993414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993414, "uuid": "4e2bcea7-4534-4d77-be15-d14bc1409c7c", "comment": "Malware payload", "value": "6dbf99cfdd2cafda6fb7898c538bd70f", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993414, "uuid": "16aeb25f-e8f8-4e21-a155-eaeb40e39240", "comment": "Malware payload", "value": "f4f0c7aa2e923da9a20f0ba9d61e81a8e5215a9a07814028c383bf7d0e4a5361", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993414, "uuid": "6b577bfd-bbfe-421e-a590-5578ce8e1f22", "comment": "Malware payload", "value": "a5f5d6b636eea8c059fece732f1e050bf8ee8526", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699993414, "uuid": "c146b1e6-dd88-48a4-98e8-442e454957a4", "comment": "Malware payload", "value": "afbef515c51037539045cb3fa956e87ed8981b05337f5b92a4fae656d4766c780a86f645eb0cdaa3fc752585c22f764f", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993414, "uuid": "3c6d352b-2dae-441c-892d-dbd33cf0e592", "value": "T1FAF5A0C4DB9DB367E792998E6793562886689F7C6124083BF1BFD5C0C08271A8F603DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993414, "uuid": "2f9476b5-d132-431c-85ca-629047e1d797", "value": "24576:wcZghLp3FWhTNnj8i8CK4QRGaE7k4nXvAd/NFaagfBvNbf:wcZCnWhTNnj82sGaE7k4fKFcainj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699993414, "uuid": "5ac204f1-14b6-4513-88b3-04cf01a9de0a", "value": 3439373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699993414, "uuid": "02b28077-5af6-44b2-a80c-60476f3bd20f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699993414, "uuid": "f52cda5d-a3c5-4c7f-b57b-bfa88ac00367", "value": "Continuing-Education-Credits-Application-AHRMM-NonAffiliated.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd592379-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982727, "uuid": "d7ebb11e-d3d0-4282-b36d-cfff01c725c4", "comment": "Malware payload", "value": "0615f7e856e6034c220aef32ad3c252d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982727, "uuid": "36d3852f-0482-41a3-8778-9817e42cb6ac", "comment": "Malware payload", "value": "f51088a42ffcbd2b95644e0861da35421244abe85928ada80ad383345ff0167f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982727, "uuid": "d30066c4-d582-4c41-bed7-fef24eea1a62", "comment": "Malware payload", "value": "63926703374b9167efc2b76a9bea4010cb3ebd57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982727, "uuid": "edfaf933-d3d7-4c22-aa34-bf7a3cccd914", "comment": "Malware payload", "value": "7fb6d3658f9ea07ea1f8557e435e6c02b22ad46e0382f25382e0567383bb82129e2733eeee11ce60a53fa21b4f525d74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982727, "uuid": "ea57d39c-e043-4978-86b6-364026081f08", "value": "T13E258D2273D0D03FD4721231892AA3B155BFBC314925A60773DA772E2FB52D29E26B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982727, "uuid": "219fe1a4-31f4-465d-9049-9f7af09eb48b", "value": "647985f19a644c7c8fa55862553f4ea4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982727, "uuid": "494c1dc2-e800-4c63-b232-830fd3d3b747", "value": "24576:BuP2/n8ahmObvWMwNibsc1adRZBch8RYw/5tn5tnDb8bV:W69zfxsc1adRZBS8RYw/5J5tn8bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982727, "uuid": "570a7b8f-1a21-4be9-b0e8-a3a8dde65ef0", "value": 1041544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982727, "uuid": "dea565c9-b0df-4880-a2f2-8d2e779d47f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982727, "uuid": "ddf68b37-b2dc-4e3e-acce-5ce5eb18a18a", "value": "SecuriteInfo.com.PUA.Bundled.Toolbar.27886.16163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce66242-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982699, "uuid": "590f9f4e-5bf4-4cbb-8bd1-167473b8cdd5", "comment": "Malware payload", "value": "679a48e624c8da722633192d2526a97e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982699, "uuid": "9402b28c-5952-4b57-9c91-845b93b5cca2", "comment": "Malware payload", "value": "f6a51523b06781d76acee7cc96c996852e35ef0e053e5c4ec5604084cbbdaf3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982699, "uuid": "55dd5666-72db-49bf-b4ea-4d47fb81e0a4", "comment": "Malware payload", "value": "3cddc5bf632fddb36159089dab87742e767d3bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982699, "uuid": "8cc47797-4431-4abc-bd33-21689f7f3fdf", "comment": "Malware