{ "Event": { "published": true, "date": "2021-12-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-13", "timestamp": 1639440181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f9ad931f-a059-4088-a085-1b627697b079", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e31695-5bff-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639391488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391488, "uuid": "83e453b6-e19f-4ed0-b912-80aadb899f45", "comment": "Malware payload", "value": "30bfa06c47fc8f02168c35c08d01aae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391488, "uuid": "d3c7523a-e178-4234-8313-71ce0ea862be", "comment": "Malware payload", "value": "0071956348a81cb84c438c535466ce28d4b53f79ef4c4861cacf5fe62d2be5a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391488, "uuid": "4904ff44-9db7-4847-ad83-bb09899aa41a", "comment": "Malware payload", "value": "4c1da5c441873ba2172769e4d9ef12db75a2de04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391488, "uuid": "e2308121-e326-4d39-a3f5-9af3abd3d773", "comment": "Malware payload", "value": "ef551cad5f513caf4cb2b9ff344fc7d84fd94998cf1983088b334f85094200abbeead94e4a1704a629fd38bc0456c1b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391488, "uuid": "5a687e8a-c2a1-47b6-9999-5c4b6e293b75", "value": "T165C4BE5E35D796DCF87AD7B43BA5718403B5BDF2E103E19DF888304B5863681BA22272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391488, "uuid": "e02ac6f9-5709-47fc-a571-fd824cbfc8cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391488, "uuid": "569bff66-167d-455a-abd0-23809831b2e7", "value": "12288:SR7Hu+A+nIlkJiKqQBM6fjQqHNYVhGnnKOatK26bhewZ0zw:6umnIlkJiKqPok+NYunKO86pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639391488, "uuid": "d0e5b0dd-70c5-48b5-8cad-337b9866978c", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639391488, "uuid": "5bab5663-e49d-4861-9291-ce089f50a779", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391488, "uuid": "b734062f-f1ae-4b31-9582-e955aac75ded", "value": "TNT SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881ccc6d-5c61-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433450, "uuid": "f7245a52-e5b4-4cb1-b567-74913db6304b", "comment": "Malware payload", "value": "0d20980b3b439d157a9a3893d425e1b8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433450, "uuid": "a7b648ae-5b84-4983-bdb2-3f14039b182f", "comment": "Malware payload", "value": "013bc060ec27044cdaedc482e22357c113609036160d87fbfca5df894d00838e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433450, "uuid": "70f6fc72-33af-4b3b-938b-81f28262426c", "comment": "Malware payload", "value": "7a6970f2f9d333ecda1be45622e0b25acf64238c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433450, "uuid": "95a96793-57d7-48ff-ac4a-0ff23396c56a", "comment": "Malware payload", "value": "f4c69f0390047d092bfa1e5a4b4d12ff2a32952536e9d12059a5eed54d7c9a118d53c9d98c4a5ff46ae47c3cf601c357", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433450, "uuid": "61afbaa4-3dfd-425f-86e8-7b89d8d37810", "value": "T13F156B1276878632C4821131596FD7B01A39FC214B7181C772ECBB9E2FB27D0A7766DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433450, "uuid": "49948804-7c23-4b9b-bfad-5393982e7048", "value": "12288:GP3J9u7vfDE9Q23Nn7ByIuyBlpOuq+8wAb1AlFp:GfJ9u7vAq23Nn7BjlpOu3dAkFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433450, "uuid": "5c36b4e9-047d-4b5a-8716-ab073cdc81d7", "value": 901092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433450, "uuid": "ccdda431-ff9d-482d-9f9b-95fb3bbaf031", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433450, "uuid": "df19ae04-719f-4eb9-9682-67997be61b7b", "value": "shipment.update.jar.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745c5dd4-5c56-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639428693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428693, "uuid": "a590801b-9e0a-4a18-a15c-02123d819a21", "comment": "Malware payload (RedLineStealer)", "value": "c4c940008dbe4cfa94bbeac1d1f2efb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428693, "uuid": "3191dae3-0f47-4224-8df2-e65f22106653", "comment": "Malware payload (RedLineStealer)", "value": "01a44b51bc44a258ef0088bdc5c96b19857d11019fad57e9ae2a97dca17778e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428693, "uuid": "7cefc91e-8432-47b1-88a1-f66dcbba1f40", "comment": "Malware payload (RedLineStealer)", "value": "aa19556b9bf50a4760615609d50eaf36fda20040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428693, "uuid": "5190a292-1798-47a5-8ba7-65b898a8b8f5", "comment": "Malware payload (RedLineStealer)", "value": "89f945821db5c4ca9aef6db3f8bac51c16fe34689755e70c40f3d1ab2dbbdaab0f6cfbb719bcebbdbc88b748e3f55c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428693, "uuid": "17c4aad4-1405-422e-af55-89396d8cf3b2", "value": "T18964E002F5E0E8BDD6B305315430C7E54EBFBD926A70464F7B682B9E6F726804A6C316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428693, "uuid": "437819bc-e723-4ac8-b43b-6b7e7f7715fc", "value": "794b7cd20ec7276fc8d2300f9007d7f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428693, "uuid": "65245dbb-bf29-4dcb-9a2d-081a505af1aa", "value": "6144:d93Yi0p78/aIMu20GrmwNq4B6N5uod6oamk9X:fIikw/aIMu2VjBqIod6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639428693, "uuid": "31bc5d68-3369-47a6-97bd-eba78618592e", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639428693, "uuid": "8f15b90f-30f9-45ec-8582-98a7239dc98b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428693, "uuid": "be63bdc2-d48f-47f9-8fce-e0b1d1788237", "value": "c4c940008dbe4cfa94bbeac1d1f2efb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9112d201-5c24-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639407266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407266, "uuid": "33c7168b-dd36-4a81-a56e-496683221a9a", "comment": "Malware payload (RedLineStealer)", "value": "03060ce5791cbee695224bff10984910", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407266, "uuid": "ffdda0ae-cbab-4cd8-bb18-fc0be56e5acc", "comment": "Malware payload (RedLineStealer)", "value": "02880a81b63c1b1918b7755b35a9b932eb83b8c929060f166d1bcda85d33f933", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407266, "uuid": "a328e11a-11d1-4e99-9437-982ffe6fe6d2", "comment": "Malware payload (RedLineStealer)", "value": "dc3ad02b5db58c9935510c340c48b15af3d53a20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407266, "uuid": "169d3203-0bce-4be7-84d1-73f43006c735", "comment": "Malware payload (RedLineStealer)", "value": "f389acd57bc4b780656f69cfdc88a8890f7f92be811d5e177a958d86b69cf80f0a1ac97f15a733e3cf443b18fbbf8967", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407266, "uuid": "2db25743-bbed-4dea-84c1-f8b8f72ce71f", "value": "T152A35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC164E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407266, "uuid": "c00650cc-d1ea-4ba5-beb0-7eaa81e036bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407266, "uuid": "2b953d3d-c5bb-441c-acdd-8c0a1989eea4", "value": "1536:xqskjlqzWlbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2m3teulgS6pk:fYUeYr+zi0ZbYe1g0ujyzdwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407266, "uuid": "08529f95-36f2-41d0-9eee-06dbd8a54f4d", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407266, "uuid": "87eecd3b-305e-468f-ae4b-ee1cc1c80d60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407266, "uuid": "6c2487b1-430b-4a12-bc9a-80eff33e37f8", "value": "03060ce5791cbee695224bff10984910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca70615-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408117, "uuid": "326b6cc1-7e5a-4d5d-9fdf-4255f4a5464e", "comment": "Malware payload (Formbook)", "value": "3c886f37d1b85bc35a264d008e1d8741", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408117, "uuid": "e1df6281-f839-4b16-9da6-e130a7b77438", "comment": "Malware payload (Formbook)", "value": "02901541cc6b46c7b191735463f714c9f3e57f89dcdf2e6f51d5a033d84b1508", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408117, "uuid": "f3886b29-727a-4676-93d5-01d9d7b1fccf", "comment": "Malware payload (Formbook)", "value": "5120e6c1ff075fc9294567fba0da780931376166", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408117, "uuid": "98aad4f6-598b-471f-b6ee-0df5c888be19", "comment": "Malware payload (Formbook)", "value": "1e66cb7bee3e4cdf5d48915a04f5faa54a56cb98b57dc15f99802832ee27882e6428fa752de654e3088973cfc7a2cb7c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408117, "uuid": "4da6515b-bbee-4602-8df8-d9b24a1807c8", "value": "T1BB641235B33926B7D9E215B0FC0577C46E9BFF14CE32A456655832DFDAB4E0A8800A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408117, "uuid": "26cffa8c-4f29-4ec8-b4d7-c9b7d9fdbd5c", "value": "6144:pTZOnTO+/NVmmz4CNcLrPMoxfgUzbMw59gdVoklzKaQ8:14nlbmW4+cLrPMoxfVcA9Yoklu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408117, "uuid": "1e5ddb5c-ac77-46d8-9aa8-4a464f1d8182", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408117, "uuid": "d65cb864-daf5-451c-b11d-7b51c5e3f4d6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408117, "uuid": "980e53c3-e65b-457c-876e-303c9443bb6b", "value": "Company profile.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a56352-5c51-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639426713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426713, "uuid": "128a1086-c7f7-4fa6-a830-e70b5f0518d7", "comment": "Malware payload (Dridex)", "value": "351e97991ea2f7d9e24c594776c11d6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426713, "uuid": "6368a726-f062-4af0-8d15-1267caac2afd", "comment": "Malware payload (Dridex)", "value": "02b4e73080d8846e3a1e57a00f0f332a68df4355d14be50811f62c50f03830c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426713, "uuid": "c4a2e330-f6cd-4e98-9d39-cc3f605c4fdf", "comment": "Malware payload (Dridex)", "value": "bbc72a2d44081950395a43a7a46f8eea2fbc16b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426713, "uuid": "7475b99b-7db4-45e3-9c66-9033c10d6409", "comment": "Malware payload (Dridex)", "value": "22f15b55105d9420c8e5929cffbfd951d560a2c61f26e789623421f7199e43ad57f27eabee4a0ab7e60063a1090e70d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426713, "uuid": "3536430b-ea94-46af-9d6f-ba9076b2614e", "value": "T1EEB4B0D1F05FE94AFA5F46712E189932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426713, "uuid": "2ee3d784-6298-43cc-80e5-c3dcf948d56b", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426713, "uuid": "b0bd75da-4ad0-4e79-a076-f0993edc1a2b", "value": "6144:4KMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:49hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426713, "uuid": "adaf074a-50cd-407d-b812-caaf4412a11b", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426713, "uuid": "32ff8c03-7e99-4f67-ab0e-f42150a472e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426713, "uuid": "e1210122-e16b-4cf7-82ad-d468239ca228", "value": "351e97991ea2f7d9e24c594776c11d6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521c4c7b-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639414032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414032, "uuid": "08f36873-a6bc-467d-bdb7-c2ce1d0aec81", "comment": "Malware payload (njrat)", "value": "1c41af81f1c37f70962c835596703b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414032, "uuid": "004948a7-10f7-4cba-a0f6-87c92bd61882", "comment": "Malware payload (njrat)", "value": "03447599c5357fc3645a073317f6ff86c672af2d227bf82cdfb7f9b1629eb434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414032, "uuid": "7599a990-af7b-4775-8ffc-4e7f8e9207ef", "comment": "Malware payload (njrat)", "value": "451d21755ead253c6e91adb92064ae6505366a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414032, "uuid": "cdf25871-a48e-4784-80b9-a3ac75d29382", "comment": "Malware payload (njrat)", "value": "14b44550095a814d058e72c2b425e2be0c6a71a6101789f4c3a2a822d80bd6b02926ae73c03ddb3f14d0855312ac5879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414032, "uuid": "251d0350-0646-484d-8319-03a1d6037462", "value": "T16A032A4D7FE18168C5FD067B05B2D01207BAE04F6E23D90E8EF6649A37636C58B54AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414032, "uuid": "d0ab9548-bce0-4bd4-a669-c1abd1c0e41e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414032, "uuid": "973c284e-884e-492e-a98d-515dcf8ca4a5", "value": "384:LWwDylgibfjpPu7w9qyMTIvfTSs2EWfCrAF+rMRTyN/0L+EcoinblneHQM3epzXn:DWNN9ZMTIvWVENrM+rMRa8NuPCUXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414032, "uuid": "64634a62-95bf-4747-af3a-1eb3dc786fde", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414032, "uuid": "4066ddfd-aa7e-476a-93e6-d0504b3cc08a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414032, "uuid": "49c4fb06-7406-4935-9767-935f05258e98", "value": "1c41af81f1c37f70962c835596703b46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e860980d-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408271, "uuid": "8f223de2-4249-4185-9389-89dbf182d6f7", "comment": "Malware payload (AgentTesla)", "value": "88e09abbffe9ec0ad5db8a50ff5a51e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408271, "uuid": "10f84655-089a-44b1-b303-d6f60c82754c", "comment": "Malware payload (AgentTesla)", "value": "03ab596f7b9487bd40e7a2b55c79a7f0b36f3c526a0fe13ec8b1e406279a2f6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408271, "uuid": "fc45f9a5-c943-4539-a597-50be867dcbe5", "comment": "Malware payload (AgentTesla)", "value": "fdb51e38088e28571e79074ee2da1a38a31138a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408271, "uuid": "16e31ede-5ef8-4f25-9209-f5cd28bfa01e", "comment": "Malware payload (AgentTesla)", "value": "f49c1a56695a0f704bfef15dcdf94c3b7c1356c1ea8258656ee945689b5f905fb59f930110d5aa890870fbcb07248eef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408271, "uuid": "bce2f703-2cbf-413a-bd69-9927e14ce134", "value": "T17D641204373BAFE6D46B5CF0251B93EC7256AD86CFA668D181947F0D6632B31B9C92C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408271, "uuid": "95ef3306-f851-4c98-9adb-b3b8c80513b3", "value": "6144:SUtfxEN8BAjo3UGaUrxIe5mgAfOYL2AETWayWQJeR3hDObHaiB7+JINj:dtuN8Eo3DxIe5msDAWWayO38HIuNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408271, "uuid": "84f1dd13-06d8-4e5b-9d46-a943a5df6b28", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408271, "uuid": "599ea0f7-ccb3-4ad9-a2e8-ec643fbe2348", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408271, "uuid": "bfc5e2ca-e341-4ae7-b622-dcbcc01bc482", "value": "Order list specification.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19790a1-5bc7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639367404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367404, "uuid": "163f1439-aa06-4fc2-b097-b6260ff202e6", "comment": "Malware payload (Mirai)", "value": "006445641d2d66683c37d08cbf8fcb21", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367404, "uuid": "8c4f823c-8fc9-4895-a457-312a7c470dac", "comment": "Malware payload (Mirai)", "value": "047bd24a33066d7828e742e62ff372c86d534bb458055fbe19d119d40516b4ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367404, "uuid": "2b87e42d-6f82-4dca-9e76-5c7db70c2b1e", "comment": "Malware payload (Mirai)", "value": "6ae88fb8a5169d227773e2a8247ce44839452b35", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367404, "uuid": "a7ce9f68-a6c2-4189-b6d2-15768be59354", "comment": "Malware payload (Mirai)", "value": "af513ba0015e49ad6c22c090feedcc8fa831ecd8a651c8f2c78be8e08c4719a50e0fbab9cbeec2833f07db6d6a60ddfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367404, "uuid": "0046f0f6-b73c-4dad-b3ca-fbc740b323e1", "value": "T1FDA2E1626C270F6FDA6CA3316486761BDAD03871C25E0316C6B8565F26BF035F8E30C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367404, "uuid": "4a207c09-5cdb-45b2-8e35-e9321b2c1183", "value": "384:MVKn2cNV2Jq5AeALov9O/ogWlU+pE/lnb8csNQBKxxp4OsM9j6CjVNy2l:JfVB+eALovIoix9nYPx/hVCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639367404, "uuid": "11a058db-902e-429d-b2fe-83544292a3cb", "value": 21908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639367404, "uuid": "34235c05-3670-4c89-9fcc-431f026b1bee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367404, "uuid": "daec4d13-de57-40da-8fda-a78871de6563", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2f5016-5c46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639421777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421777, "uuid": "2764e1d9-7f10-42c8-a935-b7f0b28e1ff5", "comment": "Malware payload (Loki)", "value": "b401523afb3e0122d00964c92e1fe2ea", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421777, "uuid": "337cf348-33a3-4f25-ab42-b316054033a2", "comment": "Malware payload (Loki)", "value": "071f6a846ef55f40bd430507bec2649deaf832ce64d51a092a955a1b0dc236a9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421777, "uuid": "51cb1ca4-36a8-484a-83d0-7e88a659717b", "comment": "Malware payload (Loki)", "value": "0394f36ac229eef739d7d0750ac89fdc3851bb79", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421777, "uuid": "58f67870-989d-4d86-ae80-cfdf4702fede", "comment": "Malware payload (Loki)", "value": "4e784aebc3395bcd43b7d8502f85c7378a159f102446c7ca6c2559e56fe03a31541286b7451034ee2476b97dda0cd5fd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421777, "uuid": "868f083a-77e3-4acf-b063-6b280baa622a", "value": "T1CD5109B41BB86844EF3F069BA4B4FCBC01F5315B52CA029D72BCE9C70722329B0D1152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421777, "uuid": "f0225429-dbf9-4755-8c44-a968a5b4ee97", "value": "48:YvW6Fz3AsKK/aED2Wcg4zDY1ZhnnEjC2VLl60BRRW0uK/875CMsXESyUuPmH4e:Tgz30WacZBnEjC2VJZB/WPn9CMsUSyFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639421777, "uuid": "6e989137-a44d-441f-b495-be8704e23511", "value": 3169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639421777, "uuid": "6e36e4b8-f3f4-4337-b399-a22dcb6015f3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421777, "uuid": "4085e90d-092b-4843-a100-938b3639254c", "value": "facturas pagadas.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d829b61-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639415340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415340, "uuid": "82458fab-2444-4cf1-a93a-df10517e14a9", "comment": "Malware payload (Smoke Loader)", "value": "6d60150575c66b311938d99a4dafda80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415340, "uuid": "c4634b2d-ccc8-4dd9-a7f1-9feebbd58eef", "comment": "Malware payload (Smoke Loader)", "value": "09299aff6aa2c2615f40dfbfe6606dd11cb87dcd629875b6510300255c340e93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415340, "uuid": "d3a2f90b-a6c3-4dca-b649-32450d8e9632", "comment": "Malware payload (Smoke Loader)", "value": "732da1e147a766e9d2636a0afa8c4432d4662308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415340, "uuid": "707c00d2-0150-4760-a13a-e4e4704ceff4", "comment": "Malware payload (Smoke Loader)", "value": "c859d5b1952bd0c8331a9a39d6e56d3ba901448f04b8796926a23902ec2a881771f221a8de89196f2e5c65f16ebcf45c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415340, "uuid": "08dbf3e4-ce95-4f24-8ea1-2310d861c2e9", "value": "T1C6149DC175F1C573D5A239308860CBA47E7BFC72EA60454B767826AF2F722C05A2535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415340, "uuid": "3ce8421a-e8c1-44fc-8e18-b74b06579070", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415340, "uuid": "cf1a68cb-10ce-4a3b-9ca1-2bd747c78747", "value": "3072:Dt0BOM/69h9gj2vRc53jX96nun75GZwpokhsZVggjcGkNIVqIZh2:AH/GSA2BjXcnpT3b7ITsqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415340, "uuid": "e5bc172f-8d0d-483a-a5df-d47687772db0", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415340, "uuid": "5696e69d-16a9-4f65-a0ff-0979fbb894f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415340, "uuid": "e7d7aa09-67b8-4bfc-89ed-32271d24b696", "value": "6d60150575c66b311938d99a4dafda80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250f9e6b-5bc3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639365424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639365424, "uuid": "f6f966f6-c3fb-4934-8111-f3ef38fde85b", "comment": "Malware payload", "value": "d2e12dee6b918dbb48431813742c422a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639365424, "uuid": "5b0a4d85-2742-4ad4-8293-43e9f639bc40", "comment": "Malware payload", "value": "094b0a52e46aecf71145ac10cd0428453c8284951e6580e8163f6fd37a4cca4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639365424, "uuid": "da84110b-a335-4665-8067-9d99eb552e9c", "comment": "Malware payload", "value": "95303f66c631c815dba4e01254f3b7c65d7dfa5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639365424, "uuid": "e4bcd75e-c1ed-4e73-b7cd-9496302436e7", "comment": "Malware payload", "value": "c2fec5a84ea30328c265be02f4133a81ed20e8fbc547fcbd4f1fdfd2ee039e11ac88287eb3d6d7f23c16a09700e3157b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639365424, "uuid": "5d2a4a5d-55c7-45c7-b80d-2f56b5ba2347", "value": "T137C402717AE1C072E96754308DED9360FAB8BC351774858BFB900B6C2B62AE1D726713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639365424, "uuid": "8a1d5a11-a570-4962-9888-7f9b0196d45e", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639365424, "uuid": "5f9c2dce-fd6e-4a31-950a-238378994187", "value": "12288:yw35dS4X8AnVq+uPQtJ5ln2AdweN7kGeCRnlKwigm1+:z35dPpHCaJ5ln2AdTN7kGHRn4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639365424, "uuid": "4fa8679f-8790-4166-9cff-c8f758f12cb5", "value": 589369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639365424, "uuid": "b78292d8-f4be-4d5a-a8b6-5d3300e926c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639365424, "uuid": "a1d8bba1-cbd1-4f83-b3a3-7fc71ee5e1af", "value": "Sales_Invoice_SI-IRE-00001026_2021.10.22_08.31.27.