payload", "value": "4319c3674fc8770706cf9a87795b29ec4e5b400ce42a714098fb101c1448bf44c0a5748e88ab0efc54515b9a56b13fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982699, "uuid": "9372fd4f-5b15-4894-a4be-424c59b9ba1a", "value": "T17F357C1732915033E6B279314B2B42AD8926FE161D78386A6BF59C487D35643FA32FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982699, "uuid": "34389ea2-2d89-4e1d-ac6b-307355981f46", "value": "24576:VfdWTzFpXnVH1BS958zRP/e4tIUkeNM5vb3rMBh28:NdyFp3DBG58p6jBbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982699, "uuid": "9f3b515b-7d09-4b84-a52a-c5aad640767f", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982699, "uuid": "96af019c-8abb-4aa6-8ee6-ba57b6ff9ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982699, "uuid": "681bdcb2-efea-417e-88aa-467656a85282", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14840.11130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0173298d-8334-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1699996988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996988, "uuid": "189a156e-270b-4330-810a-42d11076830b", "comment": "Malware payload (RaccoonStealer)", "value": "fd7ba34260b053e342c996b2190ad23b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996988, "uuid": "ccc3d9ff-1224-46fe-9463-fe70614c8491", "comment": "Malware payload (RaccoonStealer)", "value": "f6be22baa5e6bc398c0130a7d93411166fd2441722cdd6a3ec3f7205a384acfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996988, "uuid": "69453df2-6398-4576-83bb-a31b3b1e0114", "comment": "Malware payload (RaccoonStealer)", "value": "dc198db1d2447d6b223032f5d6dfd878f5c33de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699996988, "uuid": "cd4a304a-265a-4743-861a-9de53eef9163", "comment": "Malware payload (RaccoonStealer)", "value": "db50585d4ea484007b8899bf129abcfeb0aa779d837e92bdc7bdbd218877960f9c40b8e77060367d6f74a902b343c807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996988, "uuid": "7ef24271-99e8-490e-9ea6-7f0ec59afa17", "value": "T195546B1578A180F2D82309B619E5D7B19A7B75330F9298EB17E4CB7D4F203D1AF30A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996988, "uuid": "76076364-8c75-4357-88ea-90e2d470d671", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996988, "uuid": "2fdcedbe-31aa-44b6-9518-5eeca8123860", "value": "6144:KTnttntG3PuxBHhbOsAO2a+cCxO0aPYDt3EgdN:mttntGfkOs9cOFPYDt3EgdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699996988, "uuid": "8bf86e33-04f0-49b6-a13b-3e32bd0d3386", "value": 300664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699996988, "uuid": "f1b150b4-6568-475d-9f8d-6c47b65a2320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699996988, "uuid": "2ec995be-27f2-459a-9e3c-44d1b5b51c88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c582e47b-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982714, "uuid": "9896df0f-70d0-43ec-a4b1-c1aec6378be9", "comment": "Malware payload", "value": "553714b7ffe01b5daa849bc4221f1e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982714, "uuid": "b6db6d7f-a9db-41bc-9ffd-7f54028fc2aa", "comment": "Malware payload", "value": "f7c6af19e272f9017f27afa2699e68759a231edfcb1386f854121257d405e167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982714, "uuid": "48855545-6c1e-4982-b963-500ba1cd8eda", "comment": "Malware payload", "value": "82cc1b6c45f643d2fda6f8ef696bbf347b147de9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982714, "uuid": "5db1de25-7b26-401d-b136-227c9e0d8fc3", "comment": "Malware payload", "value": "33ba171e65b80d117a099ff28518e85e9dfb74538c37730fc1312d6c5e26e5e97da4dd04b843372dae9ba4b75a042cd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982714, "uuid": "adac975a-5494-46d8-bdc9-12321f7b1efe", "value": "T11E944A7367A8822CCD372033F9D092B785AE6F30AF111C8B36359B7D4B145D39A627A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982714, "uuid": "87badbf6-84f2-4aba-86e1-b35f3a38144c", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982714, "uuid": "44d17e78-c099-46a6-bdf1-ba9f42c3a3b9", "value": "12288:ZnkaR2VkeV3UYCYwpm5TnGZlZ1FNUJcl2oRjq0rfJd4Sdf7ISb3:iaYpkQwpm5TnAr1sJcl2oRjq0rfJd4SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982714, "uuid": "b31414d7-f5dc-49b8-9837-c35268e3fea6", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982714, "uuid": "c139e854-9e17-434e-b065-a820a39e5cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982714, "uuid": "1a39b829-9c61-4b73-9451-39dca0ff0745", "value": "SecuriteInfo.com.Win32.TrojanX-gen.5849.22757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79acd7c3-82e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699961541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961541, "uuid": "e9e08d3e-0084-4db2-93c6-63d63b8adfb0", "comment": "Malware payload", "value": "adcaa63353083b81150d99bca3fc8752", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961541, "uuid": "4416223f-1dfe-4a2b-bc0f-16ae88b34bc9", "comment": "Malware payload", "value": "f7ea87d7e1c7167b0ee3091546b6740386996794f72ea603c10c4643609b0747", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961541, "uuid": "94615357-fe70-4dda-8be4-038e11002fe9", "comment": "Malware payload", "value": "96ecb0f81a15741d9db2b289e70c0324d17d9970", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699961541, "uuid": "64f46a48-37d2-4253-aff7-08117cbea2b0", "comment": "Malware payload", "value": "929a786589124e6a848e132dd83555a484000fb03c537d5ac2ca9938bf12de8b100b8fb6051fe0aad543c08a4af46c48", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961541, "uuid": "192bad89-6439-46fd-a4b2-90b2c10029f4", "value": "T1FBB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961541, "uuid": "dfb8f929-53e2-48fa-a7e4-fdcdecd4a101", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961541, "uuid": "881a0ced-f24e-4b2a-a733-d2de8f3010b3", "value": "6144:7exbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7spUlLaEx:7eZeWSpda70ADIgSoxgUW/zFun7OkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699961541, "uuid": "2e9d7ce9-0916-404f-bd2f-400fb298a77d", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699961541, "uuid": "563c750c-d2de-4d44-8363-261cdf943db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699961541, "uuid": "12029122-6d6b-4a13-8299-9c506b76c677", "value": "provvedimento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d2b3a3-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982712, "uuid": "021113d3-0358-4728-bc02-160a48dd3c24", "comment": "Malware payload", "value": "0c171ba7ac8a8f86d6312c9c6ece31a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982712, "uuid": "ecabe489-cfee-4192-bce3-729153ea91cb", "comment": "Malware payload", "value": "f890008561d6268df4e91f4d14c9ec70e42bbb8f7af20fb68e368e542edebc16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982712, "uuid": "7ddbe954-32c2-4e82-a747-7f9fb1fb01d0", "comment": "Malware payload", "value": "b38fd59b39c50bb2ef59b643af61be93b29c52a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982712, "uuid": "11932ee7-6003-4c86-ac48-3ee2d493c3a1", "comment": "Malware payload", "value": "ce60431e418b6f56b638cfb745d020c393f1d96396745ad360f4ed367079ebee633535b968c3745c3367c6b176044899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982712, "uuid": "c5ba2c71-76db-4a0f-b6f8-68f6275ca11c", "value": "T1E5E55C21B2A19807C1635A74AD3B47AC9A3AFF502D38288776B87D8C2F3475374B93D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982712, "uuid": "50109054-0e97-4dd5-8adc-cf5accd8d73e", "value": "49152:9//hPS2+XaJckVmZDWEBo0ttwvUI+lw88NK:r8I+y88NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982712, "uuid": "4a5e8147-bc4c-4fe4-9115-74ea2816aae1", "value": 3141632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982712, "uuid": "457525e2-c1ed-4ffc-95ae-39f4ee7722b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982712, "uuid": "c7b18505-abba-4b50-8a0e-eb30c06aab53", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.7678.3085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c068aa-82cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699953822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953822, "uuid": "b88c50a9-39a6-44b2-a79b-08f6610b3cab", "comment": "Malware payload", "value": "0bea2274310f70b61cdd0d3854830a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953822, "uuid": "919b3dc3-8a34-483c-a61c-cb1ea38b7f4f", "comment": "Malware