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccef3a53-5bcc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639369571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369571, "uuid": "156d02cc-08e9-4bbe-8402-32ae465f87bc", "comment": "Malware payload (Mirai)", "value": "42488a880b8e97e96479c6139453d74c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369571, "uuid": "ebc141aa-20ea-4de5-bf47-e8f28d861e3a", "comment": "Malware payload (Mirai)", "value": "0993ff10ed39f38319d5ec70712c7423940b5a845cd9b1278357b872769640f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369571, "uuid": "5189073a-b92c-4f6e-9c81-a4ed202b1bd0", "comment": "Malware payload (Mirai)", "value": "7c92187dd78cb0173b00173769b594a88883738f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369571, "uuid": "48834ad5-e036-4591-8e82-95461e978ce7", "comment": "Malware payload (Mirai)", "value": "a283fc1449de71f11c44530d74adfcb8f5f5db324124a4a5467d70c3eb0b7ebce76509593790fbff3cb394e695fd0132", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369571, "uuid": "c4ee4b63-a908-4f10-b490-92d474d5ebd5", "value": "T1FA334B25BA791D57C4E8647A62F3432AB1FA124F60B88B5D7D720F9DFF605C0A80B1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369571, "uuid": "ba48f5fd-175d-41d4-bbad-ed34d208f1da", "value": "768:jjA7oR5qN2ZGUrIauwyCQggqsdivO+P6XlkTDabEb/:vA7K5qNAGUrXuwyXxdiT1HaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639369571, "uuid": "b1ac85a4-b94e-4422-beec-06f0568682d7", "value": 52096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639369571, "uuid": "2e43c3e4-9bd5-4884-b35d-52d7554a961a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369571, "uuid": "c06be173-33a2-4f6b-aba1-6ad6d175b997", "value": "42488a880b8e97e96479c6139453d74c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f99956-5bf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386393, "uuid": "46c7aaf9-f333-4b5b-9d52-de75798d8902", "comment": "Malware payload (Mirai)", "value": "69f04e4417ab84863147ec58587a21fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386393, "uuid": "01ac2301-e28d-44ad-bc4c-295163ba26f6", "comment": "Malware payload (Mirai)", "value": "09b6db348b3fd8c95c0cc3f691042d978bd875b659e738f9f8bfc94f66955985", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386393, "uuid": "3d0bee7f-81f4-4eed-9f55-558bc8d3140d", "comment": "Malware payload (Mirai)", "value": "92149c54dcb84c74b707ae2bb1d46bdee5ab0a58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386393, "uuid": "3e2b69bf-f5a3-4913-b17e-6cb5448a20a5", "comment": "Malware payload (Mirai)", "value": "9b77c973d2209307c0347cca96cf1f34a30fbae1d413a8ccbed054b72246235f96dd3d62a17292942d756652498dad46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386393, "uuid": "40be6173-3931-48cc-957f-825e67ab7af8", "value": "T118933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386393, "uuid": "b7918b1b-d70b-4c09-8ce1-ea69ce04e696", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8El4umXxVqDrstKfz9e:Q97vk51RcG7A2l4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386393, "uuid": "ff33b7db-7791-4a28-9506-1fc41721975f", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386393, "uuid": "f2793e04-e2f6-48b0-a0fd-66283d489121", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386393, "uuid": "404c90d5-36be-4e2b-9e7d-b2f14ef123f1", "value": "69f04e4417ab84863147ec58587a21fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51958c59-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639388262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388262, "uuid": "86aacc4d-6aff-4134-9f2a-6ec4a8772073", "comment": "Malware payload (Formbook)", "value": "e6a2fb1862b646efd9f16b74aba41429", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388262, "uuid": "8e80c1c2-b418-4127-b6f6-79f4c6857ec0", "comment": "Malware payload (Formbook)", "value": "0a0b295f224de6fde72016769bdff87301bb1b501616875dc124fe016d403703", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388262, "uuid": "a8f45d4a-c0b4-4099-8b13-d3e312076187", "comment": "Malware payload (Formbook)", "value": "1f5cb86dc2289d48769fa02041ed50d04c8d7d9c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388262, "uuid": "46c450c8-cd3e-494d-8df9-316be71d6ccf", "comment": "Malware payload (Formbook)", "value": "1f7cf6a674d4599023df22bf53735104396be52a994aa416404d6bff870abf87f8e027d235ccebf19125c95ee6ec5219", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388262, "uuid": "81bb29f8-7325-4788-bc3b-52a3a641e75c", "value": "T1379533AC0CEDBF56CA0615BD94CB90EC5525980D30D37C0DBD25D63901ABCA7EAB268F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388262, "uuid": "e5b95753-c48e-4081-9365-f4e91192f975", "value": "49152:gmzDO4SvI2YAX75qqQEo+W1FOHH3Fnp8CR5yUwyrvN:goL2YORQEo+kUHVnpzTmoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388262, "uuid": "91e81a91-edd7-4539-8a3b-f053c153fdb5", "value": 1934424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388262, "uuid": "f490a599-8fd2-4543-a7e3-a760f1a3415c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388262, "uuid": "bfdcd226-c630-4f49-83db-d36235d48633", "value": "LC Amendment Copy no: 11214928.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65ed94f-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639408617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408617, "uuid": "76833897-d1fc-479c-a0b7-39b1bba4a0da", "comment": "Malware payload (STRRAT)", "value": "1c26fc689838571c525ab1956f441c92", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408617, "uuid": "7923cfda-2f8f-48fa-99e3-8d8d261a370b", "comment": "Malware payload (STRRAT)", "value": "0a6b8da241ae9c2fb8b7b8095ab51da1caedc0af4d56185bc47bb2b8158d8dc0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408617, "uuid": "e36433f0-2365-4601-9424-87c068f0f22a", "comment": "Malware payload (STRRAT)", "value": "873619c5b8264326cfb53c1a025b1bddf4da6e2a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408617, "uuid": "0f1f5efc-80c7-442f-a408-9836e4aaf25b", "comment": "Malware payload (STRRAT)", "value": "78d6d281217ca9a3f604f6ccea526ceb93bd698a0adcd6bfc7a3be157931fcf3e93ba21987adb9c0c9d8b5eb6e543750", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408617, "uuid": "3c00c6cb-8600-4a31-be1f-13d83b181f31", "value": "T134A3D00BB9AA80D6D42BD4375209C571EA1E895CE056617FB6FC492A0CB187D0F26BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408617, "uuid": "49e59ae5-734d-417e-9d7d-8a0715a425fd", "value": "1536:uDQa023Drqu/rNjI1byHkXGpG7FF1h4cMecPJYIo3KnK3u5cWAcvn6RetX+WXky:uDQ23LNYWTpGxlHE8s5cgUK+Ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408617, "uuid": "72bff301-7067-4e8c-ad9f-cc5cc7d74ad8", "value": 104346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408617, "uuid": "01922c98-f6f7-49eb-95d7-c6f9d80f25e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408617, "uuid": "732f2517-9025-4f4d-ae01-6b338f680017", "value": "Scanned.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e16610-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639426140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426140, "uuid": "8d8de1a7-09f2-42d7-9918-2b88f2d31585", "comment": "Malware payload (njrat)", "value": "ec08bdb2c15f50947f399f1f3825b69b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426140, "uuid": "e08ccc09-f74a-483d-a7a9-90b65366415b", "comment": "Malware payload (njrat)", "value": "0ad97be849c854ddea3a0df0597c8e9b2dc8dd4d274b9f4a89f2dc3e9a9fff3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426140, "uuid": "32bcf6f4-6faf-4bf9-94e6-9fda5b13894a", "comment": "Malware payload (njrat)", "value": "602fe73180c9662ce229d090075a33e7e2cbc56c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426140, "uuid": "878c1e79-4c10-46e0-bf5e-bbb9d0635699", "comment": "Malware payload (njrat)", "value": "124875fe6ed3015e53b7375cde3a7ea0e7513519bdb6ab07178be3c07bd394f905a9bd6f4cada6e2556d7baaec5155a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426140, "uuid": "0a4edd62-08e7-4076-9e35-ce337d706948", "value": "T177C2D011F766C656D94A4BF25B2783517274D1E02EAF0E4A3C4C19AC7C61FC648EBB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426140, "uuid": "db5ead58-fa37-4b09-9ca5-25f875638d17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426140, "uuid": "61670001-3bd3-43d7-8a58-6d05c3a418a9", "value": "384:sv3ZI6LjWJgIONV2//mtdNWmUBYo7b8SHmfPqb8LP9Vqvfas:svpeW9V2GrTUHv8SwJLPKvfas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426140, "uuid": "3a77890d-6494-484a-b09f-bc8312806102", "value": 25960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426140, "uuid": "632bb533-831a-44c2-97c9-156deea1ba27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426140, "uuid": "e4b4e091-060f-42f2-bcd0-8a6a81211265", "value": "0AD97BE849C854DDEA3A0DF0597C8E9B2DC8DD4D274B9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9a4849-5bcc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639369575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369575, "uuid": "1b695c30-ec63-4bd5-89df-7d02dad1fe05", "comment": "Malware payload (Mirai)", "value": "486650f7e58cd7e8d080797a036ab2c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369575, "uuid": "2224d29d-18cd-4c49-8cf1-d4e231bbaec5", "comment": "Malware payload (Mirai)", "value": "0bf8e68f7106ffb001444696a06188724cc2849dda4074cb3fcdaf6f0dee28ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369575, "uuid": "4932b560-3206-438d-beec-f50e5fde8572", "comment": "Malware payload (Mirai)", "value": "06ba9759d6eec441dcf31bdc1cba4b1515cdf9c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369575, "uuid": "bb07f99c-d43a-42a6-9786-f3835ca785b7", "comment": "Malware payload (Mirai)", "value": "bea261920c78f2a88f82f325ea4dbec50472894bbf161c0024a67086fe2da21f760e4207960830ae918d7981ae4ff0dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369575, "uuid": "b5e27d28-2fd8-4227-9ed9-ff4ce3ea5fe9", "value": "T1B5A2D021552FFD39DB708832DFA58B857752A7B5C6F838671B080EF8B9400027BB4297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369575, "uuid": "67905292-3549-4731-aba2-487cbf27c2de", "value": "384:CgLEC5rX9ikrP18Cxncl8CtHkobn5/B0xGxQGmn+kpRJ+fzQ6rhymdGUop5h2:CoESNiC8CxnUdhD55uwXmXJ+Ps3Uozs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639369575, "uuid": "2f3142be-8570-4fd2-b000-05254bab9d31", "value": 22476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639369575, "uuid": "2d9a7b1b-1820-4551-8404-4d8294f09bb0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369575, "uuid": "e9ed951d-bd3f-4bf1-9f4d-07cdf2a7eb9c", "value": "486650f7e58cd7e8d080797a036ab2c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dc0acb-5c56-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639428615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428615, "uuid": "234ca023-44c0-49df-a4a5-41ef05b7dd85", "comment": "Malware payload", "value": "997dce89cee41eb6d3fac09e715760da", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428615, "uuid": "08e8f170-ad83-4bf9-b270-2ba3df31f996", "comment": "Malware payload", "value": "0c465301f933cc0416656138c8a41616ed49b86e4da17a9c95ccc3088fa0f65d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428615, "uuid": "801958f5-f800-44d1-9566-6a7604cc01c0", "comment": "Malware payload", "value": "a047751c60a3c77b8f762e5ecd9e102115746a1e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428615, "uuid": "33cf5e43-114c-4c02-b243-70d148c6cf4f", "comment": "Malware payload", "value": "e179474f974144bc9172bc53e0663461b070bb5850579093fd3059aeefea17887a61b6888ce2d4bd93dd3cbf1ba98114", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428615, "uuid": "bff68c30-33e3-492e-bc7c-9bf065f39e59", "value": "T16065AD4A725449A9C9A7D17CC4438F4BEAB174018370D7DB17A58AAE2F233E21E7F721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428615, "uuid": "a2a6fc39-f22a-4546-8fa9-44f41b412382", "value": "24576:QEPWmMKGIxMZXxMFLqE4a6fn4l5OzsDH9q7FyRF8xpwPLxjFDXj8lKCCEN028Sdh:QAvMKG2C6FLka6fn+A1N0+ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639428615, "uuid": "9bcfeacc-7de1-4d31-8779-35d9b758163b", "value": 1460224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639428615, "uuid": "659722e3-390d-408a-be3f-2c04020dea99", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428615, "uuid": "874f2739-703e-40a0-9740-a1d850cb00f9", "value": "0c465301f933cc0416656138c8a41616ed49b86e4da17a9c95ccc3088fa0f65d.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc25d64-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639408171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408171, "uuid": "466632c9-19eb-4eed-b1b9-6f11dbc5b3c2", "comment": "Malware payload (Gafgyt)", "value": "f5e9685c83fd7fd4cfe4efcf8bcc949a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408171, "uuid": "d2245cc2-3f26-42fc-bd1f-3443896d57dd", "comment": "Malware payload (Gafgyt)", "value": "0ce17e3302ccc08b16c5e2c2daab97be2d030d6fbdcf0341fc357912ef06162b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408171, "uuid": "f885b294-c5aa-4df7-b1f0-284abf14fc88", "comment": "Malware payload (Gafgyt)", "value": "7ab758ad9ad7b7b1278f5f727a58dff19d35901d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408171, "uuid": "807f1a60-e5fb-40f6-bbad-21cb9a3bae50", "comment": "Malware payload (Gafgyt)", "value": "ad6ca504437f9a3eb0ecc271551d36f6d84b4b50cb890731388a67674cae36904307fa4919400d7778384baba4f93ad7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408171, "uuid": "150e2272-d41c-48f5-92fb-90b9b159fa3d", "value": "T108A32943A72D0F83C4DB99B12DB72BF1876DB97112A361C1690BEE9003739B81517FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408171, "uuid": "1c0ebe66-170b-4866-8180-3ff0c3c86d33", "value": "1536:7QQfckMzQzgv9OtAC0QptczD3z+FavgQTXvEmL49VqFjtUfkjX:7xH/JFDtczD3ma7vEmU9VqFBUfkjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408171, "uuid": "c91f676f-89be-43ce-abb7-ae29c412d005", "value": 99023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408171, "uuid": "e0c365cf-b16d-4bf8-9888-cd60a67b9919", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408171, "uuid": "76090dad-b2ef-4349-8fe7-5099188640e5", "value": "f5e9685c83fd7fd4cfe4efcf8bcc949a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d514591-5c5f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639432493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432493, "uuid": "ac4b075e-7f3f-4b8a-aa38-91b066f59a61", "comment": "Malware payload", "value": "04368e7da745a74b130c41f9793e97b4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432493, "uuid": "a7c50fd0-c8ba-46b4-92e3-24b011453859", "comment": "Malware payload", "value": "0d1c17141711a48262d6058fb042bcacdb82c3418533b0a5210100e6c6547410", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432493, "uuid": "e3d0a105-54fa-481f-96f7-6ca16adcb532", "comment": "Malware payload", "value": "c96e45447e494ccd9c0b71c96c08c2fb1596e302", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432493, "uuid": "484235fe-cc3b-4079-a9a4-7000c2df09c6", "comment": "Malware payload", "value": "7bac8f8e4a556807d1e9e650fa936196baf1e55f9504e900d41513c46420d41000156b2e1beb05db2192d70e8a8701b5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432493, "uuid": "7a4e777b-4d7d-4fa3-ae28-e3db00f6b0bb", "value": "T1C063AFFA024DDCF262EE96CEF9415F060C5A7C2F65967B4603016BE192A13DDB76E8C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432493, "uuid": "526126c2-0742-4ab4-a717-14e84e63bff5", "value": "1536:adFXl4Lj+eL4+RLq1AHL+4TsoDX1AHL+4szseLxj5qCLV4sFXl4Lj+eL4+RLq1Aj:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432493, "uuid": "8b37c743-14e8-4f47-8ced-14938c6d15a2", "value": 68980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432493, "uuid": "befc7425-7258-4e83-892c-9b103cb0cc06", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432493, "uuid": "652408cc-7612-438e-b734-619efebf9268", "value": "0000011012.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f737d7-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (DarkComet)", "timestamp": 1639413953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413953, "uuid": "988dfe43-456d-43bb-b113-81bcebbcded6", "comment": "Malware payload (DarkComet)", "value": "af0c10e86cf1966cf6dcbe7c92ba987b", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413953, "uuid": "531427a9-c374-4fdd-b38c-6b3b46e6590b", "comment": "Malware payload (DarkComet)", "value": "0d64bfe1a5e515d9b2fcf7e85f95d7de7c6ee4fc8212359649f4d55acba20d11", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413953, "uuid": "c6d9f068-b209-4ed5-a1b5-3ffc8abfcb71", "comment": "Malware payload (DarkComet)", "value": "7415d2cf9ddb99c428a5c4d58de45dac4c721d63", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413953, "uuid": "cbb7c3a1-34e0-4b32-9aa5-c1651c36cdc2", "comment": "Malware payload (DarkComet)", "value": "07063cf8d4c8203646cb403908b1ac053b869bc727f08d8aa594f26a3cb47f7addc74a633f5279ee51c0b1bd35f6c977", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413953, "uuid": "b8b91451-50b6-49fc-b33d-9e1078420455", "value": "T1F5E48E31F2808837D9721A788C5B92E5943A7E202E39754B76E62F4C5F3D6C239263D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413953, "uuid": "a0d45976-6039-4dec-bead-2b8d9620f151", "value": "8033c11f8a2fdfc317e8655120579933", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413953, "uuid": "506770d4-da38-429d-a98f-390d31bd0a51", "value": "12288:u9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFw:6iBIGkbxqEcjsWiDxguehC2ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413953, "uuid": "2dee3f4b-eedc-4938-a83c-a9b37eb6ff9d", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413953, "uuid": "0bfbc372-85d8-4360-aedf-e1febf75b7d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413953, "uuid": "70b18aa5-73e4-4929-856a-657d492af5db", "value": "af0c10e86cf1966cf6dcbe7c92ba987b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91a6623-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355820, "uuid": "fb80b8e3-4bf3-4d7d-8cb6-83306358ff7c", "comment": "Malware payload (RedLineStealer)", "value": "bc196f4cb057d65b6cb01e41aa9e3f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355820, "uuid": "ea7e5c6c-680c-4fda-b638-be1117747cc4", "comment": "Malware payload (RedLineStealer)", "value": "0d7502674c03677da5f6ae1a3908ef7afda02af510cd35b801b531ae33aa7571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355820, "uuid": "cb5e8863-71a1-4872-a764-a58baf1d7adb", "comment": "Malware payload (RedLineStealer)", "value": "12e8be9400c366791cf74abcb1ca9d08b7e7da0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355820, "uuid": "929b8463-bb69-48ae-8eb6-ec5253a756c5", "comment": "Malware payload (RedLineStealer)", "value": "5cb330cc97fc9725b5e2ade0b75295a2fba3cd93c8744b1a91766eb9183509320f3fa5573227c70fec4b3d9bc7904b76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355820, "uuid": "3c34f5a2-3041-4a9e-946d-dbc62fe47f0d", "value": "T1D5B34C5037C89918D6FF0E706CB0515983F4F5532411EB5FAEC558EE2EB2B81AA12AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355820, "uuid": "b40ca450-8ff4-4ba6-babd-a043a9790e6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355820, "uuid": "f52853ea-f3d1-48b4-b80c-4658c8b80535", "value": "1536:2s3uqThGWHm18sNIcnuvvX7pSuhH63GbZAKom0jNqbnUf9300PtB:j3u2hVHmXNIYhC09I85ZtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355820, "uuid": "44eb757b-2334-4f7e-9e4b-938680d541a8", "value": 108768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355820, "uuid": "06e30526-0480-4670-ae73-7e4972eeb0bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355820, "uuid": "aee48bd0-68f0-45eb-8e82-269f90fe2bb1", "value": "SecuriteInfo.com.Variant.Lazy.2413.13342.21181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348d4c82-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639415271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415271, "uuid": "15053485-6a48-46da-921e-615594959549", "comment": "Malware payload (Formbook)", "value": "e0bf9ffd6776f7193cb5063149952996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415271, "uuid": "71fdbac5-1a35-4ccb-bdd7-747037fbd2bb", "comment": "Malware payload (Formbook)", "value": "0e05f364eea6b843357ec8a4991d1dd52fdf847d2386799d62275742f7787d08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415271, "uuid": "679f95b1-92c9-49e3-989f-9a604148ec4f", "comment": "Malware payload (Formbook)", "value": "fc377eef8a3a83b2b5935ad2ad707f38bae3cdb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415271, "uuid": "63bec4e2-407e-4d9b-b5fd-ca8a30873238", "comment": "Malware payload (Formbook)", "value": "4cdff996bd2208a38d1d0f27cb77629b5a3981f7b8c645c087a3aae4a544747d73d2439f1100f96b3fa1c5da3deb80dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415271, "uuid": "b4f317d1-b838-4991-96e2-0e1373ce8c37", "value": "T1F655121D37E49D10E22F07B9A075C1308732AE06B426E30EA9E57EAF7E737809645797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415271, "uuid": "7c653056-bd60-4d3b-9daa-2eec35272f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415271, "uuid": "616304bc-ecbb-4656-ad2a-08b88cc7cfd3", "value": "24576:hXOHtEgDr7qVK91bvqLdEHmIYRoPmXDUsCAc/hO7RpsCvGG:5Oyg/7eK91bkSIu27n3vGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415271, "uuid": "ee61b44c-d421-4111-b347-606d24f1a632", "value": 1334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415271, "uuid": "e267e173-8830-41fc-8be2-6a0aac5419d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415271, "uuid": "a53d968e-e766-4850-911e-8dc9d3e069ba", "value": "e0bf9ffd6776f7193cb5063149952996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bdf200-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639355821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355821, "uuid": "433e1568-48a8-4b10-a06a-2941d0dc63f9", "comment": "Malware payload (Amadey)", "value": "d01639f69822e51f0ddaa74bb8355583", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355821, "uuid": "9d0fc827-8965-4c64-99d5-4a8c8bbac8f5", "comment": "Malware payload (Amadey)", "value": "0e9891ba648b7eb2c22df06ecfc965e1c5e9296bb4ff268b7179a5f2cf4fe452", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355821, "uuid": "c41e5cb3-c6ff-4aa1-9c91-407c668221c6", "comment": "Malware payload (Amadey)", "value": "3e4ca2d50af5ee5b98e1111c96d6eedd3202223d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355821, "uuid": "5daae50c-d388-4d6b-a602-fa7332a4a8b5", "comment": "Malware payload (Amadey)", "value": "4c6717cb3f52b6d3173986df70eca1b4f524fad9d61d27a78679a57414c6607c7085c1289487a4f306b9a6765a24a0ab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355821, "uuid": "69aeba91-d399-4ef5-8a75-3f9503d716de", "value": "T13154CFC17591D631C5A33E7088B4CAE54E7AB872EF34814B367C2B9E5F722D09A32752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355821, "uuid": "5f0b8f9a-9546-4014-b943-80d75b74e538", "value": "04d65cec586946f988f0bcf2e96b3498", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355821, "uuid": "807ec150-a1b6-464f-9107-e503cc64a1b5", "value": "6144:2vKIiSwHuMIRupHBIyIoSCHgJb7ITsqB:RK0u3qhI9LZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355821, "uuid": "b9d0dcb7-0a8b-40c4-bf78-84aa61941edc", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355821, "uuid": "12b7fd6e-9698-4271-ad7d-761e73f2e517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355821, "uuid": "71cd3a7a-1f94-4820-9b70-a7ee25aab6a6", "value": "SecuriteInfo.com.Variant.Tedy.63043.4663.23840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ab1ab9-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408128, "uuid": "eaee5da6-487e-46c3-afb2-f241910646bb", "comment": "Malware payload (Formbook)", "value": "99f1bdd67c558c943d6ba062bc327d28", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408128, "uuid": "588d4d90-5c02-44b3-a1f8-e8c682c3a2f1", "comment": "Malware payload (Formbook)", "value": "0efd3949bdca68716bd115e68de2f6247135e19dca8ff9e300eea9c7e9b4260f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408128, "uuid": "db05db47-b151-4194-9044-e75f29d7cf7c", "comment": "Malware payload (Formbook)", "value": "3694f22edb747d065595c4760fa25119581a43f1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408128, "uuid": "bb995cb2-1430-4862-adb4-57d9b1ebb9ca", "comment": "Malware payload (Formbook)", "value": "51eb95afad0911525e48c99c3854e72118d883f8a8d83ec49a23200e45f615883dfad00e624ee3713958a8908ce22c86", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408128, "uuid": "16e5e242-d554-4c4d-af02-a4ca8c06d5c5", "value": "T16A84BFF476047CD72A6F536BD996ACED1366167399CBA4CC40A477C30AA3371EE06C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408128, "uuid": "73a0a7f9-42e9-4f9a-ac6d-73f61efd66fc", "value": "12288:W3v9HeCnDBK4Fmh7c3b5fTscyzAFlVmerPOh:Twwc3bJT8erJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408128, "uuid": "208a5601-6e8a-4f2a-b207-31f56293c9e7", "value": 393494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408128, "uuid": "1eb21fc5-769a-4ab8-8fb9-71eb0eb8a4a4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408128, "uuid": "45becf45-aa6c-4e5b-9e61-c713263787d7", "value": "EX775380705313.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ac14ef-5bd5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639373350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639373350, "uuid": "953019f7-5989-4633-82c8-e29afc843a78", "comment": "Malware payload", "value": "1e051111c4cf327775dc3bab4df4bf85", "object_relation": "md5", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639373350, "uuid": "9b2c77dc-ef02-44d0-9a5e-4a34d80bfec4", "comment": "Malware payload", "value": "0f5cb7f8c43d3ebf71d7e22a2ac2fb94d0457ffea870daa2c402508caa39aca8", "object_relation": "sha256", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639373350, "uuid": "c7beb68a-3161-4b37-9ca1-4ad5916f2a57", "comment": "Malware payload", "value": "7758f16acf29c00c396fa5e8f03856155c89784e", "object_relation": "sha1", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639373350, "uuid": "c7f8ed0f-c632-4c18-81e3-4bf2c117d20b", "comment": "Malware payload", "value": "d0a38c35c26e5102b96ba7dec4ed6de094cc5b520055e4e2a12f184740d29bd3202ff82d45822c8ac6f7bbc5f4278ab3", "object_relation": "sha3-384", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639373350, "uuid": "ebaa5034-3479-4d7b-8357-4d94d3eb8ced", "value": "T1D1011DC42876F090811E995EB2E444D8B16DC3CC3BE68F59B76C4B7515D8718F318F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639373350, "uuid": "a26630b5-5816-4abf-a2a3-7e47ff94446c", "value": "12:Rwbh21KZ3G5Te7EUugx3qR5XZ8Swbh21KIG6DvqyRtG9unCFYyRtG9P:RohdE1FHoh6kyR8gCqyR8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639373350, "uuid": "c98029eb-0644-44a9-a11f-312cd56b5967", "value": 759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639373350, "uuid": "f8fbb549-bf74-40e7-9b6d-bc0aa28d59a9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639373350, "uuid": "c8ce206e-746a-4934-94e8-dc6f566313db", "value": "log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be777335-5c48-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639422804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422804, "uuid": "3929c6c8-0f4d-4817-b6a6-8fa20805559e", "comment": "Malware payload (Dridex)", "value": "5f28287ae8335d9b5d7312c84aebfb00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422804, "uuid": "9c2b6402-8150-481e-a0a7-5ccb2578d515", "comment": "Malware payload (Dridex)", "value": "104f26193555cb12c6738ed0fdddf4fb609c241b75192ec24856d077a3ca490e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422804, "uuid": "9529d907-d594-412a-83f8-e6df2742762f", "comment": "Malware payload (Dridex)", "value": "c2be47c635e30596bd061b1adac4bb2b8a70bec4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422804, "uuid": "07117431-68ab-4a8e-b9da-be9b0d0c556b", "comment": "Malware payload (Dridex)", "value": "721949b5ea64783e61927730f09c2151fc5adccd1f0462f0384471746341461f28421f7dfe7028e58553dbc01646cda4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422804, "uuid": "e0e735f5-e68b-4fdd-ad13-e763f571bdc9", "value": "T19FB4A0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422804, "uuid": "97c2be22-5446-4e3b-b12b-2018aa1a4feb", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422804, "uuid": "5fc89f65-6983-4828-9f6b-e436a5837047", "value": "6144:hKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:h9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639422804, "uuid": "827802ed-2436-481f-a71b-150cc3366e0b", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639422804, "uuid": "1ae0e202-213c-4065-a2c2-0d5b0a0ea0e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422804, "uuid": "24a47977-5c25-46ec-8ed0-64229609d27f", "value": "5f28287ae8335d9b5d7312c84aebfb00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ef38a6-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1639408594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408594, "uuid": "ae6f4af3-21f4-4509-aaed-ad4baa18926b", "comment": "Malware payload (DBatLoader)", "value": "3b62d1c0b3151a63ebc779d8723596f3", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408594, "uuid": "18f78eef-eb01-48dc-beba-2fe9b166fbe1", "comment": "Malware payload (DBatLoader)", "value": "10f5584682c3f5d54ba1e3afd68822c81e8234531c8b1a41e11774b980915c72", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408594, "uuid": "5ad04ff5-8797-4a86-9769-6071229d97c4", "comment": "Malware payload (DBatLoader)", "value": "865a6e4b1e90b8d4d8e27f13b6795df84267b70c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408594, "uuid": "8eea6a0b-e358-4af2-ba63-67489bfbe005", "comment": "Malware payload (DBatLoader)", "value": "a1164aab916c0784333293ab9a98a5effaa0dbbe5108e2730ceb7fd16c8d7dcbca03341e836aad7efe5bc6dc793e381c", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408594, "uuid": "c680d7df-602c-4fba-8754-936cf3077760", "value": "T1E7F4AE23B6E08837D0732E79DD6B55B489E9BF002D38A4476BF43D484F352A17A39297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408594, "uuid": "a37392c5-8946-4b80-80c8-91658095c874", "value": "fa0e7f1e414f64ce479e9b2ae5bbfdde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408594, "uuid": "641bd5c4-71f3-4513-a3d0-dea02ce9e52e", "value": "12288:x3+1u3fSageKokouFWsr1wYs60jHD0dhc1squpMQ:x3+iboodOLf0f0dmmNpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408594, "uuid": "1af84848-ff57-422f-8520-10d8eee88f5b", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408594, "uuid": "9ea569f7-afb1-4b56-ba63-928f29ff7f24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408594, "uuid": "2fd8d9fd-c7ca-45dc-9d70-ea317c768242", "value": "DHL_119040 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438,doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0806b5eb-5c09-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639395440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395440, "uuid": "7b017f13-4458-44fa-a76e-f12a44d96911", "comment": "Malware payload (Formbook)", "value": "3586b17e2baf1d1bc4999a1bc6a08091", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395440, "uuid": "b4b3dfd2-5f73-475a-93ef-b390e7e54767", "comment": "Malware payload (Formbook)", "value": "123a87c47551ce1746e00620004806d10ad657fecf8e0d1f877e24abc7e1a1db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395440, "uuid": "a632d2e4-f4c7-4574-baf9-9e8414412f16", "comment": "Malware payload (Formbook)", "value": "82b2ccd5dce816f72696a1411999280fca4383ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395440, "uuid": "2255013a-5eb5-4b7d-a2a7-9b3066c240c6", "comment": "Malware payload (Formbook)", "value": "583f1c8b19781f247d05ebda49a9d7c88ada97911a67489fb26d33c8761ae0b1b86d0c7606c7530cf3bfa723f5416053", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395440, "uuid": "a0a4a313-3d7a-43b2-b978-a1ba6f93185b", "value": "T17B742351BED40DBBE9F21DB7E4B2162CC77D761813229E4903909F7A9D7C21AD8843E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395440, "uuid": "89ce2233-2a94-49d1-8040-251b29cb0eaa", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395440, "uuid": "4e6c3624-7681-46ed-a7a0-439c293cadc0", "value": "6144:rGiDiKLBBau1/hEGtstaau2aLne9LZly/CmdPuGiEAcswyljfB2iDbO:H1B1JSkYaaOLg/8dWGqYyJRbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395440, "uuid": "ef062bef-e53a-4d8b-b5fe-aac1cc387440", "value": 361960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395440, "uuid": "af8445b7-a0a8-4622-9bab-ffa547aa7e19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395440, "uuid": "eb2a3349-330c-4619-bc21-e9e590ff6260", "value": "3586b17e2baf1d1bc4999a1bc6a08091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f619cb-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639388182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388182, "uuid": "a4c3d36c-e7d2-491a-82eb-9671768224ae", "comment": "Malware payload (CoinMiner)", "value": "e33897b0fd6cce956c1ff1da56da0ba7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388182, "uuid": "11e50286-a31b-42ee-8cd5-c040899dd568", "comment": "Malware payload (CoinMiner)", "value": "12d542c3ef2508b2e4a5f4d5a51731ab9da6dc21fee210c201a2c88c43a2a0a3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388182, "uuid": "ae50963c-71fb-4e2b-855e-3381e6d4401f", "comment": "Malware payload (CoinMiner)", "value": "dabe7c4680a25846f8ee1fc1adfcba8e0954de21", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388182, "uuid": "b1e9e162-0c76-4922-81d5-6f618c68c937", "comment": "Malware payload (CoinMiner)", "value": "1a9736206f860766a4aaa479fb8f169097233bb9faa776a28c00d6c0be3ce45b78b909e1b137197e5876d0c3b291a2fb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388182, "uuid": "771fe238-8d34-4647-8536-127ea7e55414", "value": "T1E9E523E3F44EDEF9C11B08B182402A159E4B6D335FFB8895577D9349AAD3072238EE49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388182, "uuid": "517421b3-0d49-4b6f-b4fb-891505ebade8", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388182, "uuid": "416ee1d6-469d-4be7-8ff9-28bb79cc4269", "value": "49152:+0ZnHC0ejvb/E5ZrMPySKWwP0GtAN3pPsdjAcOPsJArdybGnD/xeRgs:xZHNwvrqJMP5KWwJto39sBAcZ+aUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388182, "uuid": "f5f5c7ba-4e13-48d2-afc8-e4d087fcc008", "value": 3254272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388182, "uuid": "a50466c8-6556-4cc6-ae42-21ae54fae0e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388182, "uuid": "34868c13-7dea-4f00-899d-c1ce911bb42c", "value": "SecuriteInfo.com.Win64.Packed.Enigma.BV.28332.28672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad2c28f-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639395015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395015, "uuid": "fdc5abb4-e281-4805-b4e4-e86cce58a76f", "comment": "Malware payload (Formbook)", "value": "9e7ce2765ef84bc827546c47529bfd05", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395015, "uuid": "d92496df-2b76-4db5-8e2c-582fbd7338c0", "comment": "Malware payload (Formbook)", "value": "1356d44d95eac97cdb52cd3e96926c7d26096d08c33b2c9fbeb9ca13a4d4bffa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395015, "uuid": "afd20e7e-0928-45b9-8326-245942ff61dc", "comment": "Malware payload (Formbook)", "value": "eb586da4c4b8b56b12f7a226048d0059d02e746e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395015, "uuid": "c646deea-3636-4e00-87ad-dcb245801e5e", "comment": "Malware payload (Formbook)", "value": "e424dc12484ceb1fd48e623822ed02657f9e08a6ec681feed0286d6c4a98ac1cfaefa862c6b532835dc8bb25d12d9a5a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395015, "uuid": "f0ddd18a-ecf3-4ae8-b559-7c9a57120aee", "value": "T12D641257A099DFD7D58757B83F42A91312F5EC844FB9C982A8F0340B1872FFA09262B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395015, "uuid": "2b67dda0-29de-45c6-949b-02fbb923ba66", "value": "6144:2tUr8o5BgMc8PJ6FVrhMlC49oj8jmOZIf+i+gq1bbXs:2tUAobgL8PaVVqCSojmvZF1bbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395015, "uuid": "8cfcc959-6b4c-4539-8400-f4ddb4df2fa2", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395015, "uuid": "daa3bd14-9746-4eae-8774-7fbbbbd8f9d4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395015, "uuid": "0a8559da-3c59-421b-8575-800aabbc2ffb", "value": "MT103-259602.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af5e466-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639415336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415336, "uuid": "673a0247-c70c-4fbb-a7ee-27d28aca742c", "comment": "Malware payload", "value": "a7fc9f7b336ba6c46d50c84e4ab036d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415336, "uuid": "af191a13-1700-4320-afc0-a2016d2b5550", "comment": "Malware payload", "value": "13bf4a08e3ba3749b7fdc86aa45127fc08bfa30740ecb23ace9d0f85fafa19ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415336, "uuid": "66c1b3df-ec48-48ab-93dd-fdc2077d919b", "comment": "Malware payload", "value": "1df83333331b45682913bea5a674f86f66ee218c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415336, "uuid": "dc6c41e2-c2bb-4e2a-a8f7-149c3d44a97f", "comment": "Malware payload", "value": "49af6bb14996941ac12ffb53aeb4f24a7ef912bc65205b6c5576c2667db192ec0255f94a575e1a0c5175b13d6ee2b00e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415336, "uuid": "4cb6cc87-0e65-45d7-8b0b-e14b8ebf4695", "value": "T1447423096A18A40CC52D05B21DBF6216B5836DE7C41D81F7BA92BA21BD7362CC7CDBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415336, "uuid": "f4f90ad4-d287-498e-b5d3-59b8b82d8fcd", "value": "6144:i0s4s5/bCteaEWlkZOpIPhfG8WaS5cZanzeDljlifkryjBHDHd8f1dRjPTLfhvT5:i0LsNCtYOpefJWiaepjNrkdDKPRDvJT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415336, "uuid": "cafff8ac-f7c6-4842-a20d-cdd69f71c55c", "value": 349647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415336, "uuid": "129fcd64-f262-4217-ba3f-d9a0fe1ca0fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415336, "uuid": "9862748c-fec2-4dff-bc2e-5260d649d66c", "value": "a7fc9f7b336ba6c46d50c84e4ab036d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3c14d7-5c41-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639419604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419604, "uuid": "2ba2cf91-1aa5-47a0-9c1f-a7b0330d0108", "comment": "Malware payload", "value": "ed552f620e686372f9f74f4893be7136", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419604, "uuid": "a95290ca-5004-455e-9f29-ddc3c4d40190", "comment": "Malware payload", "value": "14127801ded5b52b4ffbe18a25b52213d428db459b458521e873a4454bfe1cb7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419604, "uuid": "4d7fbd94-6e0a-421a-a299-3784aa05dc86", "comment": "Malware payload", "value": "5c0f01535ddf504d808bab7858973ccd969e3701", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419604, "uuid": "95ff10a6-618f-478c-b475-e50b8ac04dbd", "comment": "Malware payload", "value": "1b3d54c9a2acb9d6c87975a5d18b9c11194f0ed855d7d7fce6f0aa2879f20c7d63a33466a6eecf19d8eefdbb489f5ff9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419604, "uuid": "0e6a9945-09ed-4abe-9570-bf3a53c51a8d", "value": "T17E55AD5A725449B9C9A7D07CC4834F5AEAB074058370D6EB07B59AAE1F233E21E7F720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419604, "uuid": "2ffe7aef-9b19-44bb-baf7-50adc51aecc1", "value": "4ca54a6ae85170224dd88abf6fab85e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419604, "uuid": "f90ab058-4613-4358-a52a-4e239815b193", "value": "24576:jrJy+DqdEE02Jmzgd6IzpgUUkoi2EMLQQo1VPZSg/88/wImnTXdT2At3JJyRGphr:jrs+UE6JTYIzpgQNu3JJ405P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639419604, "uuid": "5da7b71d-bd1d-45ed-9d2b-c289f1c710ab", "value": 1406976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639419604, "uuid": "db8458ef-6093-4904-8852-bbbd6ac34705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419604, "uuid": "61d5d58b-4833-468f-9d3c-c4eb29678079", "value": "ed552f620e686372f9f74f4893be7136.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea3f233-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639395129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395129, "uuid": "44f12d27-0dcb-4184-bf51-263ebfda4539", "comment": "Malware payload (Formbook)", "value": "7856270434cab4f33dea340ed95ecab5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395129, "uuid": "0f6e043d-958f-4b34-8432-b721e06586c6", "comment": "Malware payload (Formbook)", "value": "1419671c7d3afacc61b8efbcf507da94beaf22e4950939a77fefc1ef22bc29fb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395129, "uuid": "785fceb9-7cea-4561-a3c9-6d287f8eac7c", "comment": "Malware payload (Formbook)", "value": "679a8457d54db2634497ba9975988a04e2111837", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395129, "uuid": "21d7d3e6-e71c-4dae-bdec-b91182d4f23b", "comment": "Malware payload (Formbook)", "value": "09f4f563a2658d480ff70498fae3087917c97ab05120b3dc202eece5829cd5d5cfe0f4e27ff4996aedc7d7915d4db216", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395129, "uuid": "35c4b48c-3987-41f6-b37a-2fb3cab7a933", "value": "T1B34533EC8BD2E75F6B1AA423EB783D4A19694BF4F8149B03C209D51467F3AE4C71C249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395129, "uuid": "b1d0548b-2f2b-4dfc-8b95-bfd91c64a72d", "value": "24576:haNDsdAWCZro/rfReVXiI/2T8cnnFt82wTY5Erp7HXbt+4W:haed3C2DfRls2T8AsocZsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395129, "uuid": "d432c60e-9abc-42c3-ad9f-af9d6c031c10", "value": 1215942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395129, "uuid": "c045ddb6-9f57-4c51-a2ed-cda9668aead9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395129, "uuid": "b9bfbb8b-27b6-4d6d-9d63-905e7666995f", "value": "\u0442\u04e9\u043b\u0435\u043c\u043d\u0456\u04a3 \u0434\u04d9\u043b\u0435\u043b\u0456.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827c996e-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639407671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407671, "uuid": "68b4991b-971d-4e56-b31e-abf931454f70", "comment": "Malware payload (RedLineStealer)", "value": "dd5814cd909e9833dafd5d02cb7c6277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407671, "uuid": "3ac3a7d2-5e2c-4765-9fb5-1a4df8ba1e39", "comment": "Malware payload (RedLineStealer)", "value": "1511325d8e8070d4d96abe231f6967955d07fbee1e8bd306b8db6bd954ea6a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407671, "uuid": "b69a6afb-802e-4ea2-9877-85302c73ab91", "comment": "Malware payload (RedLineStealer)", "value": "ca170089936d9da6f5961b52d427ef8dd4008316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407671, "uuid": "0fae3cd0-8c5e-4428-8625-1db8b92f1042", "comment": "Malware payload (RedLineStealer)", "value": "439b451f67e3a35c843e4868065e251e1aece2102eec92cc39b617f1c41e548deb550e6f9a9b6fe74332c2e848c28d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407671, "uuid": "b0f2e7ab-a661-4d0e-a21f-f466cbd7c372", "value": "T19E64D0C0B5E3C871F5A27A3088728AD54E7FBD11EE20814BF7382A9E5F726D05672752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407671, "uuid": "af5b4692-95dc-4e81-847b-3c4b97b58026", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407671, "uuid": "c077116c-8093-4aae-ae78-85dcbe81356f", "value": "6144:Ie7S10J27wbFwHoz+8F1hMo8cDVFAIBbtb7ITsq0:IW9Jwwb03W1hfJqIpx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407671, "uuid": "626662a6-6b71-4c09-b934-aa9eba3d1773", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407671, "uuid": "15142d19-b8bb-40a8-b0c8-b32504876b38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407671, "uuid": "f0b08b36-a096-4fa2-93cb-a6f42a0e428e", "value": "dd5814cd909e9833dafd5d02cb7c6277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879aadde-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426148, "uuid": "7256d5dd-4328-4b8e-9baa-466fc067f6d1", "comment": "Malware payload (RedLineStealer)", "value": "928b0929ac9a7a67c1ebc1ec746ec9b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426148, "uuid": "061ec2a6-3a9d-4eb6-b999-5350b732b410", "comment": "Malware payload (RedLineStealer)", "value": "15aaa5aecd7ba5e5ffe29c5a95bfcd5f6a2a36e60a77d595005ca56ae224da6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426148, "uuid": "13ac33e0-c32c-4be8-b52c-8ad1be205ac4", "comment": "Malware payload (RedLineStealer)", "value": "beeb947fbf25ca6c464ff785954099520f6f39df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426148, "uuid": "e182d339-6337-4b33-8870-945f8a0627e5", "comment": "Malware payload (RedLineStealer)", "value": "a6514c06a199c6cf12df70e201c63b4063c35931795a74b168c9f721a4e63d919019b480b7a2428e589a6c60f3610bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426148, "uuid": "fe078c06-fce1-4547-8cd5-ab98b875a38d", "value": "T19855339DE6D07B39E6CC97F3457BEA9D8707C2A82AF0B30679391A0769AD452134C31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426148, "uuid": "bb04a338-dc88-41ff-a46e-4bbce1fbcc1e", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426148, "uuid": "2ef8e2a1-90e7-49fd-be1d-de4bc85937d2", "value": "24576:FNAvfegVUNVvBjkzUcVsw8aIXq30Y1baHAILkEaHNYK3w7oy3NVzLT:FSv1VEBk/F30hRNamU6NVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426148, "uuid": "442f374e-393a-4bd6-8bba-54a2f0b5d510", "value": 