payload", "value": "f93737e8575d0af497e1432588bea5d62c86f7984605af2c257002b73563d0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953822, "uuid": "13c8891c-d019-4671-bbd1-2e6516c71f53", "comment": "Malware payload", "value": "112f96ccc06ac99e37243deff395361859ee9717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953822, "uuid": "87c3e73a-9d7a-44a6-8735-e38a9402f203", "comment": "Malware payload", "value": "4530b0d0c3a649bf88bacfaf5592357eb101b541539dd37a9300f2e7b21f57cce756769a0446f32089a31924ff6533f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953822, "uuid": "df707d55-f3f0-4444-93ff-b89d52915f33", "value": "T16A448D0074C18432E8B715334DBD9A69DA7DFC200B146AEFA3D85D2ECF716D1BA31A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953822, "uuid": "66544776-cee4-4c6e-bacf-5d562c1be202", "value": "3bd21c073e321959019ea60d6d842ed8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953822, "uuid": "5307e7e6-6082-4363-b3ad-611df92663d5", "value": "3072:EDja0zbupXz788zpJG6rewrR+813+siEJrOLD7BFrPBaUNknoC2l9p1WUeAg0FuP:+a0yz788DG67/+slrOLxFrDk/bAOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953822, "uuid": "e28c0f45-2339-4792-b712-90409476420d", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953822, "uuid": "f54fad52-d9bf-4e66-86f0-097d66f715a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953822, "uuid": "1b7426ee-8753-4334-80dd-cce8efb74683", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14232.7698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a3de2a-82ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699953587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953587, "uuid": "f39ce30b-a139-4cc1-86e9-864b1de589e1", "comment": "Malware payload", "value": "f7e439befdd648a45434f69c5baebe0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953587, "uuid": "ab021b5b-d6c7-486b-932c-553dc0b04495", "comment": "Malware payload", "value": "f94464959b33782231ae5a82624d3407833a812cb17c09bca2647e4476b78fde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953587, "uuid": "77b5cf42-48da-425a-bae5-0c745e748dca", "comment": "Malware payload", "value": "ca99d2b4d6674460132e8663a56447216de4087b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953587, "uuid": "a9fb5593-3244-4cd5-bc88-b4fb5b8e4e53", "comment": "Malware payload", "value": "289f41d75beaf534e55449a12e765eac70bb3f7cddea01cc819056e6dadb92263ffb0c2dd37ec4c3beea2e068722ae76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953587, "uuid": "4326108b-4f39-4874-b92d-a22578872cce", "value": "T17A24CF2277E2C072F16745359961C2B24F377CA28FA189CB27D41A7E0E253E2DB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953587, "uuid": "c7665355-3f81-4bf0-8fcd-c48b293c185d", "value": "3cf8645c93eebd6a8066c6479eebf80f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953587, "uuid": "7ec8f133-5090-420d-8449-3180b680b1e2", "value": "3072:Ua2zciPMelgMhTlfYM2v+nxvGtGK1i6SeXhuYUh+owrJu5Ij34Y6YT:yPM6BhTxYCvGtGK1iiXhuYUhLSu+juY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953587, "uuid": "9c444e23-e079-4cb5-b7ff-469207ee9ffd", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953587, "uuid": "490fd23c-181b-4b5b-887f-1a6dd66da9fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953587, "uuid": "f22a8d05-be27-4ac5-ad70-03e8e6feb84b", "value": "f7e439befdd648a45434f69c5baebe0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72721fce-830b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699979568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979568, "uuid": "e0aaaf02-6076-4796-8915-5ce6c2fda447", "comment": "Malware payload (AgentTesla)", "value": "599cabec223c44da7627bba69838c2d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979568, "uuid": "4b0922bc-7037-4ecc-b306-d6213c5f4c6e", "comment": "Malware payload (AgentTesla)", "value": "fa86b4d3e3e4217d2c502925eb6c41fb7a9bf0a17a976fc6a11a849d5861c8d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979568, "uuid": "d8477e4b-cd89-494d-baf7-f89c370f619c", "comment": "Malware payload (AgentTesla)", "value": "ff2d25f7c03d5e1a6aae09af73487584b1a124db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699979568, "uuid": "0a827e45-6960-4bd9-b483-8305d20915f9", "comment": "Malware payload (AgentTesla)", "value": "97e1d2212a658f0fcb81b47e91968297e9c0dfa63c2ba10dd0091a0f03fb49ced3e394e345b75c3d5ea946559c24d8bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979568, "uuid": "44530884-9faa-4dba-98ac-85b158d93970", "value": "T10BE4021737788827D27D02B5A426419407B2EE12B561E3EC4DE77BFD27F2BA186012E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979568, "uuid": "600cbad1-0b8a-4b91-84ca-06c9a9823bb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979568, "uuid": "fefb71b8-9c28-46ef-adb8-51462cacae8f", "value": "12288:uJX4QtLaBlPcKSqOvfWXGISQ/i4rGtXuzf5i1Jjvld0+wVKeiwDPY2Pa/VbG9iyF:bxNj/py+LepdxwVKNwUvVbGp4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699979568, "uuid": "a378fa86-b1d3-4824-abc6-cc6f04d85c54", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699979568, "uuid": "63615385-4e76-4e7c-8fb9-53ed027db198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699979568, "uuid": "ed1735ab-6b35-43f6-b217-ada8e77168be", "value": "SecuriteInfo.com.Win32.PWSX-gen.27152.6475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46cce23-82cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699953882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953882, "uuid": "194347cf-b0db-4969-b594-05ce0dc77b9f", "comment": "Malware payload", "value": "0200d4d6104237ccf6475f3beef56228", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953882, "uuid": "4010a816-e434-48ba-91a5-f703eb882cf5", "comment": "Malware payload", "value": "fdad89fe9db1c6caa09660a2abd2a99e73a8f442dec417ff49b22614057c74ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953882, "uuid": "a7c805a5-961f-464e-befa-d678be5701e8", "comment": "Malware payload", "value": "f6e7d9339a664c1a2c344990124d5e5ffe6aec3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699953882, "uuid": "89279371-17f3-4353-b325-2d6777203baa", "comment": "Malware payload", "value": "7f45410ddaba484c444b24c8d8d35625f29d25eaefb5570c6ac9de51ced46012e1c19c23e5b6c9e99827231f09b42276", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953882, "uuid": "cb7c7fb0-912e-443e-afed-feff15278747", "value": "T168945C03BAA1D261D5E3637245E8F72197E5F441A60F54F76AFB0638C7306ACA3B129C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953882, "uuid": "2d565e95-f070-4531-be7c-d8cc0e2b9e11", "value": "1c7d0efed001e965dd9c0307904ea44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953882, "uuid": "91709627-c8ba-48de-8f93-292508d02e8c", "value": "6144:MOykMFF2Wb2U4nDjcAOzyHF5HOt0q9tg36PuocNaZy8ZnC:Uk+F2wccw/HOBa6PuocNaZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699953882, "uuid": "542487ed-86c7-487d-aab1-ee94df2cf1a2", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699953882, "uuid": "5a63573c-812e-4fc2-9700-5e3cd967dd74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699953882, "uuid": "b8a2d0a1-90a1-490e-8872-46b4496d7002", "value": "0200d4d6104237ccf6475f3beef56228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f995407-82f1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699968396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968396, "uuid": "3060276d-c400-4458-9722-d5c3812d1617", "comment": "Malware payload", "value": "f13d48e0d882d10ae46569a66b08203a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968396, "uuid": "6068d3ad-d367-4beb-aed4-3fd14bb1fdad", "comment": "Malware payload", "value": "fe3b975cd1b89dcd4ec203a5c74a6b612a2df2df4f200d40b5bd2efd9ab5d73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968396, "uuid": "e2cf6e6e-2295-4838-8422-f3035d4d1099", "comment": "Malware payload", "value": "89c7f8fff942fe14c4d6ba5c499f417e10f4957c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699968396, "uuid": "187f3159-9aa1-4e3e-a838-5c6046b91cd7", "comment": "Malware