1334784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426148, "uuid": "ad179bab-550d-48ff-985d-64645a49d87b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426148, "uuid": "59cb6048-037d-4bfd-a868-260b24fafeea", "value": "928b0929ac9a7a67c1ebc1ec746ec9b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdad5626-5c17-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639401784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401784, "uuid": "d23de088-dfe6-47f3-81d5-c52fc1ac48dc", "comment": "Malware payload (Formbook)", "value": "a4c34ec89966a552a5cacb6956f78ac5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401784, "uuid": "9c7fd495-d99f-48e5-a53f-1227a9894704", "comment": "Malware payload (Formbook)", "value": "1631edd29c03c5b7b26a93590e8f5959bd033cf8c80758b1ecc40a69f678e264", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401784, "uuid": "1943c4c2-6e78-4d65-be93-e8ef39663054", "comment": "Malware payload (Formbook)", "value": "ba3f3bc17eefc641664df68cc01b91669d295c6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401784, "uuid": "0dc6336c-b7e9-4391-bf06-4227fc4a0c79", "comment": "Malware payload (Formbook)", "value": "6564a7072151199b3c5c8e62661a5e7ac1cea707ec627ea730b33d2ed8ea20fd6a29b553f98d97a155e633fedbcbf193", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401784, "uuid": "91f29169-f060-41a9-ab51-29878a6ffc6d", "value": "T11464231BAAC2D21BF6AA06725A732B3DEFBD534620948903DB81CC2F743774245D5FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401784, "uuid": "f18ebc3a-f3b3-4d91-a7b7-51aff251bd63", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401784, "uuid": "9bcca647-fae6-46e5-bbb6-ac4fdbc191cd", "value": "6144:rGiCSJtRL68A4xS151m9SmnZbUveDUE04h9PpxfTruo:nRxbo51mpZCE7HB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639401784, "uuid": "4d57ba5d-be1f-47c1-a35a-058267ef3432", "value": 313934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639401784, "uuid": "49991290-60a6-4c88-ad4b-19b8daba0f3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401784, "uuid": "76838d07-b2e9-4fa3-8904-0c009c34c59a", "value": "a4c34ec89966a552a5cacb6956f78ac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aa47d3-5bdc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639376484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639376484, "uuid": "a99d1b43-f533-49fa-9072-078ac7147f6e", "comment": "Malware payload (Formbook)", "value": "3ec1a88555fbc4e3469c3d932e7443e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639376484, "uuid": "916067f1-f2a3-4694-889f-dd6f0dc8d1b0", "comment": "Malware payload (Formbook)", "value": "166eaef2a1db9235f1cfa04186b1586ddb1f81466d4a47d4a835d6fbecdaafca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639376484, "uuid": "12d23adc-c410-4f3f-b117-a109368612d1", "comment": "Malware payload (Formbook)", "value": "c7332a9e58641255669aae2f53a45ad79a4dd8b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639376484, "uuid": "4e414195-b50b-4217-a758-444ddc040f0a", "comment": "Malware payload (Formbook)", "value": "2798eeb6f16b448b23df0595a85472fb934aa34168b7940708512b02109bc6eca7ef8fd30010036d975c84f0f570d9f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639376484, "uuid": "0d40bc42-54a8-448b-8127-6c546f5996c5", "value": "T17855125933A08E18E56E13799470C270C375BD196827C31EBAE43DAF7E337909A06B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639376484, "uuid": "d0395fa8-085b-4c71-80ff-6a34efafe08a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639376484, "uuid": "a1db8b87-a921-4f8b-8544-042dac33c1a8", "value": "24576:EHUrF0NrH0V8tYZMb7W3Nam/zFcBNFRf1nHoXOHtEga:EHUr+4VOYKbqQmEFXnEOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639376484, "uuid": "accda7d9-29b5-4c03-a2d0-3b1b7444ab62", "value": 1316864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639376484, "uuid": "6bb9dd39-a3da-4d85-ae9e-b93686f3a7ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639376484, "uuid": "7669ad6a-6794-4091-a76d-9c6916424877", "value": "RFQ #0012212012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa68381-5c4f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639425911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425911, "uuid": "425e498c-911d-40ec-ab9e-2c4f7a7c6aac", "comment": "Malware payload (AgentTesla)", "value": "b05c58f3f3341322a2f615e0c674e4b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425911, "uuid": "ba08335f-d4ac-47e0-92e0-e663dde4114b", "comment": "Malware payload (AgentTesla)", "value": "1681a54061e896e569da0e4dc9f222f0e59d8edc28199fa2d24011f348984843", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425911, "uuid": "1d0117d8-edf2-429d-96e6-42fab115697f", "comment": "Malware payload (AgentTesla)", "value": "f302175ce9622f12172da422e0541f57277b7f0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425911, "uuid": "f4f5d183-5a86-43dc-b9cb-6537ebba7ab1", "comment": "Malware payload (AgentTesla)", "value": "249f75617b4843923debd83cad97e51836ebb1d9c1cd8e327ebd2aaa12ff3a57e81362d154cbb676e7ccf182e7a1d4fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425911, "uuid": "8b3fdf76-5f09-4d79-bfc2-da764245a59f", "value": "T18865230076F5D215D23D97F88CEB603003B8624BB491D25A7ED623DAB8EA3F446D19DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425911, "uuid": "f4529cdc-076f-4980-9f09-9a5138aa99b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425911, "uuid": "51ea0f8b-dd96-4246-a15b-9776c0c4aec8", "value": "24576:C5dMLg/2XCgPikPORPsvG7CrZBZ/IPPuh3apS7cjHrRmdKzsu/KtwGJGF0lT+fGG:KdP/oikP0KGmRkPI3DoHRmLuKtzJGF0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425911, "uuid": "b567ab9d-5799-41b7-a59d-8cfcb19812bf", "value": 1419264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425911, "uuid": "bf1d4dbe-0b71-423d-8fd9-05dbf2ba87f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425911, "uuid": "f76bb419-fb4e-4fea-be78-c2714acbbc8f", "value": "b05c58f3f3341322a2f615e0c674e4b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d1f982-5c13-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400103, "uuid": "10fad598-0d3d-4442-8584-19161a4d17c7", "comment": "Malware payload (Mirai)", "value": "4ad6b4f41e05a40e3d31c8245bc1469c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400103, "uuid": "dcad09ed-2d7d-4a32-b598-67a9644d6e19", "comment": "Malware payload (Mirai)", "value": "16fc99bb70b0b97c151d13cddcf530b6e67f88a682d73abd582e87d994ade9b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400103, "uuid": "a5feabfb-b0dc-47dd-8e9b-b1806f93b3c0", "comment": "Malware payload (Mirai)", "value": "eee72a493f84b82c483cf72bb2c17757460b222a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400103, "uuid": "050f104f-cbc1-4743-bf31-a44ed17cfef9", "comment": "Malware payload (Mirai)", "value": "add3716cecd39c0d873853ee16dff5c01cf9af137b789735e356a983160f1bdecee47be72de0e050c34ad02c2c816ea3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400103, "uuid": "1e5b33d9-0dff-4908-b183-c4f94b956e57", "value": "T1BF03F112505A4AC1C58B58B70C5D750E0958E20DE9DC8323FBDDB96FE593AA9631CB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400103, "uuid": "368adc98-6afd-4a30-a6d7-e6614f4f4ec9", "value": "768:KANXbfgge/KIH+IIFGjRi4dM2cH/ujMqLLUooTLMSE1tCfonbcuyD7U0yqWC:KApb4i+gMjRi4W2QujMqLt6dELjnouyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400103, "uuid": "f3cb1cea-144c-4e51-ae20-3ca00f889d7c", "value": 39400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400103, "uuid": "c01e4f4b-d588-4e8f-8da9-096d788208d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400103, "uuid": "5d57aa24-14dc-4ca7-91c7-6aa1322f3731", "value": "4ad6b4f41e05a40e3d31c8245bc1469c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5208df7b-5c54-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639427776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427776, "uuid": "19ff89a1-ff30-4c34-be0e-7092f14a1edf", "comment": "Malware payload", "value": "b6e98bc10b2e8c29e36e7725063c7eed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427776, "uuid": "363a4a42-bceb-4160-b0f3-b27eb0c1464f", "comment": "Malware payload", "value": "1729eaf30a69ff628cdf67b220da8b639a194c27f91a8e12f0e5151899a7ff3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427776, "uuid": "31d2eba2-fdf5-456e-8b55-661b257e4479", "comment": "Malware payload", "value": "721dc8a0b81f6c3d46a34f366b29c4aeec9d3e0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427776, "uuid": "6a750e27-0584-498a-9c08-9fb425240748", "comment": "Malware payload", "value": "6fbcc0a41920a5267f35032398ff7c7720be3ebe3381619c12ceb92d574edcb5bd7a5b37f11bc320a4ee2d9ce44f925d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427776, "uuid": "cb93d99a-5628-415c-81ee-fce7fe31d508", "value": "T190255C2D7E0D05F2ED5DE131EF19A9047B624FA3A241E99723EB39CEA76F051BC04894", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427776, "uuid": "c4904d4f-489e-47c2-ac1d-85fc3395e850", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427776, "uuid": "2364b981-3482-42ea-9447-847b4418e69f", "value": "24576:cbVyViiu1DiMXrhb/B9u2y2sxHbN7Ec/IOE:cb91Dioh/u2ybxHbl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427776, "uuid": "265d7094-a8f2-47de-9801-92e1f1e7323a", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427776, "uuid": "7b0ce234-73f6-44e7-9e30-609ff04ca5f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427776, "uuid": "513b4811-2226-4d33-81a3-f60bc634a7c8", "value": "b6e98bc10b2e8c29e36e7725063c7eed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a915dd2-5bcc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639369245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369245, "uuid": "285d2823-41fe-4dd2-ad44-51833a1378f7", "comment": "Malware payload (Mirai)", "value": "de9b2caaef84652b66dce1ce3545c1a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369245, "uuid": "909ee5bd-6d2a-4984-b3be-15f6d74ae8f7", "comment": "Malware payload (Mirai)", "value": "1736894b066e435727cb2fc3c87f1fce4202e03a61335259cc7d1e4321ba2753", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369245, "uuid": "7538911a-d64c-4c8a-b48c-cd440b8ff197", "comment": "Malware payload (Mirai)", "value": "74b065d473648411ac9b4a0ccd6db8ec546d37c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369245, "uuid": "b9d16af8-42f2-44f8-87f2-bb275ff88022", "comment": "Malware payload (Mirai)", "value": "8237ef2d41befdbd056b071c5765581875e0345dfd66ae93f5e30d7fdf90627813eff776c18a18d7a6424b8b5614335a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369245, "uuid": "287ef75d-a9ed-45b6-ad8e-72dbaea7be6c", "value": "T1D4C2E03DC1257EA34B690CB4ED35D8471D3ED37090BA34B3A83685D81AE424EA7A57D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369245, "uuid": "efac8439-396e-45b1-828b-dc097a7ddb90", "value": "768:E9xM13LhiMUsg5iFZOVTUzp7KOQec9q3UELJT/:E2hhNg0FUTqp+ORlL5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639369245, "uuid": "5c78cb23-64f2-4014-b22d-684ba0afcbc3", "value": 27452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639369245, "uuid": "39462c09-d5c8-40e1-ac2a-ddbef4142723", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369245, "uuid": "171e3fd9-1e5c-411f-a372-979b922b38be", "value": "de9b2caaef84652b66dce1ce3545c1a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a72bed-5bd0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639371323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639371323, "uuid": "1dfb1415-5431-475a-be54-05cd6e10b836", "comment": "Malware payload", "value": "c6306735f9dc92de5a0938e901ba10bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639371323, "uuid": "bcb5dad2-37a6-4784-b1a3-d94152a0c0b4", "comment": "Malware payload", "value": "1748a73a2984931bc6a81df9555047da1362e932b1472266dbf4284059772584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639371323, "uuid": "0b54fa9a-1e65-4279-9954-26c2c25f6b6b", "comment": "Malware payload", "value": "0b8b769157dbe71e432d4fb98df2dcf6e7449166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639371323, "uuid": "d4749e0d-0367-4538-b76b-c7de2704cd9b", "comment": "Malware payload", "value": "d99021aa84c8fa47d27adb5783626897d879c5abe55799a017a6c41297405649c0a6b660375406dacd8a61189f190d2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639371323, "uuid": "6069be48-b174-4944-89ff-007883a826a5", "value": "T1F9F4AD4D358782FCF87AD7B03A7164900365BDF5D453D3AEF88831EB1BB36816522A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639371323, "uuid": "e1d52d76-279e-4179-bb8d-623987ea9ded", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639371323, "uuid": "d24eec65-5db2-4d44-9430-f704c049fa69", "value": "12288:I9WfOeDgnI5EgLTk9nPBHBpyfaKcRS8OL7LZzpo8MKZkMAjplCV3Li09zDT:HO7nI2g3kJBhpyfp0S8KLkQkMau3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639371323, "uuid": "3386d38e-bb3e-4019-a68d-f3c15c8fad4c", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639371323, "uuid": "e65aa883-cf1c-4c0a-9baa-4c77e8a33049", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639371323, "uuid": "785564de-ed2a-4a96-9427-5c000da7b0c8", "value": "SWIFT REF GO 20210193SFT200201017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62237997-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639388289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388289, "uuid": "8df9e50f-c6ad-41cf-9bf5-52e56c89c3c4", "comment": "Malware payload (SnakeKeylogger)", "value": "d7951412dca98c0e2b45b74fc681fac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388289, "uuid": "7de8dea9-ca2b-411b-91b0-74c6aa8249ad", "comment": "Malware payload (SnakeKeylogger)", "value": "18d00ffdbe154db1621b89ebbc7580c21eca1d428aed3876df66e6d258b2bb4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388289, "uuid": "6df68054-d031-4647-85a3-cc54d066948d", "comment": "Malware payload (SnakeKeylogger)", "value": "7d49c098f22b43e1c9c8572e9f1a4053ba260ccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388289, "uuid": "e855c262-4612-44fc-8ed1-b15915b981d9", "comment": "Malware payload (SnakeKeylogger)", "value": "57df17c638e4903d7e3b0e7c3aa694b440d6759f024b4187ee320766180e625174f344821458c86ea21bb53fb11fe6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388289, "uuid": "9d72ec6e-a484-4514-ae69-d84734ae0796", "value": "T16945231237788F58D0A413B8A9B22B4203BEA0343D21D29CCDD576DF6A977C15A997CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388289, "uuid": "321d64d7-58ef-4ab4-b206-a002f30828be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388289, "uuid": "defec0a6-1199-4a29-81b8-7a36e7522952", "value": "24576:vc8pD41nW751v6ASdNoiWhI7obXMW7vS74EZz/Y+PXyi:XpDanW75QAS4iWh787vbY+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388289, "uuid": "bcb89b97-aec7-41b9-a407-1186c5015ad8", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388289, "uuid": "e600f180-3dc5-4802-9098-97f222b74243", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388289, "uuid": "ed4063ab-af12-41b4-8240-241094b72a68", "value": "Scan Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559c34e8-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639415327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415327, "uuid": "996eb3dd-1c31-45c1-a8df-a09eab023a92", "comment": "Malware payload", "value": "89cb775ba1719dea2eba83f6fca95a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415327, "uuid": "59a0358e-801b-4955-abc2-2572d8d9c518", "comment": "Malware payload", "value": "19d22eae0230d0f4a1d46231b6ad90d382bf5baa0b1344605d62682ba8da48c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415327, "uuid": "ee1e00a3-21a2-4634-a70b-1967f6ef0146", "comment": "Malware payload", "value": "79e286dd96679c2e5dc067a5f547cb2bc19d4667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415327, "uuid": "6d67f9cc-3612-4328-9d5b-dcfea112cd30", "comment": "Malware payload", "value": "ee3222e4f79371367e015ec6e4d3dfb4a7fd76ebb0d8885a568d10acb195672292d868d718b6cbf7673c354da8da9d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415327, "uuid": "c4f04402-47ba-473a-8c12-e3b273f7fe60", "value": "T140058B0273D1C036FFABA2739B6AF64156BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415327, "uuid": "b4702672-32a5-4b45-8248-0cbeda7a573c", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415327, "uuid": "5a1521b0-4e2b-4e1b-b74f-abfa949d4dd3", "value": "24576:/AHnh+eWsN3skA4RV1Hom2KXMmHaFJU5:ih+ZkldoPK8YaFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415327, "uuid": "f426b817-a416-49ec-9b3f-c16d061e3827", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415327, "uuid": "d88e923a-3bd9-4140-827c-81b71a5801bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415327, "uuid": "7d47aba8-1233-462f-9c88-ba3c933f6704", "value": "89cb775ba1719dea2eba83f6fca95a8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ef1ccc-5c51-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639426707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426707, "uuid": "919e937c-91e3-4c9f-9e01-2423eb52d1bd", "comment": "Malware payload (RemcosRAT)", "value": "9046feed2fb64ddc461b75f2f07d7d74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426707, "uuid": "a287ef11-060d-401b-8556-6c58bc4df437", "comment": "Malware payload (RemcosRAT)", "value": "1aa2a73ddaf95de7b6bda630197f4f44e7b74e0424916f5c6ce8d0751c205674", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426707, "uuid": "7266bd15-9540-4d8b-8abe-766341440c96", "comment": "Malware payload (RemcosRAT)", "value": "1f36fe06bf6a0dc7eb30e3cd6837e948f2af1cdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426707, "uuid": "7545f6a9-f466-4c06-8850-31e8a40b2bea", "comment": "Malware payload (RemcosRAT)", "value": "6bc89e92a80a81be182ac08600988fdcf4ee41c6ba4a2cf846ecdad1d89e320c5c6971ed5cfd110de273bbf0f9875533", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426707, "uuid": "9b063947-26a3-4d57-bc2b-c84eb7b06579", "value": "T1C87533133770CA11E62596FB87D6266113B87829B2B3E1583CCE36E87A157F21D06DCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426707, "uuid": "7e156082-ea87-4cbb-84a2-45c2ac743b31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426707, "uuid": "334ea6f3-266a-4b52-9359-63a0f4b9d621", "value": "49152:9UaouzeoE17bq9D0w4v+WmEFAxFk9AryaJx1+dH:9Uaoueb2Qw4mWmIPAl+dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426707, "uuid": "42045005-e047-4923-9e1b-0ab78e197c73", "value": 1654272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426707, "uuid": "3fb1851d-a327-43a4-a439-7962d50f3e30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426707, "uuid": "67354c72-12ea-4200-8b99-2b214552a93f", "value": "9046feed2fb64ddc461b75f2f07d7d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7650cb-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639386832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386832, "uuid": "3c3b0fd2-e14f-4b3b-b0a1-f9fbc52cd949", "comment": "Malware payload", "value": "c03533ff94571d073dbb67d19a2d0ea1", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386832, "uuid": "57835d89-dfdd-4e8b-ac70-64613110827a", "comment": "Malware payload", "value": "1ab276232ae5b1244bf542947e791775bac32ad9e99638880d8cf99ff7d88cf4", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386832, "uuid": "0c711afd-aa75-4db4-8550-c194fea27d03", "comment": "Malware payload", "value": "9c9802340f587c5691304a33fc257783e320e55f", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386832, "uuid": "8ae2acfb-3d55-4b91-a1b2-54d1e414ce4d", "comment": "Malware payload", "value": "8877340de7f3399bdefaf2867cf4c3dc1ebc020fd89ac53b335e983734a54bf67a97163a98b4378d5b231935e6e35d11", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386832, "uuid": "64286b4f-9a83-4629-a6c8-080869d98620", "value": "T1089423927E087E9F05F409348A72DEF4E0259DBFEE7602CCA4421C19E47B2E653D92D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386832, "uuid": "77535fa0-6ca0-4b18-949a-300f37aff589", "value": "12288:X8/4FZu4D/uvXP0ssdCiwhYB+BcHxU6uMLYE:xnu4DmfP09dCnYHHO58YE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386832, "uuid": "46422054-1d26-4eb0-bd8d-13c65d0e69e7", "value": 411028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386832, "uuid": "f796f7e6-0100-4588-9c68-708c794cef9b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386832, "uuid": "2f7a4bac-02f3-48eb-907f-cb4681e5bafd", "value": "invoice and packing details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c572f870-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639408642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408642, "uuid": "97f8a370-3504-43d7-bffd-491f04090f76", "comment": "Malware payload (STRRAT)", "value": "b1467334c88785074a65f4a908a98852", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408642, "uuid": "0a12c21e-af27-4744-9642-4e08b3cadaf5", "comment": "Malware payload (STRRAT)", "value": "1ad5d9e88b0356a59d02aa52ddbb663719b46085e3075e7f171c609083a09db0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408642, "uuid": "b9478c0d-5b41-4c43-a91d-66489db0c349", "comment": "Malware payload (STRRAT)", "value": "f03287324b6a6d87458802faf8626a8b37f7ea76", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408642, "uuid": "618ad0cd-7e86-477f-9451-c7cae0bc7d61", "comment": "Malware payload (STRRAT)", "value": "0d45fb0ba887dcee65840bddfc0c5c8ba783249ac2cae0f4544800baef5d0db9177a828aca0e9395759c4db55d59ed77", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408642, "uuid": "1190f55c-767f-4e17-af7a-6e7da9eb5126", "value": "T1CFA3CF1B3D9B81BBE1678532D0468337B61D5298C049A11B2EFD16C70DF2C695B2AECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408642, "uuid": "7c0f5c6d-a5bf-40c5-96d5-d2af02b22ab1", "value": "1536:c3J/KS7hybQZfYk73AYJBCYY3X5vA7hxnJ5nukEMC4KLs808gV/KXDxkU:c3JJOuVAYT63X5v+hlJ5uz1/o807SkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408642, "uuid": "8d8c812b-3551-46ca-8f96-fd37c6948595", "value": 97740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408642, "uuid": "37819c20-6658-418f-9864-717ea2b1cfd2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408642, "uuid": "eeaddc8f-4b6e-407f-a709-b6f5a840822e", "value": "SHIPMENT_DOCUMENTS_INV-PLIST_BL PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961a1352-5be0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639378069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378069, "uuid": "dba975ac-5912-4248-9ccc-341248a46fae", "comment": "Malware payload", "value": "64efe503e0c16111485e78f7cab16d07", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378069, "uuid": "eb759321-57d5-4a36-92c6-b29078435151", "comment": "Malware payload", "value": "1aed792d29e5f829fa7b1de54f698d8e4ee4e77f0baa9e7362dd46b686fc581b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378069, "uuid": "f6293143-eb6f-4e8e-beeb-7a2681b1bb3c", "comment": "Malware payload", "value": "34f5f00e048e0485da3f3f5055f9b78cb9928c9b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378069, "uuid": "1d4eda2c-6b50-4b5c-b165-a33ae5edaa68", "comment": "Malware payload", "value": "c426e84585f9f269c6342980eb45010fcf8a76b501a764e42bfd163c4b060faad084e605b3976685a9b874627735314d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378069, "uuid": "2c7f596e-3d53-40c6-9c65-cf6d12fcf15c", "value": "T143641249A9FBD7B2E0D3537AAAC8A130C365DC354B01A4C71585F22EA435BC0CD7FA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378069, "uuid": "0aaceffc-eaf6-4ddc-ad32-21fc8a5572d8", "value": "6144:xs9zlcThTYlHrH6jjUkcbfL7cCsDoyFqsPTHPno+43XSqOLp:6z6U3LfcdDorETHvo+43XGLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639378069, "uuid": "ded1ba7f-fb2d-4aa7-89e0-57344436a22c", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639378069, "uuid": "5ac384c2-9c4e-4604-99c3-fe2f3888cb5b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378069, "uuid": "fbd31e8c-4a14-4c0f-a20d-5a5c16aae6db", "value": "SECUREDXQUOTATIONXFORX674993XORDERX.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944da8b0-5c61-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433471, "uuid": "1ad4bc54-8b90-46b5-bf9f-f8e3307b29d0", "comment": "Malware payload", "value": "c3bca7439e62a7c039121c1926ba8979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433471, "uuid": "bbab4c1f-b2f8-449d-80f0-bdd341e589f8", "comment": "Malware payload", "value": "1bc95ae62d31b8b9c4a34c80049f693cb31199e768af6ac4a33fe082b34209a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433471, "uuid": "6eeed2c1-d01a-4d7b-8f26-326cc1ecb253", "comment": "Malware payload", "value": "b3f25a56de24f515f43cb6310d9239daa87f92e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433471, "uuid": "c2d28814-c388-45e7-b7d2-4d573539581f", "comment": "Malware payload", "value": "820714f014fc003e8287ecff4ab0138bd467409b17bd70a677a600c31371d43dbc5810b5dc8537b1ff57f1f06f56d080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433471, "uuid": "f61302de-8468-4dea-8943-2866eb1490dc", "value": "T1FCF4AF13F6E18873D1373EB8AD9756A48CE5BF002934A8466BF43D8C8F346A17A35197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433471, "uuid": "53e7cc8e-62af-42b4-8a62-4386e383ac52", "value": "fa0e7f1e414f64ce479e9b2ae5bbfdde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433471, "uuid": "47de2555-f308-4349-a35f-5506b7aff3f5", "value": "12288:x3+1u3fSageKokouFWsr1wYs60jHD0dhc1squpMQ:x3+iboodOLf0f0dmmNpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433471, "uuid": "f78a5d5c-578f-43d9-8262-2541c8dee8c0", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433471, "uuid": "b9ba76ca-7ecc-4c48-9826-3ff107cfbb25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433471, "uuid": "a99fe5b0-92bc-48a0-b975-462474cf2a28", "value": "PO_2021YG1312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f16116-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355812, "uuid": "95485023-19c1-4a67-978a-2aff19f16a57", "comment": "Malware payload (RedLineStealer)", "value": "62201c2f4c90866e9048ab60e3573591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355812, "uuid": "d8dceb12-fb0b-4967-8ef8-2d6d64d4c1cb", "comment": "Malware payload (RedLineStealer)", "value": "1c71b83cbb3da5825be602ea9be89c322e571b53a6501f781464421c9a397961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355812, "uuid": "d4f7ccdc-5465-4eab-9363-2f7f46fd6aee", "comment": "Malware payload (RedLineStealer)", "value": "2be3c09829760a31023928df611f259a73c0e386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355812, "uuid": "c7d571fd-339e-4cb8-920f-8f653ad3d800", "comment": "Malware payload (RedLineStealer)", "value": "5af8b3f25caf6239b6db7790beee69dfd30369abbddd23d0ba6b72e22aa9bd6a848789bdb9dcc7142e069d009824e3c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355812, "uuid": "71e6528d-7d8d-4014-a591-e99b03321036", "value": "T1474439C72FB0AC57C868C9F05DA395D1C6F26DE3D82C8611F380AA1E769738C7529A1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355812, "uuid": "e1e1cb24-8595-4613-9229-1a4098ffb591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355812, "uuid": "7ce8c330-8273-4b1d-91a3-41e490d2bc70", "value": "3072:/jdiCgEzLbF0azX86nbOmxrKKHbBTQXUPdywGyTzBpOo:/j8ClbFLxrl7BBT9Io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355812, "uuid": "c7c0857f-0cfd-4ca8-bf44-b4c01a29ae2f", "value": 267368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355812, "uuid": "1b788aff-d74a-406b-81f5-b8f256ccf036", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355812, "uuid": "713eb9f3-96a4-41ca-b4ba-7b59e722689b", "value": "SecuriteInfo.com.Trojan-Spy.MSIL.Stealer.gen.27309.8414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed89728-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408336, "uuid": "575be605-f31c-4265-b024-80d60be94a41", "comment": "Malware payload (Formbook)", "value": "d4fcac78c26af853588db3dee9bb3d8c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408336, "uuid": "ca614a56-d6cc-45a0-bec2-5706c77738d7", "comment": "Malware payload (Formbook)", "value": "1e01b6dfb7079c9968271e36853f0d4d368f7c1e1b62b218123a9ff191f8b50c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408336, "uuid": "24fdabb5-8901-4bfd-9f66-77df9367783a", "comment": "Malware payload (Formbook)", "value": "d66aa498129843c4c23c7eb3e01c93a0ec36b0bc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408336, "uuid": "d561be76-d677-4141-a0fe-8de29b95a6ba", "comment": "Malware payload (Formbook)", "value": "fc921747eef6ec9d24a29a535865018c4833dab7289cb3f5dc5a2c8dd4f9099a0d34d469b7a18b72d3cf23dc1b6e7892", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408336, "uuid": "bd4d22aa-45e7-4e7f-aec8-498188b1caad", "value": "T16564127031D0D79DD9621BF8AE2425166C3BEC6C6B68240B2E03315C95BC2DDF276E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408336, "uuid": "df741a13-f8df-4257-9af6-ca33c7372159", "value": "6144:zMZ20SU1fb6At/D8tIpfLrhTwuT3yQDcBJVsa9umgX60gQ01wZVw6mh4HsvA1:zMUqpbp9wc3yQwbVsa9nC60gz0w6mxv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408336, "uuid": "0ed26e21-1523-4e81-97b4-729150dd8621", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408336, "uuid": "d6d0475b-f956-4c2f-af96-c40db14af58d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408336, "uuid": "baec3f36-9d82-4b5f-8d7d-2904b20a1b23", "value": "41111.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72ae29b-5c43-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639420617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420617, "uuid": "062b8ba2-77fd-46d6-8423-f54a82b72cbe", "comment": "Malware payload (Formbook)", "value": "acaff3a2d0818c66b73072c76782924b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420617, "uuid": "609466d8-9759-4e80-bcce-80c59acf978b", "comment": "Malware payload (Formbook)", "value": "1e614cf564bedf5c140013cb4227786b5975d2b61757ed7f9ce8cf5d9fdcffe3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420617, "uuid": "82ca9661-b2cb-40de-8ae8-01df15ad8468", "comment": "Malware payload (Formbook)", "value": "a9bd3b018ef40b8ba8e97d0c99bcd68effe0933b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420617, "uuid": "78f36826-f599-47ef-b435-23378b82a73d", "comment": "Malware payload (Formbook)", "value": "c8b6cefe8477bedc134c570beb3f093e14ce08e3c1121612b2705f035cc6c152af0d9494bd2cc989a52470d3642d890d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420617, "uuid": "8bd00ea1-4ef5-4ef5-a00e-204d49864d3c", "value": "T1E954D4B26502AB2EF508EF73C35FB72878606EDA6CD1465CD90E372855381F54EB6388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420617, "uuid": "a8a71259-3996-454b-befd-5159c3d57060", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420617, "uuid": "bfe191b6-3d36-42a9-8c5e-82017044512a", "value": "1536:g95BMvbXqLDFQNO4VskUKrBa7HeZxPe8rGB0Bk:i5BMvbXqLDFQPxaWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639420617, "uuid": "d893a727-5ff2-4031-99c5-2c924638296f", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639420617, "uuid": "eb1a8896-de62-444e-90d0-64034b39a850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420617, "uuid": "0ca282ae-6849-4898-86e1-3b51213a05d9", "value": "acaff3a2d0818c66b73072c76782924b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a5f4f2-5bc7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639367406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367406, "uuid": "16912d38-3c1b-491b-aa3a-94b4eb34242b", "comment": "Malware payload (Mirai)", "value": "b961e81410cfcb041dba0349edd34904", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367406, "uuid": "45edcfc7-284a-46b9-bc61-427954bc51a7", "comment": "Malware payload (Mirai)", "value": "1f6d5d4cdf770a4ce430a7eb2adf50076a707e12f6a1cde1e6092f70a65e7a32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367406, "uuid": "32960c72-9bb7-41e4-b26a-0940d6adaef7", "comment": "Malware payload (Mirai)", "value": "4e74633876c129920b642ec3392b880efa5bd23d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367406, "uuid": "b03ff7b3-70a1-4eb4-98ec-a3eb87b63c6c", "comment": "Malware payload (Mirai)", "value": "a69de8feb435f24d6028a7491e163420226bfc1d11dfe4c317da75849fae1acc2a70d56f894cfa8bb0bbd80c2fc3c134", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367406, "uuid": "39612bb8-dc73-4f02-8ba6-8d07b167437f", "value": "T1A7B2BF3EE8AD7561CA3A097C828D23274F9825C2B2EF4B4C335A4CD59993356F64C879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367406, "uuid": "c5f998dc-b9b8-470a-8f17-290bd3c8b819", "value": "384:HFlBUkgXosS2QACmjjAEdQqJIn4gh+tTyPBvILatUkc04GEmuTF1xWwIVmVaRWG8:OkWAaLjjFeFn4JWvILath4GEmuZ1kQVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639367406, "uuid": "d2d698b0-24bc-448a-baaa-b4e37e462ebf", "value": 24524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639367406, "uuid": "684cff9a-6596-483f-b712-a74548113d16", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367406, "uuid": "f761e808-8a71-4f69-af5d-99677724b392", "value": "b3astmode.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac6a7a5-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407846, "uuid": "742a35f0-7226-40fd-8123-0f90964719d1", "comment": "Malware payload (SnakeKeylogger)", "value": "2c258dc907cc97c7d8818946847d59d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407846, "uuid": "181d7d90-cfc2-4da9-96cb-d475303fb23e", "comment": "Malware payload (SnakeKeylogger)", "value": "20f04fcfcb818a6ef77d00cae2bd8788ff7a8a060256b700eeadd2f3e02df374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407846, "uuid": "b59c9382-520b-460b-8f43-631c27bea856", "comment": "Malware payload (SnakeKeylogger)", "value": "1afb0a099bf09a6b0846609150ee7b239a28d5fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407846, "uuid": "72b6f2da-7c3f-4450-ab91-29932163277f", "comment": "Malware payload (SnakeKeylogger)", "value": "2f22ae45fe0bba45c6e65274f1134e1664a59a75862c959367bfd08108ec24f409492dbf1c89f1159ed3b821367c9519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407846, "uuid": "f61fa161-40d6-45dd-a05d-2db857acb24e", "value": "T1B3651216E6509A34ED2D2734A932C53043227D6DBC35E22E19E47C9F3FBBBE29015663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407846, "uuid": "b0ed5ccb-27ca-48b4-8731-a8edea7d02f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407846, "uuid": "400c1849-70ae-4149-bcfa-a62d80672518", "value": "24576:7XOHtEgQcfTKFzUctRU4AqkFyM5F1a4WxUbvt/ShtCSmuQYn8CZPHs53ZJ+t:jOygQcO9xKJqeL5/TB6vbNHE+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407846, "uuid": "80b77371-a094-4737-9541-82dbe0664c4e", "value": 1448960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407846, "uuid": "c3a8b7c4-ca86-493d-a3fa-8542416272f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407846, "uuid": "a14b2857-3662-4806-9df8-19b7b4552877", "value": "purchase order #202201 January 2022 delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84724db7-5c3d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639417982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417982, "uuid": "49b3b68a-2153-4d4e-a3bd-a8a41ab416d9", "comment": "Malware payload (AgentTesla)", "value": "032c93671e23484b69955ad2fd331cba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417982, "uuid": "08457074-bf5c-4cf6-87e4-88a1769b4211", "comment": "Malware payload (AgentTesla)", "value": "2160d6dfd4a63bb126a03bfbf6f1df9bdff5dc6dc712a660b70fa22b9c544920", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417982, "uuid": "eff0d472-5cb4-4b44-8172-54689491e508", "comment": "Malware payload (AgentTesla)", "value": "7eaa9f12f128ae646a4c6045940e5892cc646ffa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417982, "uuid": "1da1269a-5089-4889-87d2-cb7e695cf92c", "comment": "Malware payload (AgentTesla)", "value": "14d5176387b688f06a91d8f864343866f9bd193338801d140ab81aa2e6f133eced7ddda5d9016f56abcfdd2922af5cf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417982, "uuid": "52ef6c5c-319e-4eb2-9053-82abf181e115", "value": "T13855234A70A8AB07D23AD6F85FE129524371C1252E92F3589CC812E61F36FE35E127D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417982, "uuid": "7c64fff5-d169-48fb-a756-37d7f4b7a020", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417982, "uuid": "c78847be-7cf2-4775-b6d1-2f46bd08fc00", "value": "24576:tB0MKDVWRB+1NI0WaXOU1r+dFhdLWYm9DxGxMaXb7Gaqv11+CxeedV:/0M8IRwjXWsO3jfW79DxGNQ79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639417982, "uuid": "81626e00-a014-4a94-8553-7ca1ecb6f3a7", "value": 1341440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639417982, "uuid": "bdf15c6f-1a50-4cc6-9f7f-1b19aa98e79b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417982, "uuid": "dc04f428-afaf-4639-b43d-2d95c3ba2534", "value": "N \u00f8 0002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ce543b-5c57-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639429230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429230, "uuid": "d0be3ddd-cdd3-4820-8d47-e6aaddc0ddd4", "comment": "Malware payload", "value": "fe76c8fbaae02426f2b1adf605c971e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429230, "uuid": "349335e5-adbe-4fc5-860e-c79eac5e2c68", "comment": "Malware payload", "value": "2188ba59be5637dbc7e38dbf6eb379d43a1c62eaa3301cbfc680b02c5a36c023", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429230, "uuid": "7546ca4c-51d8-4b63-8e1c-b7c219839462", "comment": "Malware payload", "value": "f56f89fe9532ab65cc93427e24afa48b2fd1eaea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429230, "uuid": "764528a0-d57e-4ff0-90db-792c0710c3d2", "comment": "Malware payload", "value": "73c9bb7fe9be20ae04d41c9aa903524d0c190a726ae833139aecffec98eb966de2082512662344f50225d159786f4c78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429230, "uuid": "a5cb9220-a0ea-42ab-a54c-469e8151136b", "value": "T1D7B4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429230, "uuid": "cd6c91d8-6c3f-44ed-be55-da6dd8866488", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429230, "uuid": "e79e222d-46d2-439b-961f-57e42676b99c", "value": "6144:bKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:b9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639429230, "uuid": "ba8f612d-b751-4707-b309-b95c29b4ec7f", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639429230, "uuid": "6242c2f0-0b56-4f86-bdbe-3fd9e2c1dcfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429230, "uuid": "4a484320-b4c5-4a70-a018-2ca085451b1d", "value": "fe76c8fbaae02426f2b1adf605c971e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621450d8-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639426085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426085, "uuid": "990593fd-66b1-4853-b015-3f45757954e1", "comment": "Malware payload (Loki)", "value": "cb9766eb9f2ebe7326ad9e4e6a17c6ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426085, "uuid": "49cb6ac5-5022-4599-952f-120662517b9f", "comment": "Malware payload (Loki)", "value": "21fb7711488cf82187fd78369e4fcf888525d127d1b379c02f0a4e19d802e671", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426085, "uuid": "fe42f382-571a-405c-9591-462c5cc1ad7d", "comment": "Malware payload (Loki)", "value": "f9596463722401263f1ba4415eeaf3f6d52fceb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426085, "uuid": "e3ec3231-6c23-400b-8050-fc3096edab41", "comment": "Malware payload (Loki)", "value": "1f84836b7d0ad0ee3ae35f7e94b35a05197c2129eab4a795e05e53139da2cf3bb55ec63497ea5675ad42f22debcb8a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426085, "uuid": "c6ac1156-acd9-48ee-8f93-b8dcad0038c6", "value": "T15545125A73A49A14E6BF17B9A0B1C1308732BD01E926C31E6ED57DAF3E337614900B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426085, "uuid": "23d70e87-b396-4356-9135-6d74b135ac6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426085, "uuid": "810b4a59-1521-4105-b84b-25bea7f0ce3e", "value": "24576:u5XOHtEgqVklYw6WFLi421CwJB971bFO1apqOU:uxOygkpFWFGZtB971LqOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426085, "uuid": "23a05963-07f2-4701-8a61-e5abecd2205d", "value": 1272832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426085, "uuid": "e2e3b7f2-ad6d-450b-a89b-51f64683d6e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426085, "uuid": "87092f63-6073-43f1-9b94-0ceb6da14641", "value": "UT09586846358599.SCR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913a686f-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639408125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408125, "uuid": "5a727597-e9c6-431b-928c-e0fcb4b16c5a", "comment": "Malware payload (Loki)", "value": "36bfefea677e3939e5018a83e94792dc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408125, "uuid": "6830866e-6098-45e4-83a6-47d9530b0c67", "comment": "Malware payload (Loki)", "value": "2280e408274ba308f6fc66bbf9bb6ac2c5c30e281b053e46a6cbcc9310a7666a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408125, "uuid": "657f6d80-7eec-4ef1-a4bb-e7d2c59c25eb", "comment": "Malware payload (Loki)", "value": "727c559b8867e11eb63e6518aefabcaedf89d9fc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408125, "uuid": "ee861008-c863-4b86-abd3-3a13c2845a7a", "comment": "Malware payload (Loki)", "value": "6a28c3f398f21dc2a37c8b8fcb454f9159f3b0b48df5511745a88b3baa0c72b5ab50579b161514549b78f641b10f51b9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408125, "uuid": "9aafd26c-9828-44af-80f4-b95736d3d386", "value": "T1D681E752134D1C13FA4685E6D465FFA71917F3EE80C71AC4B22EFAF1073721069B6442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408125, "uuid": "4617e85e-0796-449b-85bc-0aafddfb14d2", "value": "96:y8N0eOTDiLUfdIEq0zGNPqVSmj49JSV1xaPluWgkuFi1uvuI:y8miLUj6t0EJSDmkWNuF+w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408125, "uuid": "223294c7-405e-4538-b211-695f89596bbd", "value": 4175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408125, "uuid": "1a982344-1b81-46b6-b55c-a5e970a8a2b8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408125, "uuid": "ca206ee7-db32-4d9a-9594-702cbdd14f55", "value": "NEW ORDER 256831.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ae147c-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639395065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395065, "uuid": "883e0784-8d50-46f8-88e3-0a2ae94de11d", "comment": "Malware payload (AgentTesla)", "value": "3029436a6f023b7f08ea0ffbd83693b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395065, "uuid": "49a06142-232f-4bcf-afb2-26c4aca0f3cb", "comment": "Malware payload (AgentTesla)", "value": "23033a273c86c24421d05547c1da953de7b744d4256aafd7c980b061caac515c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395065, "uuid": "075f0def-15a0-4ebe-a861-c28498347c50", "comment": "Malware payload (AgentTesla)", "value": "8d98f69b020e50963b788237befaa8d7221e9625", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395065, "uuid": "380e6b1d-66f4-4ece-bd5e-3acda620c758", "comment": "Malware payload (AgentTesla)", "value": "d85fe0ae30d2fd91f2af39a07f1d033af6a9116ed7ee1b78b3252d3300c76dd1633f2d78901440121583f4dc48c3ed10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395065, "uuid": "74685950-db76-4b88-bc70-b2f502153473", "value": "T1CAB4230B33A0774E403277990E0E283595897A8499DFD9ED6444BBB0EB7D89B613CF72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395065, "uuid": "20244544-1f72-4e0f-a079-cefa3a20ef3d", "value": "12288:JmvJPaIlgnzMbzpQTPY1ek2uQq6d2y2XR1ZyONJ2p:JmFsnoqUYk396d2NLEiJ2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395065, "uuid": "af3f9970-d09b-43f3-84c7-c9186c114235", "value": 504381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395065, "uuid": "2838aa09-8494-4504-bbb2-509e254afdde", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395065, "uuid": "07c87826-960e-4123-843f-d226fcfc8ce3", "value": "ITW-EAE_Ref-20211212112010.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60970fde-5c0b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639396447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396447, "uuid": "581d4d17-7e68-4e16-bb45-991c8aa001f3", "comment": "Malware payload (Formbook)", "value": "f8908f479c3541372a809ddef7c2f0cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396447, "uuid": "9f7e19db-5b4d-4a95-8868-4fed842effdc", "comment": "Malware payload (Formbook)", "value": "250ebc9da2be5c46efeb561cd89bf9786a6c7a5f84f741397c4d0a5366dd2a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396447, "uuid": "df6464f8-9e4c-4027-9de2-71f4d769f4dd", "comment": "Malware payload (Formbook)", "value": "11072f97d7a39c53fa470ded3e24b35614415614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396447, "uuid": "db9a379f-5ea6-435d-b684-952a3b08cff4", "comment": "Malware payload (Formbook)", "value": "043760c226a71edd761c099f25c154378c2eee0b5bb4c569cbe8c4153578ba43c070d6e8066ee01db122a5ed029c233f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396447, "uuid": "b7a71375-cf64-4b03-b0b0-8680d381f858", "value": "T1B9D4E306DE507AA5C0078536809C682CD1D86EDB61B89085F3917E87C7A708FADFFE5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396447, "uuid": "48de97d5-80b3-4eaa-8fb2-38fa5d9b6cf2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396447, "uuid": "d942b944-6e13-4978-9249-dd323056738e", "value": "12288:Bdp5pNVI9VQ9seECEk3l+sooOdwSSt20lXmMU43E:x5SQ9setEqssoPwft20l2fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639396447, "uuid": "964bfd8c-3d26-4473-b5da-04875a058c98", "value": 649759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639396447, "uuid": "54d33298-89ea-41b2-b172-40b1bf73b2c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396447, "uuid": "5ff65ee8-8f31-4e99-8067-385032aeda42", "value": "DHL_AWB_NO#90785388091100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4980ac-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639426102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426102, "uuid": "2aaf6333-4f81-48b6-b782-93eb8dac5849", "comment": "Malware payload (Loki)", "value": "7b23545dfd4ec0c95a2d0304f2cd34a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426102, "uuid": "8263ab8e-516b-4371-ac60-bd3c0be99327", "comment": "Malware payload (Loki)", "value": "26231832bd1a16e078833ff74fb20aba25b6b7320e93e8638ac72d133a2c46dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426102, "uuid": "fa011f47-f06d-49c4-9a62-070ec66b34fb", "comment": "Malware payload (Loki)", "value": "a5177d26cc1b64ea59a76a866209c4c277b46915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426102, "uuid": "08c8fb9a-3a63-4649-82db-4711efc68f5c", "comment": "Malware payload (Loki)", "value": "9303d91673eb5082ff58c299416360129536ed20942f07b99def3ab7386e62457031ec75602250b81e5be231f4d26d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426102, "uuid": "59238e19-35eb-4b6f-81d9-33fc816a7b92", "value": "T1E245125D33A48A18F56E03B9A071C1248B76FE04A926D31E79C53DEF3E727909A04B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426102, "uuid": "3a14bee3-f8a8-47bc-9d9a-a77c46bccab8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426102, "uuid": "024ed85b-6c00-4fda-9a6f-a01355d689b7", "value": "24576:X1AVkDeHeKHsZx+J6B3w5FHrjbGnF0W87EQMXOHtEga:FArlIxLBA5lrfGF0bEXOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426102, "uuid": "c76a7b9f-dd3e-4514-8dcb-863c1eb6f489", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426102, "uuid": "92b7c98c-7d82-4e8a-b417-073c603c76a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426102, "uuid": "1ed6d890-a75d-4460-a6fc-d8a70fea7867", "value": "HU09585763553588.SCR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4591035a-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426037, "uuid": "1c4f3632-fbb1-441d-b6a9-a77fc05f00c0", "comment": "Malware payload (RedLineStealer)", "value": "05a1bc5735be4d72eb951fb9f3512d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426037, "uuid": "395508d4-dbdd-4b71-9e70-8388fb59b231", "comment": "Malware payload (RedLineStealer)", "value": "263b450d99f9b6a2ebd0d74ebf15ac049f67e989a91cf42c22a49b23ed1403f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426037, "uuid": "a30ca294-2b12-4d47-8571-2d72435c7831", "comment": "Malware payload (RedLineStealer)", "value": "ca9a22e8a6b2dc02a8611e1d7601980a696cd830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426037, "uuid": "72345dcb-b9f4-4114-bde5-abca825cd317", "comment": "Malware payload (RedLineStealer)", "value": "dd625cc67fe2584df739219aa9ce713cb7bf011829fa268a5bfcef1bbf5182a8e5953045ba5f6ae81856cc96b5492cb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426037, "uuid": "d9b994c7-6dd1-49d4-8628-0d0e4351ba34", "value": "T15D64E0CD7AA0C431C16A3D359930CBE45DBFB961D660816B37B82B9E6F723C04E2571A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426037, "uuid": "ce0ccb1d-b676-40e4-a628-93cb0a41b749", "value": "890535c33f1fc2a002e2ca470b68a66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426037, "uuid": "15cb34b0-acb9-4c87-85a8-78be662dc125", "value": "6144:xye1Lo8JDA3xPvnjELDjo4lel+GNyb7ITsqSIV:xH1VQZUo4lecGc7LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426037, "uuid": "7e2dc135-111d-4e2d-813c-a7dc9ee5b0dc", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426037, "uuid": "bb6d6baa-4590-4d4d-9a18-64d4553e001d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426037, "uuid": "82218456-ce77-453e-accc-c3ce359ef51a", "value": "05a1bc5735be4d72eb951fb9f3512d80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a21cf9-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639407513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407513, "uuid": "5eb1b47d-4e14-49b4-bafe-e69adecc3c2a", "comment": "Malware payload (Gafgyt)", "value": "7ab94c64a627b29e75c35eb4fca1ff54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407513, "uuid": "e512d816-e73d-4bff-a02a-516a6ad306ca", "comment": "Malware payload (Gafgyt)", "value": "26bc95206deb5e374105454a112511862bb2ba390043cacec7a9557b18125d6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407513, "uuid": "35d5421f-6df3-480d-be8a-365142afa217", "comment": "Malware payload (Gafgyt)", "value": "b57493cf42ee48656631b0e81ca66b8ce35532e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407513, "uuid": "f393f459-ff46-4411-b3d9-394876749314", "comment": "Malware payload (Gafgyt)", "value": "7db8b676cdeb3dbe6b59b5577a0b1851f0ca5f4c87ab6ca960b4c174ced24295f5813c39a73ca063e25086883438a0cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407513, "uuid": "e46437f1-f61e-4f29-a18b-ab2a4c49f5fe", "value": "T183D3956EFA12EBBEE16C863107F76F70D39531A22AA1D341E16CDA181E7125C2D4F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407513, "uuid": "0ace79f7-d5e8-4d1b-8de2-8a7b50bd5de1", "value": "3072:jGTyrDxJWwAfr9f3yJddxUEJmTDmjOrWcpu3NJFARtRVJhGvaZqhZYiDhB/ZZ9B9:C+nZSZFnJeUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407513, "uuid": "b5125c31-59f9-46a2-99c3-568998380de0", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407513, "uuid": "325ded9e-3c19-4cd1-9817-585683075110", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407513, "uuid": "dd79f012-40b0-496d-9174-d244ace4fb0b", "value": "7ab94c64a627b29e75c35eb4fca1ff54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5d5c79-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639408302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408302, "uuid": "120fa422-b980-4bfb-b79c-1073db0ada51", "comment": "Malware payload (AZORult)", "value": "647f5c08b156d82c14807d0b1f4a1d02", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408302, "uuid": "776d1193-fa60-462b-8f99-d530792118dd", "comment": "Malware payload (AZORult)", "value": "26d585c77afdb4e606684d709456b09af3a4677da7dabe6b85a6c8fb13a6ae19", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408302, "uuid": "7668d2d0-2c22-4690-9d3d-b89d0634ce0b", "comment": "Malware payload (AZORult)", "value": "52ea3a76630e6adb7d89cab9a862d4b9f491d93d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408302, "uuid": "000ef14b-1bc3-4c64-902c-2d36a62538ea", "comment": "Malware payload (AZORult)", "value": "dd70c28053b19e4fea17a564ca1f470dcce6578e734eeb84266c653514cd6c7aa43c6e7af42ffbd59323962b0b4440f0", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408302, "uuid": "f8f6757a-8287-4d4e-aaba-d8c30381c7d3", "value": "T1CA6422693F981E6BFC91E73A20B935A5063ACC6C8CBA45E74572344752B2FD06763C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408302, "uuid": "9ed3c563-d61f-4f3c-90fa-becc878afdcb", "value": "6144:lTwIwpLXyn5qJS/DMeJxPnQegSgsG/3rWddMgBroBXbAvJmJtm2RQQ/s4:y3LWgJS/fJx/QegR3odPmXbQmJtm2eh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408302, "uuid": "b2ee50ab-cc67-42eb-98d5-05f9cce24714", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408302, "uuid": "57dd0861-9d0b-40c2-9b1e-95cd94545490", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408302, "uuid": "41c5bb78-33d9-440c-8fad-b621c8045ae1", "value": "DHL SHIPMENT ADDRESS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0769b08b-5bed-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639383413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383413, "uuid": "519c75f1-e3bc-4ba4-88c1-5d55d212923f", "comment": "Malware payload (AgentTesla)", "value": "0688f968d4228afde377e82e7aee3d59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383413, "uuid": "c0253309-4542-4316-8de0-2c495e2c1f6f", "comment": "Malware payload (AgentTesla)", "value": "27968da68f6236ef382c2c8bdd2ef69ec946066becf30d60b889f14e6bddb761", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383413, "uuid": "2eb6e6a3-4173-4e86-b2da-3c88fcae44b0", "comment": "Malware payload (AgentTesla)", "value": "e4d5ee1356063f421e1aea86bbc5c15d955f6d0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383413, "uuid": "f02565ab-b02c-4cca-ad24-58a7b8d6e7ca", "comment": "Malware payload (AgentTesla)", "value": "b2d2b3cc417516a2f83a2ebd26d1e63992bede3cba8600d2a896991bf08084b83eb4d94a86b0100d9120d3be909e9830", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383413, "uuid": "34764f4d-431b-4659-b470-df1a0aab82ee", "value": "T133234A42D2930263D95A5A73B49397C30BA4A30D5CF70E6BA8CD311E8E9F21A7553FC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383413, "uuid": "aedbc75e-bd6f-4a3f-9646-e872046bfd27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383413, "uuid": "a09583d5-6be8-4d4f-8fb7-3ca7749cfd30", "value": "768:AGYq2pmrs2GL+pAgka/8HHUTQQQQQQQBdy3bI91GN6bcE/2ihWSCAtkrjL1Fm:J2pr+pga/eHUTQQQQQQQBdBgN6b5/2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639383413, "uuid": "d3177776-22bb-4a65-9d90-7f4ec9e6d06a", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639383413, "uuid": "606b64b0-0b51-4880-8d8d-83688654dacc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383413, "uuid": "766d085e-6981-4920-9784-2bff0864eff5", "value": "AJC Internt'l#New Order Inquiry-pbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8034f13f-5c5e-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639432148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432148, "uuid": "4b41dbb0-c176-4e08-92a5-f3e77758bfdd", "comment": "Malware payload (AgentTesla)", "value": "49719e112898c23e21f925220c2e8c15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432148, "uuid": "dbf0105c-9054-4754-a510-344eb2b6ac9d", "comment": "Malware payload (AgentTesla)", "value": "2899caac6389de53536a18884426561fad7caa6244cac07aeb4451f06aeb3aba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432148, "uuid": "c01e0a76-b2f9-4132-bc86-be43106e3621", "comment": "Malware payload (AgentTesla)", "value": "dc2b3aa5590422ee562bea7ad07ea6fc2b0ef29b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432148, "uuid": "cf0ac99a-e29c-4e87-840e-e6519d98c3db", "comment": "Malware payload (AgentTesla)", "value": "dd6567227b4924638dd863257bcf79e318793c71d6bdce016397cc99450adf4eb8acbee33a9c395f8a4eb7f2280371be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432148, "uuid": "11e32e24-dcce-451f-845e-10c8a159143f", "value": "T1365523597624DA73D1B9A7F4CA9A846907F0782B3E11E78D3CDB63CA0615FD14B021CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432148, "uuid": "33b72ac0-8028-4c63-8dde-a1f6c5113209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432148, "uuid": "29e14a10-1e19-4c43-a6d7-e49305a185e7", "value": "24576:0yNfFoZbpb8E7jvCfgXg5xs94O+j16td17IyWjl+1fK17jDPwDsHUejcMN:nmF6E7ja95xIRn7g+1S13TkItjcMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432148, "uuid": "74ce9559-36bd-412a-8eb1-238f5cc24282", "value": 1384960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432148, "uuid": "da4ca60d-bb34-4306-b45a-81ab9f1ac768", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432148, "uuid": "e7a4c40d-c52c-463c-b5e5-6104218c09b5", "value": "49719e112898c23e21f925220c2e8c15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c82138-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639408180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408180, "uuid": "1e17a12f-3573-465e-92c2-48c94f39f098", "comment": "Malware payload (Gafgyt)", "value": "156480bb1de62c70f5cdc2ca34f77afe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408180, "uuid": "6de5b783-b614-4f7d-be5d-b8c7a204293c", "comment": "Malware payload (Gafgyt)", "value": "295e22b2fe090b791f5701060ea56478a391abc5a76d489354143e70d5a7e0a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408180, "uuid": "a09f9259-5f3f-40d2-b44a-eba5acd760d2", "comment": "Malware payload (Gafgyt)", "value": "f6486eb7f91a508947d7d73b0b635377ae4eb675", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408180, "uuid": "f036eb98-e406-4da5-9725-8e2645a9f6a4", "comment": "Malware payload (Gafgyt)", "value": "2bf1aad671b12ce899b691f12ece0957e4e0be1994cd245c7068e66adc50a9d582358cdb73e1d5aae856b0ff79cd19e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408180, "uuid": "45785276-fcef-4677-9da0-c868865aff58", "value": "T157835C49D747CAB3C88307B2029BBA764532F93B5E2E9E45F70D7CB49B124D87226712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408180, "uuid": "f1fbcd0f-42ca-4f03-8fd7-4d49f666f2fa", "value": "1536:sQmab6bXPm8VjWWHT0im5t3ItTShKW6GLdUF5MI5AtpgwLUOGHfV+mLI2VOYjXUd:Oab6bXPm8VjWWHT0B5t4tcnBUF5MI5dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408180, "uuid": "0b30a1bb-1832-4807-abcb-6603e7bdd23c", "value": 86409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408180, "uuid": "be060eae-38e2-4625-8a0a-7c2efc3f41a9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408180, "uuid": "a00dd324-4967-4e14-9a06-8d560c987863", "value": "156480bb1de62c70f5cdc2ca34f77afe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59e44c3-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355814, "uuid": "1bb3256f-5716-426b-9736-040b3bffd285", "comment": "Malware payload (RedLineStealer)", "value": "73ca85003efbe04345270bf94f466e6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355814, "uuid": "0d32d7e4-7985-4a88-91ea-b43e6a79b672", "comment": "Malware payload (RedLineStealer)", "value": "2a0ccca01fa3457b091c167af55cfb3314edaa94c95a7e2fcb3d241b943aaccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355814, "uuid": "71456d5f-c945-44d0-bc5d-ed21c8bcc130", "comment": "Malware payload (RedLineStealer)", "value": "f8a416dc152465c5ca359248b4f8bb07129fceb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355814, "uuid": "d2748a26-2180-4dd1-aac8-cb234b23759b", "comment": "Malware payload (RedLineStealer)", "value": "022359614fd6bb6d7c9e2bfbb47131647e0bbb74adf902c2e287e0eddb2e8fae037e3263eedcf8a355d7970475d44586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355814, "uuid": "9e3a89e3-a66d-4074-bc7d-db68c63c9447", "value": "T1D9B4F53839FA5019F273EF759AD878A7DAAFF7633703A15E105103864A13A81DED1239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355814, "uuid": "9700702f-de0f-44bf-86eb-c88bcf90ead2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355814, "uuid": "e6001ce2-373e-4b7d-81c6-e3e34b6be50f", "value": "12288:cnWLpb4YEE0e0+EU9cF/mAIIEIp043kj5Cwh:qEsYn/ojOC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355814, "uuid": "1169a09e-4dbb-4c81-ab70-0048eef60ad9", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355814, "uuid": "128d77b5-b3b7-4061-a230-7a6bcae98739", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355814, "uuid": "2877be62-d5be-4bd2-8d21-61c3d4f921ce", "value": "SecuriteInfo.com.Trojan.Siggen16.711.21005.64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f07b97-5c61-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433467, "uuid": "15f3d56c-3ebb-4586-8670-79146ecdb9ee", "comment": "Malware payload", "value": "fdca9f0aa7f4d51201cf3b0474adcc76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433467, "uuid": "cee8ebc9-d062-4703-b2f8-2b3ab05a2b12", "comment": "Malware payload", "value": "2b376c183bc46e56550fc8827e0b8e773e8fa49ef70635184607ae1b79c4ac0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433467, "uuid": "31c6fcc5-3a0a-4665-a660-8e00bb9bef0e", "comment": "Malware payload", "value": "89b4f42ad3fe44608f1852d2ef68379ba368bdd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433467, "uuid": "10895ec5-23b6-46c8-8aa8-12d51bd816ae", "comment": "Malware payload", "value": "7cd1c3159f6feba7c7a91e253367600b763df103b41b40f30b30892437a21de38b00650036ec676a1c05c1c42fd99c44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433467, "uuid": "4fcbbb0d-ea86-4e57-a362-b20c6da45674", "value": "T1D255336E31FC6761C1B8E7B9235503D223B56416312AF6426EC9B2D628BA7C1CA107DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433467, "uuid": "227235fc-2ae5-4e4b-8fda-bf030d8fda3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433467, "uuid": "998e5d30-1da3-4d19-9155-60c74c134432", "value": "24576:r6uaUbkQyuNvj/SsiqMT8MGPYnZ18eXQOSREAyOlnEP1jnAoznFxu:r6uaUbkQyuVj/SvqMTeA+Oo1lnE97A8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433467, "uuid": "74495780-ca1b-4854-beea-7fad9ffe649f", "value": 1317376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433467, "uuid": "6a755f14-828f-47ad-938b-834de54a0a46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433467, "uuid": "a0c11541-bad7-4aad-8b2c-ca8004f937ac", "value": "\u00d6deme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c40960f-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639414022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414022, "uuid": "579cf1f2-46fc-46c3-8d7d-343741479a08", "comment": "Malware payload (njrat)", "value": "6c95025f2875badef97590d2959dc712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414022, "uuid": "dfc380ec-658a-4a22-a50f-cee91dea6bc2", "comment": "Malware payload (njrat)", "value": "2c93b625471a6651f95b8d35940acaedc9263ffaef689204948d7614507ad259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414022, "uuid": "643d62c0-a533-4ec6-a4b0-a86fdfe46128", "comment": "Malware payload (njrat)", "value": "7c62a27c40c169d07325cd9e1bc9e29c8d546e04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414022, "uuid": "24789a3a-9976-4c74-b8a4-6a9cbd475e0a", "comment": "Malware payload (njrat)", "value": "e8e59a89dc86a82314b99d0175453d77f015c5781ef2e2d9e466ebd2a615193f91873ad9f67e49a5f09cdbd88582b393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414022, "uuid": "b33e0717-a472-4bde-bc06-7bb447a499d9", "value": "T14093E74977E52524E4BF56F79871F2004E34B48B1602E39D48F259AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414022, "uuid": "8a9d00b0-77e2-4715-b719-40cfe27d4b96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414022, "uuid": "4c719988-61f7-4b5a-a208-9c81cdcf65f4", "value": "768:YY33UnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3CsGN:XUxOx6baIa9RZj00ljEwzGi1dD+DpgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414022, "uuid": "ad33f559-308d-48f8-81c0-4e6c2c1a5a0a", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414022, "uuid": "8d1ee707-ca2d-4653-a938-0d5746cdbe86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414022, "uuid": "8c692830-c945-4982-b080-83418ee13bb5", "value": "6c95025f2875badef97590d2959dc712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881aa0a4-5c21-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639405962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639405962, "uuid": "5d88ef72-6d33-44c5-a796-eec90cfb34f0", "comment": "Malware payload (AgentTesla)", "value": "415c3eb97929bd54c5d3252c8ebbb696", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639405962, "uuid": "e0929cba-52a8-4ef0-81ab-a896e7788f84", "comment": "Malware payload (AgentTesla)", "value": "2cede211bafc75e49dcfee66a1d1802d728dc56dc7d390b933e0210b75ed40af", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639405962, "uuid": "94c0a651-4924-49e5-bce8-e2bd11b31738", "comment": "Malware payload (AgentTesla)", "value": "465bf707823d14f8524a831abc8e5f2506b90697", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639405962, "uuid": "329e8a66-ee98-42a2-a85b-1509e7676c86", "comment": "Malware payload (AgentTesla)", "value": "43b802a6518d1423022a168ca2a9fa09f3d714dbb883545d881fa86ba671f03d0dd0735379ce42b50fab7830d25552b4", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639405962, "uuid": "ac5c3bc2-06af-4dde-b463-e6569ba59818", "value": "T147542307C44D4230D8D6B0E37FC8ED899A367B19B3FA611DC9A8AE7D0C381967A164D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639405962, "uuid": "6d28c5b8-58f5-480e-8d48-12429cf6f218", "value": "6144:Yj8OktDSmq43HL5hybf7WCkiCoeE7m7eMQDFhri1mCfFnx:BOk5SB4b5MmCC4mmplWnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639405962, "uuid": "cdf07440-89c0-4015-9103-a37b41a9a4f0", "value": 287344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639405962, "uuid": "1ca7286b-4d79-488f-b6db-a6873a390de9", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639405962, "uuid": "b4323aa8-d1a7-449b-b317-66566dce55d4", "value": "Payment Slip.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27519ded-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639407947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407947, "uuid": "1e403b70-710a-4863-a22d-a404c472dd30", "comment": "Malware payload (AgentTesla)", "value": "78983739b0cffc70a07f957c91563e3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407947, "uuid": "283513cd-fcdf-448d-8ac6-911dfa746bd4", "comment": "Malware payload (AgentTesla)", "value": "2d0993cfe3ef5139c233c4dfcacb287a9b9c40f0c3df4cb2464fcdcba39828be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407947, "uuid": "a44d73f3-8ec9-4ba7-a014-bbab1b58f049", "comment": "Malware payload (AgentTesla)", "value": "a9a016185ef204c3df3f5b9797418348fc5d7ea6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407947, "uuid": "486f206b-03d0-427c-8825-0120aee0f4a0", "comment": "Malware payload (AgentTesla)", "value": "2bc3b26418e882aa9106b45725011e5c6eea74699f531600efa2a31c9550c9cabe7a29e0706229c568be3c176f64cf70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407947, "uuid": "e5cb9bd3-62f7-45a8-80f6-4c65e6c840d3", "value": "T1B881E8693B0C0D43C31AC5F2CA66FD460287F273A2CF2591B34EF9B00F1B6247669985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407947, "uuid": "b891505d-8489-4fca-bb9a-40f30240cc04", "value": "96:lNGJfw/4F8GAdEw4Eo4XHMXBvcuwKPOiYOdtQ:zG1w28rs03MXoiDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407947, "uuid": "4eaa44b3-a6be-414a-a6bb-5cdde4ad6b3b", "value": 3891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407947, "uuid": "03bdf539-4127-48f7-968a-2f0ef7977cbf", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407947, "uuid": "128ebda3-a6df-4530-9bce-7387003bf944", "value": "SOLICITUD DE COTIZACI\u00d3N URGENTE PRINCIPAL ... RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6b14cb-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425970, "uuid": "bccfd774-f9ec-4170-b273-6b502bb51fb9", "comment": "Malware payload (RedLineStealer)", "value": "1ceb7f2517bff8b1486c6a0ad49f513f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425970, "uuid": "7fa17d6e-9353-4b06-ab9d-1702caa08318", "comment": "Malware payload (RedLineStealer)", "value": "2e58403738fae260ed7397056e2631b5769310b0cef718d52817eb54ff105777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425970, "uuid": "df60b373-3806-4a14-af91-21ea5e9175f2", "comment": "Malware payload (RedLineStealer)", "value": "4f69ad17cb05fb2ceb831d41e097988a2abacba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425970, "uuid": "95c11844-3c2a-40d9-9e79-1a942e539917", "comment": "Malware payload (RedLineStealer)", "value": "16f9e6e98101574d1e6dd596af10109ab8b19e248df4c8d1de7b82c498164b8b000e4f53edc8a5b2fb7156c9f3e223a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425970, "uuid": "66fad4b5-a3b5-40a4-991b-27f3fe6b0b25", "value": "T1B964E0C175E8C4B1C6E279308861C6D45EBFF852D970818B77782BAE6F723D09635316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425970, "uuid": "591626ed-d8f9-42b5-b3a0-a4267abe7785", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425970, "uuid": "39954fcd-1a86-445f-890b-24fda545b51b", "value": "6144:rh7armI3w9UCLKqvnKI6e7diAx8HvmbZXXfGpMMUCb7ITsqs1:rRM3w9tBP17/WHObB+207", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425970, "uuid": "2dddcc90-ff53-4f61-8a06-ea4bc9a9db49", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425970, "uuid": "366608f0-bcc1-418b-90fa-965d8ba53bff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425970, "uuid": "daa839ba-1ad4-42f0-bea6-c68c73c0a197", "value": "1ceb7f2517bff8b1486c6a0ad49f513f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a57da03-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426045, "uuid": "87b318e0-cf81-4d81-9d9e-758fc25022fc", "comment": "Malware payload (RedLineStealer)", "value": "ddc03139df3e168b452624203aa25df1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426045, "uuid": "fcbe29fb-4b4b-4468-836b-ae81e90fc929", "comment": "Malware payload (RedLineStealer)", "value": "2ff2bbd3044c369f43d5659418ea3c8ab8702f1438d1fd866efd56354d22bcf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426045, "uuid": "75d33da4-64b8-48fb-8791-55f050257521", "comment": "Malware payload (RedLineStealer)", "value": "90035f0ec57c059adca4869793e448a52f484d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426045, "uuid": "d15e972d-5932-45e9-8438-ca5ca92f8268", "comment": "Malware payload (RedLineStealer)", "value": "7677d43bfda9ba2e41e53261fcaa7a4565eae0a1e43b812bea890e15843348777214221c4a3f6af08bb241bfe4e8f5fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426045, "uuid": "4c266359-61e3-4495-b6f3-4f4eb240ca3d", "value": "T17164E0D176A0C8BEC5A23A318431CBD05EFAB951D930604B77742B9E6F722C06639FD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426045, "uuid": "2757ef0e-abc1-4bf8-88b7-e15a72864f3a", "value": "16daddd238d0a16baac8dce0ea4061f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426045, "uuid": "f8eddb60-d57d-43aa-bf54-36a60777a77e", "value": "6144:n6RsPZVf7Ny8xmggCwf1OMEwRvH5pNI1b7ITsqihKZ:6WxR7Njlxwf1HFFTN07bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426045, "uuid": "ca92d992-d257-439a-88be-c68ba6024e30", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426045, "uuid": "edfad2dd-d630-4fcd-896f-71c746774c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426045, "uuid": "98b11c33-5d4a-4635-bad9-ce4a04efc283", "value": "ddc03139df3e168b452624203aa25df1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdf0069-5c3d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Ousaban)", "timestamp": 1639418184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418184, "uuid": "f23a4ef8-7fdb-42b9-a684-f82713bb5cc7", "comment": "Malware payload (Ousaban)", "value": "575ad6dc2238a6844b472fa35fc02c47", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418184, "uuid": "29decc96-d71b-4f52-93c0-ff2ce1965b0a", "comment": "Malware payload (Ousaban)", "value": "2ff98044903165ae7fa32c36e9683976703f4e461c68640d9f3255fd58be90c7", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418184, "uuid": "2567ca58-784e-481a-85f7-7034c0cba924", "comment": "Malware payload (Ousaban)", "value": "12a930888cf7a72dde60a9a7e6ef3bf9860183fd", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418184, "uuid": "c1510efb-67f4-42b3-b626-ad0dd1fbd7f7", "comment": "Malware payload (Ousaban)", "value": "8082e4169bb113b9c54d3809b2e5ab4f3e43322e1ea021a145bd4a9e2605133711ac0fc6a9a477d9b9447ea09772490a", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418184, "uuid": "181b4549-178b-4577-99aa-bf4d7e84499e", "value": "T1BCD5230672C61F77D4AE0670A24BC326D676DCB05162891B939F0A0E2DF39B4A7B33D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418184, "uuid": "937dde58-9876-4981-909f-4707bb13e320", "value": "49152:FS0b1Y5A2mFIjKFiguez7buCnIrgmzu6kKWtMpL58ALkdyEKxSnzKxf5j2FVZzCp:Pb1Y5A5AKFpu27Cbrg+kKWYF8/yEQSYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639418184, "uuid": "fac4d299-e89b-4064-919b-03b15030315e", "value": 2862592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639418184, "uuid": "21a08281-c0a0-4537-9fac-48897a6d0e6d", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418184, "uuid": "958cc135-c25d-43ea-9ddc-548532e9242b", "value": "575ad6dc2238a6844b472fa35fc02c47.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a5b963-5c57-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639429143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429143, "uuid": "aaba265f-14f7-4a60-a668-af32b83b40cf", "comment": "Malware payload", "value": "78a77e2c2962d2ab26c5653dee1a91dd", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429143, "uuid": "4f501f58-7903-41f0-bb79-74865c833462", "comment": "Malware payload", "value": "308eabb2b73d7a3ec93f71e87dc45d69545d4c321dcbca4b729a5ff97aec1ebd", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429143, "uuid": "19ff3a31-5278-4376-9509-5f2d466259ea", "comment": "Malware payload", "value": "7695eb76d461c7e1da770b95bd0da5d6bf8a6892", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429143, "uuid": "89932ae5-1629-491e-a37b-3fc3ef2c1e7a", "comment": "Malware payload", "value": "382003d268fd0edbc697d487db00a0d663c319d09e89ea1a27e042e1476c240a1cbeb258f1b218c734509fc349db230e", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429143, "uuid": "7b218ecc-e357-4982-990b-7d18dc3df3fc", "value": "T16134C024B3E410E4E175623488628E6AE93638612725DFDF03794772EF366E06D7AF70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429143, "uuid": "2b6cad38-f6b7-461c-a9c6-38ae2750cb87", "value": "63a1e25ccb63258cc76f156e284f8cf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429143, "uuid": "851242a9-a0c6-482e-b65d-b99c5ab02640", "value": "6144:vESiM+ybBZ2Q7t+iPrV5OPBsz7zYMNHBA/4cmjY6jZ:vErMND2Q7LPuZjM46jlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639429143, "uuid": "b642bf15-dab5-4ba8-8fe0-d3da4b90e132", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639429143, "uuid": "cfe656b3-b93c-4a92-b1ed-02604ab92aa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429143, "uuid": "1924cdb8-d96c-4bdd-90fd-c63b0355b7e1", "value": "Invoice_#fdp..pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521a0b87-5c46-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639421763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421763, "uuid": "16f913b1-218e-4b64-b051-7469a1f231f8", "comment": "Malware payload (AgentTesla)", "value": "f0a016899796f25abac41a8689389af1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421763, "uuid": "9fa2c05b-95ed-45ea-ad45-873942c96334", "comment": "Malware payload (AgentTesla)", "value": "30922ed3f73318102010516ccdc36370ed8b85468b41ee6ee382d7bc8022303e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421763, "uuid": "9d9e09a9-fe96-46c9-a303-1bbb421505c2", "comment": "Malware payload (AgentTesla)", "value": "9d5221d35195fb50d168cbf4cf9ba3db64253ed9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421763, "uuid": "45ed6c51-0ba8-45cf-bcbc-6c4429ae83db", "comment": "Malware payload (AgentTesla)", "value": "1eeb8ad2954ad757d6e9029e1777e9fa7ce5e7ee312eec618d85c67c96b45a2cb4d13e8aac23634e93596b32d4c16236", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421763, "uuid": "25c472b7-beec-4ed5-9056-e3ebd4333b56", "value": "T1D6819465661C5897DD52C5B2E4B4FF8220EBF36A88CF5281736DFDF00B2B3152464A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421763, "uuid": "a9652169-bd88-4ba0-aa6e-2fb649cc1d49", "value": "96:T8tltsWziHXhZLx/Q80BFyQ7BY6M9tBGmCLIXOE:T8ZqzhWFyQFYNtCLyOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639421763, "uuid": "58bcc4ce-b88c-4abd-87a5-65833ffc6382", "value": 4021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639421763, "uuid": "7d71456b-a917-4716-ae31-64f9fcd129f9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421763, "uuid": "1f776adf-9228-44f4-8701-c02cafb54212", "value": "PDT_5637672372727637.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee9083c-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425999, "uuid": "102cd9fa-3fdf-406c-a2b8-958c1a660463", "comment": "Malware payload (RedLineStealer)", "value": "6490b05c479134f8316cd701c828484f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425999, "uuid": "e768ce0e-c36d-477e-bc93-76802ce1f362", "comment": "Malware payload (RedLineStealer)", "value": "30df420d71243f4aed9d90a7b11da6eab967482e9322aff537ee895acd0a744f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425999, "uuid": "d4276eb4-ffbb-494f-b4ea-83b2f245a4ed", "comment": "Malware payload (RedLineStealer)", "value": "f9b99560d1c418930a05f22cee0b91d3b917f74a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425999, "uuid": "22fe5fab-ccb1-4d33-99c5-a5b9719e62f3", "comment": "Malware payload (RedLineStealer)", "value": "b24c92cdd1a6f4b627b23d1d3eabb0938858254753f1c1fdb4d6d2cddc3a36864d1fbb55c395045e6536daa667480b3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425999, "uuid": "4d2ff156-9a0c-4c41-bdda-31e49b105a7e", "value": "T1EA64E0C1FAA0C831C1A3393198F18BD45E7FB951D924808B76782A9F6FB26D1463275F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425999, "uuid": "0103fcd6-4917-417f-ab63-d0e45e771cc7", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425999, "uuid": "94e003ec-bc63-4d42-9f8b-366458c176cb", "value": "6144:9h7s4r6ojfZwTpk8VDimUuWF9z1pMRjDdtyFb7ITsqMr4:9Rs4r6mKtkebUT+O7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425999, "uuid": "bd144e9c-eaf5-472b-afc3-aeef08102a5c", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425999, "uuid": "89c052d0-16fb-444a-949d-ae6d7874d85f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425999, "uuid": "27066f63-e13b-44d2-bacd-c76556de00f1", "value": "6490b05c479134f8316cd701c828484f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a20707-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425975, "uuid": "f00beac6-09ee-4373-a067-ee8c7d9ee311", "comment": "Malware payload (RedLineStealer)", "value": "1399fa710e5d029945cedad304632686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425975, "uuid": "6c2647bc-7d35-468f-85ac-4243768636f1", "comment": "Malware payload (RedLineStealer)", "value": "30f44014a3c2f79fbfe04f01f2e7c5528adf2e90de731ab14ce24792ce39984b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425975, "uuid": "ca651fec-4063-4824-8bc0-69c356011073", "comment": "Malware payload (RedLineStealer)", "value": "df29e3afb32d5e99e6ba18d3eb8513503c6f2238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425975, "uuid": "9ed5c533-11ea-4d34-ade7-1af4f10dbcef", "comment": "Malware payload (RedLineStealer)", "value": "de61c24b5ae0cdd3255c34b2e9d47dda6d354be279f54f3d44cb25aa7161d94db6de932fbde99ee8f3a3e8b28961c278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425975, "uuid": "5f6b2a32-78f2-4505-906d-097572eb008f", "value": "T16164E0D135A0C871C1E2393C8861C7A85E3FBA21E961518B77B87B5F7F722C18A29753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425975, "uuid": "17f40831-d2c8-47ed-9d7b-fa14542a0862", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425975, "uuid": "34769123-db07-4f85-b925-efecc99f70fa", "value": "6144:fh7ryiTswc+YIonhbjOGhpA2gaJgMqHb7ITsqyvo5n:fRrysswcokhbbhLgr7Rvo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425975, "uuid": "1a9d5cc8-4a01-4757-9e1e-b9610f74c14c", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425975, "uuid": "89fddb8b-bf71-49e4-ae03-f6050531a3f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425975, "uuid": "5fc90bff-ba3e-432a-a486-a066077cf509", "value": "1399fa710e5d029945cedad304632686.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf78e07-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639426293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426293, "uuid": "2b57c082-c2cc-4755-827c-cee7424ad2c0", "comment": "Malware payload", "value": "5712d309e210b6faf086961e09d4b4e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426293, "uuid": "ff80f952-a9d6-44fb-b03d-95bd7864e880", "comment": "Malware payload", "value": "3146863bd493b87c1cbc3faccbd7f2519a7b3b8802c388b2c6c8c544837ca361", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426293, "uuid": "5e3c4c89-4595-4ed8-b85a-357ed60dd0a4", "comment": "Malware payload", "value": "7c8779e178cd6e993eebcc1388a8bb35ca8165d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426293, "uuid": "e8647a9b-0318-4271-8113-5d9ecd048fbc", "comment": "Malware payload", "value": "56133e3553424173b6a01c207badff7c81c28676df0a6017524b8807678dbaaabc04223013567179d3d7448bdd5ac86f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426293, "uuid": "fba04079-19b6-4d30-aa25-445f8ddfda0d", "value": "T1E014CF9BF558D5C0E81A05F96837CDA0237BBD75483C4E197594333A2A722B36623F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426293, "uuid": "1c02e383-3487-451d-b420-f1bb14193159", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426293, "uuid": "1bf1bf9e-6927-40bd-8741-3c17931cd593", "value": "3072:/jbhEgRNvVB+mO1emLHhA46Xvx2CxwbD30aq2P5JcpFKn8G2e2FBgMMJ:/jbBRtVQzB6fx2CxwXL/X8VFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426293, "uuid": "adae4281-a911-4bc0-ad50-5db099ce06e8", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426293, "uuid": "9ea733a7-55b0-41dc-90fd-d5cf3899fb7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426293, "uuid": "a59ee5c5-bdcd-4e83-a4bd-032c613f416e", "value": "5712d309e210b6faf086961e09d4b4e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0185090e-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386409, "uuid": "73d44c0d-ce55-44cc-b766-dd8db9f8cf08", "comment": "Malware payload (Mirai)", "value": "1651da9c54beca8363e6b667045d93ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386409, "uuid": "54d4ca67-2dc4-4cdb-a61b-06b0bf244d59", "comment": "Malware payload (Mirai)", "value": "31754e441c7a41c307fb6d51f4d33fa1c5a1e8bac9c53789ce1dcc986558b057", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386409, "uuid": "8a79d011-dd0f-4409-9c27-c8e363db9e59", "comment": "Malware payload (Mirai)", "value": "22e25303eb1f682e17f7e5611db8da4d9f2f8e48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386409, "uuid": "9e3eb79a-9c9d-4a3b-a403-4a704eb7f133", "comment": "Malware payload (Mirai)", "value": "0d17d82240e0f096366c36897cabbbed5f6b5b3f3647354cacbdedcae61a0ede600dda515a9c459d15d1f05f9f2b833a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386409, "uuid": "5c3bd299-c42e-4128-bb3a-6eda3b92dc2a", "value": "T191833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386409, "uuid": "2c7d2e5b-697f-4ef0-b430-b00112e6e60a", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCQdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JfBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386409, "uuid": "22fb9511-5933-4f89-9f6d-c4195eefa8e3", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386409, "uuid": "f6c66615-8b23-494b-94b6-fd37c99aa0dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386409, "uuid": "ad3cca31-66fa-48a2-88bd-3eade60d8c24", "value": "1651da9c54beca8363e6b667045d93ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad857d2-5c68-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639436408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436408, "uuid": "e5981995-e646-4d64-b942-72369f68fc4f", "comment": "Malware payload (Mirai)", "value": "9c37878306facbc18293710b9321b26a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436408, "uuid": "2daecf0e-26f3-431a-a538-780896550749", "comment": "Malware payload (Mirai)", "value": "31c9747719ad683c359124fbe6a74302f6a395959c2f20bd715a807f5a5f21e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436408, "uuid": "3b16ccf4-04b2-4a41-9ab8-6c4dfa88f59b", "comment": "Malware payload (Mirai)", "value": "2d83252a2321b480412d8671341837877eb4b921", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436408, "uuid": "62b091b1-7c3f-46c6-899b-49f36547902a", "comment": "Malware payload (Mirai)", "value": "623987c7bd511d2d1d0dd38f24cabdfdc06a9baab840196025c4728c84fc216cff5a867049930e9e7328e8421fad7b09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436408, "uuid": "26ddab5b-4c1a-41eb-b967-42b7a0ed2935", "value": "T144D34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436408, "uuid": "a95c0a8f-9df3-4745-a301-32686505a3dd", "value": "3072:BxioDMQI5nr1aO4nt3qZg2IWu6b4MX7LkDM/94PmPw/t93:DioDtI5rwnt3qZgPWjHX74DM/9YmPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639436408, "uuid": "e3c99485-5838-4f8b-8e35-a72b4d3fc6b1", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639436408, "uuid": "3c734381-dc83-4065-b8dc-1196403675ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436408, "uuid": "745a2d64-3711-4832-834c-c23c3df8d38f", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f068273-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408068, "uuid": "9f156f63-0a35-43b1-9e5c-319e2a8255f8", "comment": "Malware payload (AgentTesla)", "value": "99cae3d2f9cc122437e94796f4fba799", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408068, "uuid": "abec447b-38d2-47d0-a266-efd66820d8ca", "comment": "Malware payload (AgentTesla)", "value": "321b03d3c4768e0748ce8995922b5c1ef0b8b7be39a2c2bd94402f39212e19f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408068, "uuid": "a257b731-a407-4b6a-b719-563bc40c1c29", "comment": "Malware payload (AgentTesla)", "value": "c83d8e3329854f14980b49f916e26a1e85566468", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408068, "uuid": "a62f8dd0-2313-4099-b512-d21b1844bbcc", "comment": "Malware payload (AgentTesla)", "value": "02451ea81075ff9129dacb69c2c83ff8d64b355d9b1ca091e1973979403c69ddd507089dcb4e10b699c7684c4a84bf82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408068, "uuid": "3ec3aeaf-05c6-4b4d-8319-840a5094a360", "value": "T14171F8A2A7144D07D9D781F7C049BE944CD4F13192C66A80336CDDE20BA2271BB7B097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408068, "uuid": "cad2c086-2463-4f7f-a428-f26622a67b1e", "value": "48:Lc3V6XzC11bYZX+EVBeSPFlG5cqoTvyFfQN97e5Uj7i3uS/NoiCSpVbKwOpGK7bD:LSgzgYBrRcLIvXSVoSpVbQGsuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408068, "uuid": "a9a7b8cd-1b22-4302-92c8-efd725ada8ec", "value": 3494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408068, "uuid": "9dd859c5-fb7e-4808-9925-c04f12959f82", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408068, "uuid": "56f67dd6-c9dc-4436-9a53-70382e0686ff", "value": "payment113344.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b50f63-5c61-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433453, "uuid": "60f75bb7-0ba7-40bf-8070-221d94690844", "comment": "Malware payload", "value": "c11a0075a300e1a25016b3b9a73567d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433453, "uuid": "4efe136b-9533-4d66-8f61-953f4ff85723", "comment": "Malware payload", "value": "328d5ee09cc9aa27a16d00bbc885e15e398be657f93e32bb5646bbda8d5d4ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433453, "uuid": "66b0d695-c9f9-4695-a72d-b127ecfc82c9", "comment": "Malware payload", "value": "c5d74a4f6f7c7a070f0e9c0cd6f229f1a8e8e270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433453, "uuid": "da1bb3f7-e937-4af2-a344-038cfda9f799", "comment": "Malware payload", "value": "45c3d95386f0a108240bbe671c21937bc56ca2f09ad07c546266c06cf9f0fe72a681a4d9a5cd63dc184473838c5bf67a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433453, "uuid": "643ff3d0-216f-4dcc-b664-f9a51eb80b5f", "value": "T14755235B73BB9E69E47843FD52F16F448365B1860921CB080CE6B9D2A9F3BD081163DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433453, "uuid": "561fc9d9-c1cc-48e9-9a89-3d9eec36f76c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433453, "uuid": "a67d8aeb-b8a8-4070-8df1-380e6211eb15", "value": "24576:IpnHK8Mt9liN4i7abrKnzOr1NSgRfCiy9mh19GrDSnkY7Oc4ux7jBu1AzI:8HK8Mt7iNWTr1NSGCiyAhLK4kYacR2Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433453, "uuid": "d0bfa044-4ed9-4119-96c2-fba2f68cd220", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433453, "uuid": "8c5a8e67-b9c3-45eb-ae6d-11075438a47e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433453, "uuid": "1f4dc7b9-40a2-4e9c-ac6e-7d170fe2e8e5", "value": "Shipping Documents_scanned_6210021311000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbefb2e-5c62-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639434049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639434049, "uuid": "eb5b5552-1b70-45f3-b1ab-91e69e203c64", "comment": "Malware payload", "value": "04459ef99e8cca019d3676bd52707e3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639434049, "uuid": "21d858b6-6360-4841-bf04-f2705a9f8f03", "comment": "Malware payload", "value": "32f8a7972ce0593b753c37f18cce172e3ca2fdca15a0ea6ae6f392fd388a2e20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639434049, "uuid": "fa953f31-1394-4fda-a3b4-ccfdf5524af9", "comment": "Malware payload", "value": "0cac20c446ba5a0f79290c8b88b762774f046084", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639434049, "uuid": "4fedd929-bab6-475a-92e6-f518b18a1c33", "comment": "Malware payload", "value": "bccb55f42443985c08bbcfd21ab267deed7edfa96cb86c5eca4693977099226783ec0e53a3117ad4583fd27728264c1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639434049, "uuid": "ffcaaa01-af0a-4a78-ac66-0bf071aed1bf", "value": "T15EB4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639434049, "uuid": "85e2d673-d6c3-450e-bb58-d6eafc66b12a", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639434049, "uuid": "3a056a66-6541-468c-889c-2d120924b3e1", "value": "6144:XKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:X9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639434049, "uuid": "2d734265-28f7-42ff-94e6-5a855645e8d6", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639434049, "uuid": "caec1ac2-08f9-4a8c-80cb-25c925ef35e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639434049, "uuid": "3633002b-d857-482d-a47c-a04fafdfdee1", "value": "04459ef99e8cca019d3676bd52707e3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fdb4d0-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639408623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408623, "uuid": "3cbccd08-4128-404c-a1d1-a0ccaf516c44", "comment": "Malware payload (STRRAT)", "value": "4d50a1df28610ffdb925d4a5b7bc6c0a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408623, "uuid": "11355fd5-7520-418a-bf47-f2056efe114e", "comment": "Malware payload (STRRAT)", "value": "3380d42b418582b6f23cfd749f3f0851d9bffc66b51b338885f8aa7559479054", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408623, "uuid": "ae48ea27-5b59-42e0-8610-d6bf50d5dad3", "comment": "Malware payload (STRRAT)", "value": "a5ade474fd1f83cf3ab959668e8736aff6922625", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408623, "uuid": "7c41e3ac-0f7b-4a33-b97d-72af2b4fbc38", "comment": "Malware payload (STRRAT)", "value": "5ad0367ef29559bf585df24b1402a50bc7d105821af8e0d11f93d04267c3d4699e672e8c13c75d02a5cde51ec1ef9c1b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408623, "uuid": "255ce61a-0efc-4e32-98e1-da292b35a1a3", "value": "T17CA3C01B3DBAC1B9E26F847290448233A61D5E98D049512F2EFD14872DB0C6D5B2BECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408623, "uuid": "43dba82a-60c3-4d4f-a6d8-efca1be3a96e", "value": "1536:/HJEI+7SdbQU8YkS3A0J4CWYyX5vA41x2J5nukEl9NKSsDnTgVZKXDJ:/HSMd/PA0OsyX5vt1AJ5uzPQlDngy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408623, "uuid": "3dfc6d95-5998-469c-8686-9c145da06129", "value": 97721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408623, "uuid": "c99f3359-eacc-4770-a45c-d22f9686528b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408623, "uuid": "ad56f49b-daa9-411a-8dff-ad1a5b53fefb", "value": "SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d29590-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425928, "uuid": "1269a9dd-e6ed-43f3-b397-2c10af46ec61", "comment": "Malware payload (RedLineStealer)", "value": "30da49214220bffdc1cc1a63845f1011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425928, "uuid": "4068f66e-30c8-4868-a751-e433c938bd5a", "comment": "Malware payload (RedLineStealer)", "value": "34ccae63b50259b758a5b68f579077e5152d9568cd1f968326f44aa8084585f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425928, "uuid": "ec0110f5-92df-4017-aa65-adeb56881de3", "comment": "Malware payload (RedLineStealer)", "value": "5f2756e24f9c73a2b716ba1e4d9cb53fa330738d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425928, "uuid": "c503fae9-a534-4bfd-9751-4aadd4bc17fd", "comment": "Malware payload (RedLineStealer)", "value": "b3fcab9a3ded86c1e50d8c670393148ddc35445ab86d9b62523e2262f06ccb5fbc7da05cf1fd4dcc57e9c4ea930be606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425928, "uuid": "a6b17c82-0522-4733-a0a9-8cb3cade4087", "value": "T1FB4633123B919871D6A21D318479A9103A3D6E212BD08F5FA3D81AADD971CC1F638F7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425928, "uuid": "a525d5b4-28a3-4af0-a358-47ded0d427c4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425928, "uuid": "a211f123-838d-4fba-8805-729f42188f52", "value": "98304:Pbc3XW+3k+725S+Dp9rTdiYuZWZ/xK7yLobM3Lmh5xy9bAv5IEyGwmV1h9km:PUXWycTdOZw/xtp3Sh5cbAyEzzV1km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425928, "uuid": "5df6b441-2932-4f83-b662-d7fb748748c1", "value": 5579506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425928, "uuid": "e88a5478-83d6-40b1-ba49-e0c99bc03377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425928, "uuid": "51fc1362-3f06-45bf-900c-4ddd0d598185", "value": "34CCAE63B50259B758A5B68F579077E5152D9568CD1F9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1484a50-5be0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639378141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378141, "uuid": "004dd679-4f0d-462a-92ad-75ce778f6590", "comment": "Malware payload (AgentTesla)", "value": "fba570d0294f700f966a0fc228183866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378141, "uuid": "4a63a711-7753-4365-be34-3961ddee989e", "comment": "Malware payload (AgentTesla)", "value": "35e7c4725060a762fd2b0c8bdbde467160a4962223ca40c0b07a92fd3ed52bad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378141, "uuid": "65578853-847c-4899-8055-96b8918f6ee2", "comment": "Malware payload (AgentTesla)", "value": "72b3fc63c0339bb3495f5d28435250986ce310c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378141, "uuid": "3c4e8ffa-6419-4360-b776-c96991fc83fe", "comment": "Malware payload (AgentTesla)", "value": "d924aa426bd762fd1a25db36e8b49f6add353af76481d38d84d8229c71a4c867908ea7856208b89c9f0bfff7971f95a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378141, "uuid": "d0309efa-d3d5-46a3-979a-cd45369765ae", "value": "T1B255225873A0AE54E67F07799072C1708371BE01B826C32EA6D47CAF3E737A09A15797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378141, "uuid": "220c7ca1-e0ca-44a8-b127-eb347a9cc691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378141, "uuid": "239cc229-46e9-4747-916a-382071bb37a8", "value": "24576:yaU8H2lvGxu6XgAt33Eo4XagvjwbcjaMNltOnKOA1EXOHtEga:yaU8HysrnEPqgvjwyVk7Oyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639378141, "uuid": "31a66a23-1e05-4a6d-878c-ed5e75d9c846", "value": 1387008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639378141, "uuid": "273994a6-0de1-45c2-872e-dc59eb763fcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378141, "uuid": "8f01dc9c-bf60-41f1-a4c1-4548ed105fae", "value": "Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77e37e5-5c17-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639401801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401801, "uuid": "1b6fd642-97de-48fe-ac84-67c1fb863037", "comment": "Malware payload (Loki)", "value": "9f2729a155ade049c8b2bdba864d30b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401801, "uuid": "f65abaf6-8d33-4b53-894f-d2d18451b57e", "comment": "Malware payload (Loki)", "value": "36417779039f2662db3b8fd4b0053d4b3e99cb4c56415d33f42dc97f2fed2cf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401801, "uuid": "ccd105d2-60cc-4244-9e02-7c4435495900", "comment": "Malware payload (Loki)", "value": "ac72f694fd40ed7b65760e7ecf2b9a767a183e69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401801, "uuid": "7b1c1338-b17b-4708-b336-f37c2372edb9", "comment": "Malware payload (Loki)", "value": "352217d5ca2940cd718b24fe1cc92fbde2e446a126291cf9a1650becc78e267aa0bbf0ccf84bec41448f473ef0608ebe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401801, "uuid": "22fcc939-688a-483b-a43c-8e513f8da988", "value": "T1DB3512063AF4D55BC16D4B71C6FB90608BBDF8073DF3E67A289113AE6A34EC58906346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401801, "uuid": "41e9bb37-060a-41da-81a3-115b78bc48d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401801, "uuid": "6ac42fc2-c92e-494a-9543-b9b57dc4e416", "value": "24576:7IKjy/SYCp3WIrdrm1jDzaWKcRx17F/Vskw4wQdo12YXkaG:7jASvWco1jyED/skwOaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639401801, "uuid": "43e32e0a-c1c4-4515-b810-50a7b1fd34c8", "value": 1153024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639401801, "uuid": "a1b2a583-3a7b-4ac5-9070-f8d4fad09882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401801, "uuid": "1faa382a-7107-4459-b301-7e2975618704", "value": "9f2729a155ade049c8b2bdba864d30b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f41f60-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639407813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407813, "uuid": "2a591ba0-93f5-4f7d-9528-23c7258b3585", "comment": "Malware payload (Gafgyt)", "value": "14666eff8b7b4253d5de9eebac5741f4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407813, "uuid": "e771a653-3878-4dfb-a3c7-0a3cdb9bebf5", "comment": "Malware payload (Gafgyt)", "value": "3662383457f55359b64d7b0b60313df5ba94ce5b50d114da55cf15a7234f3979", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407813, "uuid": "1d2131d9-d63e-4a5d-9cac-5102f7dcd83e", "comment": "Malware payload (Gafgyt)", "value": "60854063c5b053d651a9ab4efc53092b8f571e36", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407813, "uuid": "df27f044-3355-4d15-ad7b-9ea25867a520", "comment": "Malware payload (Gafgyt)", "value": "b88011b5f3290816aaf1b27d596bcb3158819c01fe144b09ee127f52e255904516993b218710794f5dac5a39d3da5c17", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407813, "uuid": "416c6974-5040-4279-a558-ecf41fdaeb8c", "value": "T12DA33A33A753D6BAC09322F417DB9675A823B47C0B32322B33D86DE56B05DE91E5A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407813, "uuid": "abce25b9-8f75-4854-812a-6eab2c2fe55f", "value": "3072:2K5ejA4jB4h89HOPQzM9FqVyy9W9vmrYuOHy+ZNzX:sHjBzuPQQgk9vmrYuOHy+ZNzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407813, "uuid": "c6d4830c-bc26-495e-a036-370c0a8ffe71", "value": 99332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407813, "uuid": "b7e98e14-fa25-4e8b-a682-73f1cbcc5a4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407813, "uuid": "54b7d10e-052b-4668-8296-fd591d05f7ce", "value": "14666eff8b7b4253d5de9eebac5741f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f284b2f8-5c16-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639401416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401416, "uuid": "32ba2c10-91bc-4b62-9d77-c69d9043a0ae", "comment": "Malware payload (Loki)", "value": "0a8e0c874153b68509eae8890f9b7a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401416, "uuid": "a3c82990-4efc-4d80-bd8f-aebc479126c8", "comment": "Malware payload (Loki)", "value": "36f9885006e346bf697e3580c73abb1611f2efd0aec6e9868b3b3341b67f574b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401416, "uuid": "b20f5bc3-656c-4e3f-8570-3e0fdd89709a", "comment": "Malware payload (Loki)", "value": "02ab645e524b76f2153834b03a33118ac26d7ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401416, "uuid": "ad11c85f-ffc0-48bc-8341-04c3e525e02c", "comment": "Malware payload (Loki)", "value": "b61ddcc0cf9e613ff98634a3932f0cc2240ea242e679c0bbccfc04fd9b69f7897f51b0e42c9dc4d315aa704237114490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401416, "uuid": "717c92c1-1bd8-4c1b-93d9-49e01fa23269", "value": "T18A4523027EA88353C6754FF811B47D4A0FB26B26B626CB6C0D9461EB3B21F514B6079F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401416, "uuid": "23939577-3fd9-41eb-93f2-8bd767fde850", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401416, "uuid": "b0c3cef3-f07a-4180-b190-48754b690c59", "value": "24576:Yn1S/7+cuSuwJfY6LSHaOOh0ARdx1erGKAo6bqdqPZBdWR4WAuSEGG:XKcDg626FWAryrGDLqdwZBsFrSEGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639401416, "uuid": "3422a490-82cd-44b3-b0bd-443b4ebcc98c", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639401416, "uuid": "05a4a001-e195-48cb-b436-4ef2333a8712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401416, "uuid": "a6b17729-9518-4c3d-bcc2-abc540e60375", "value": "Go7iruDE7vTzcYE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff533ff5-5bfb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639389842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389842, "uuid": "a111fa7d-6c46-4a4c-9c06-409dd0edcbe6", "comment": "Malware payload (Formbook)", "value": "61fb2b90538f47f959b29db2177d32e7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389842, "uuid": "fba517a2-e217-4494-83da-e6739db56a4c", "comment": "Malware payload (Formbook)", "value": "373154447fa9fb2c76ee5a247c76393802b1e33b4d23cef7b8b6480b89ca3167", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389842, "uuid": "47d5439f-41ee-484f-9a1a-9cf86d2aa814", "comment": "Malware payload (Formbook)", "value": "59203f8a29970306c079576414cc6ae5b3263e2e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389842, "uuid": "81854fd4-a5ca-40d8-acd2-ad293e1a1aa1", "comment": "Malware payload (Formbook)", "value": "ec4b8aeaa3f82d54acd2f8901b62b51bea6ad2684eeb76222c4f9d80536521c44450a7647a776b4ad9d20f8ad7dd7ef3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389842, "uuid": "9491a811-6a9b-4c53-8d49-6f93fa4b80f7", "value": "T1FF45334264FF672893D743AB1FFCEFE527BE028737E05A8446568C26205E62517ADF20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389842, "uuid": "6766a549-cd69-4d9a-bc1b-a339d1e9b62b", "value": "24576:3FwR/MyIsP/yN1AIvZodDDUYVbAQp5FkRFURWaYSxE:1w7pnyN1AIBEd1rs2xE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639389842, "uuid": "6fc6051b-c132-422b-afbe-2137a55402f0", "value": 1210499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639389842, "uuid": "70f14a4b-ccaf-46f9-89dd-d76e395e5580", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389842, "uuid": "b56f3daa-a63e-4ebd-857a-c3fa694fcdbe", "value": "Statement of Account-Invoices Overdue Payment.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24297619-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425981, "uuid": "34334670-d91d-4461-8dcb-2a2cded817ed", "comment": "Malware payload (RedLineStealer)", "value": "36a9f38add172e55de585069098334c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425981, "uuid": "de964d8d-b124-4ba5-b79e-335ee2955c3b", "comment": "Malware payload (RedLineStealer)", "value": "374a09266b730158dd443b8cde234854e374628c03b1622193e7039d8abe46e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425981, "uuid": "1f9b1709-d17e-457d-b165-7622b998bb0f", "comment": "Malware payload (RedLineStealer)", "value": "fe9ebee7ff06832ceeb6ed8cb1832cafee1f0810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425981, "uuid": "80bb3de6-b27b-4347-8364-61771a8af32d", "comment": "Malware payload (RedLineStealer)", "value": "950e8b020509db0a862f289bb3832246097daf7dcad12fbd8cb1909f2b0f29df5c39756b44d13460336f86ee2be0d8c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425981, "uuid": "ddc28fbe-4b16-43c5-a792-cbf76927d3ed", "value": "T1EC64E0C275A0E831D0A36D309731FBA14E7BB951D620934B3778ABAE6F726C07621752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425981, "uuid": "5500ac33-5109-4e70-88f4-64baf26185a9", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425981, "uuid": "814d95d5-abf9-4a5b-bb2b-461c50d2799d", "value": "6144:1h7JweD7vtoC2xLAIloRzFBq6DOb7ITsqw7cN:1RJRKC21Aq2z+j7Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425981, "uuid": "92aa5bcf-6dbb-4ef8-96af-55d114548a63", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425981, "uuid": "9a29e630-1aaf-4e0a-adf6-d7a7b2d71352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425981, "uuid": "d6df2659-7be1-4869-9a32-5253d9e55c05", "value": "36a9f38add172e55de585069098334c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861c423a-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408536, "uuid": "10bb3bb0-4efa-4cbc-9e78-f0508a0508cc", "comment": "Malware payload (AgentTesla)", "value": "78a1da192a371caad7414d7d7832863f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408536, "uuid": "47cc7e32-599a-410f-a9a0-bc35d8a93af4", "comment": "Malware payload (AgentTesla)", "value": "385bab06d92427dcf9f414ee21a92d2811fb5f884bdd3e6f1fff3f0de5500fcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408536, "uuid": "dd348fdb-473b-48b4-9390-2a3afed80fd3", "comment": "Malware payload (AgentTesla)", "value": "efb992dd68838e6b08703a06d0c96e2f7e2af8f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408536, "uuid": "b011fbe9-974e-40e9-8eb0-6983b68ee568", "comment": "Malware payload (AgentTesla)", "value": "a5d5d26b38d795d41916ba6e47105e80ccf08e3d664779f095cae7cf241a5ee0df7f7e666ac788d924c157abe132e11e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408536, "uuid": "376b4d02-b1b3-42a9-ae62-b461899a8463", "value": "T1D665124933988D52E5AF17B49171C130C336BE14A826C31EAED46CAFFE737A0AA45357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408536, "uuid": "3c3ff8dc-a41d-4813-b6b2-2b84651f5b1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408536, "uuid": "c1f7ab37-cf38-4937-82a3-ed525d948fb5", "value": "24576:j99VqL/vYqmEsXCfVA7A/OYx+fHbjc8Y6zsj69Wnbfw73zi1JXO/KXOHtEga:B9CnYqcXfl8+f7jjYtsWbfw7gGGOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408536, "uuid": "417ab2de-38c4-4470-b7f1-df87a151b77d", "value": 1472000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408536, "uuid": "eecd90e7-703d-4f5a-a688-247179866bad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408536, "uuid": "03a49f7f-878e-4e3d-a8d1-bd5abb76819b", "value": "BL & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901d7d3d-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639408123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408123, "uuid": "998cfe4e-f35c-47e6-af91-800f97a24eec", "comment": "Malware payload (Loki)", "value": "d1c98ea057c680835a90502a44a34c69", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408123, "uuid": "48a8afa1-cee4-4639-83ee-8b305ca2e2fa", "comment": "Malware payload (Loki)", "value": "3881fde84ee52f54e0cecd859c0623beaa728d4d7c3fef1c0dd784b40c9184f7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408123, "uuid": "cd2471ec-57f6-4064-9dd7-9d053d816422", "comment": "Malware payload (Loki)", "value": "d6ba69ac63720accf9672e862cdd174b0f907911", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408123, "uuid": "4b6700b9-4ecb-4f9c-979e-caeaebcd11af", "comment": "Malware payload (Loki)", "value": "ef2242b22e5ef149c49601d200d46ac43446ba3401c63b7b4a37bb38c9c636c17c005f3bf5cdc9f0e6aeea3536f11814", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408123, "uuid": "d5420d16-4de0-4e50-8b0f-e2ca76fc847b", "value": "T1FE8108B9137861A2EEA294E6C472FF6624D2F15AC6CF6944371CF9B00B3E3169E53C10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408123, "uuid": "c7564e60-2ba5-4d98-8b15-a83031b76fd1", "value": "96:Pkmzr9b9RG/pXGwqOiHe+1omAN6r6oI7GeAivj58dG:Mmzr9epWH7hoj7DpdQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408123, "uuid": "b1ac8c4f-86aa-4fa1-ad5c-a0a04e7bb748", "value": 3979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408123, "uuid": "94d15f55-f15e-44a1-aec8-b294a9eb710f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408123, "uuid": "dd5582af-cee0-4836-8dac-b7dd010cb152", "value": "Invoice Confirmation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d591227-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639426050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426050, "uuid": "8a96962b-6b43-487c-a8d9-26602d71d831", "comment": "Malware payload (CoinMiner)", "value": "b1a39ffcffb09c433d76def7702d851a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426050, "uuid": "3c66c901-4bd5-49b3-8049-aa740ab1707a", "comment": "Malware payload (CoinMiner)", "value": "3a3cf64b3e5945a491befc240c35b0d12a4e6c42af37a9d6df6cf457c49c53b1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426050, "uuid": "316ddcfa-4b1b-4333-9e06-3bec6eab12e0", "comment": "Malware payload (CoinMiner)", "value": "c21d22edc7fe7d20802bd80563ed1b343d30ce79", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426050, "uuid": "a2a38990-33a4-4b96-bd77-6e2508c6d5fe", "comment": "Malware payload (CoinMiner)", "value": "65201a84c9fd8d11209ff26765d04d5e1366e12248f54293e9efac12e5016c4cf9e4313336f2547b737b644756fdac97", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426050, "uuid": "aedfb2d6-7252-49ac-b920-c4220b7f191d", "value": "T171F6338F63E624E5C241EA319068B3B3EEE98428263545B84F5634CDEF409EC5FEE535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426050, "uuid": "db86f8aa-6512-459a-91f7-b6755a38e61d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426050, "uuid": "910329a1-1a00-42f6-abc7-c925141e9634", "value": "393216:J43Bcajy5cx9AcNRG4I2JROUza+ahH+dTJe4Z9s:J42aGmlGZ5H+dTLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426050, "uuid": "32f62802-e045-4922-8e03-1b8c964d440a", "value": 15379174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426050, "uuid": "7b6a5e28-77c3-42c7-b31f-e28235e773ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426050, "uuid": "cf40b77a-a094-422c-8755-ea722667e4cf", "value": "b1a39ffcffb09c433d76def7702d851a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf47cfa-5c5f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639432676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432676, "uuid": "0b9fa80a-3c62-4fd7-aa3c-358aa4225243", "comment": "Malware payload", "value": "e141d2e1c89da0b36625a8b610ebc4a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432676, "uuid": "860193c1-aaf6-474b-b102-f6b4a841626e", "comment": "Malware payload", "value": "3aab8f6eca123b1fc8184caa6ad3320ac6c9f58cd73835fac41feef05053abff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432676, "uuid": "ffa4508a-d53c-4873-9dd9-411ec97d6d8e", "comment": "Malware payload", "value": "f1da1edba0f5a4a574192e165f4f0be35839f4ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432676, "uuid": "93187e87-01d9-4684-90d6-8b6479f5803e", "comment": "Malware payload", "value": "74212fe58b60899b16fe0d60e52f269ab64db532fbcad5e0cd9f3ffc6cefbe7adc487b8cd0b2ee099eac354e43f8ff75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432676, "uuid": "5173c249-726a-408d-af87-5ec471b6c91a", "value": "T