payload", "value": "268cfebaf4662936865bf8269c476db6035382198358c31c68aeb6f74248f07d4e887d00a12498302da114a352334abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968396, "uuid": "88821d18-2692-4ff8-8689-8755fe57e944", "value": "T165944A1478914572C3B6B7378C81867D1D2F351A064B46AF2B5C0F5ACAA8FA3DAF121F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968396, "uuid": "10ee5c99-78e3-43b0-8741-8da4de984b3d", "value": "1c7d0efed001e965dd9c0307904ea44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968396, "uuid": "77c638cc-e566-43fa-8b6b-be61da9eba70", "value": "6144:CBykMFF2Wb2U4nDjcAOnyHusAjuguL0IPQC:pk+F2wcc8OsAtugq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699968396, "uuid": "41925cd8-0715-4569-8842-44ff37505092", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699968396, "uuid": "150172a9-3929-4a19-99a1-a672118a8436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699968396, "uuid": "b47b59fc-e830-4f87-a1d4-5db2c94a89d0", "value": "SecuriteInfo.com.Win32.DropperX-gen.28036.16112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d5d090-82fe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699973804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973804, "uuid": "f549e6bb-0e3f-4479-88bb-98493e76a24c", "comment": "Malware payload", "value": "b87e53716d1d15ee4d62bbf2a8a9f506", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973804, "uuid": "adfafe44-8a0d-485b-98fc-482609d05bf1", "comment": "Malware payload", "value": "fed92b12cc0fbc75bb1d1c661e1675f6e20d27d6d03d25174536d71125cb7a0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973804, "uuid": "0b8a9871-2f84-4a0c-8969-0bd77cffbfb8", "comment": "Malware payload", "value": "b34199355417eb56c97c7ace31d5faa716405479", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699973804, "uuid": "23afb4f3-60d4-4a91-8c30-1271aa6f9aa7", "comment": "Malware payload", "value": "2d4796b5d9119fe44abaa48420d79309c7b14a6e4a9071e385bc2df12fc42fdd395d90c8ae920645295a82014d0ca2b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973804, "uuid": "be56cc52-a936-4c77-bd5d-5978a488b7f6", "value": "T119176B61D2F1AA5DE4DB85328E2063F8A2B39427B713E396DC04E936742C6D7CEC4563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973804, "uuid": "4f51709e-f34f-4b0c-9cd1-abc39865929e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973804, "uuid": "f6262a8c-6cdc-4e72-b9c4-683bebebe41c", "value": "196608:ONqJQjRk/+knA9vau6V3b6OzOqJh15pMWBFnHXHsuQCU5SlMZ5SYr0D8udrjiXD8:v5xHwSlOEYk8CiX0nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699973804, "uuid": "f7ea7e28-8f3a-40be-b7ab-3c63262ca1e9", "value": 19292024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699973804, "uuid": "3c8bbc84-627b-443e-a784-c14e17ff678b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699973804, "uuid": "8920855f-1c9a-4be1-aeb5-aafe78a0fbec", "value": "b87e53716d1d15ee4d62bbf2a8a9f506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2a89dc-8312-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699982698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982698, "uuid": "872859e8-2267-41f4-92d6-9145276c6139", "comment": "Malware payload", "value": "ae01dcb90bbe3a119f567c5fd612bea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982698, "uuid": "bf125614-0095-4a27-be03-bbcf22d9b4a0", "comment": "Malware payload", "value": "ffede509da3e56af0d1a53dbac78a5d9fa35ce43b35f4df847f88f9b583ea709", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982698, "uuid": "9fc30166-1e33-4c53-b914-07c1409ffc51", "comment": "Malware payload", "value": "448998550fc95126f4b02b32fe7cc39796255806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699982698, "uuid": "eb442b4f-f2e9-4d3c-b3b2-3b1e7866d2c0", "comment": "Malware payload", "value": "0b35965bbef644f27dd7c10f59664168a89f2d846541909ad9d353b41c28ba70219989501ee3e67e74ab1c708d068a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982698, "uuid": "063b86a7-cf78-4972-bf67-dec58f87452b", "value": "T11AC48C83B231C09ED351D93FD8940201D2657F7AA6E45F896234780ACBF49E58D89EFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982698, "uuid": "91ae7e2a-6662-4746-80f7-9831f94ee412", "value": "0d458aacb602cf874f804b3959e44b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982698, "uuid": "1ba16646-a510-4f3d-9d9e-fd0522244110", "value": "12288:oLx31h4OkVUuNFviioPxGUkKZUkYGuhFkH676a9PEzd4:oLx3ZkeufivxpkKekYfhE6Wa9PCd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699982698, "uuid": "8dbcb804-34d0-4e0e-ae0f-d43182a7cdb3", "value": 595592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699982698, "uuid": "86622639-262b-402a-b5f9-1ba693b9929c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699982698, "uuid": "de4b9ce3-7c14-4803-9fc6-2cba2b31f721", "value": "SecuriteInfo.com.Trojan.0055e39a1.27453.6351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }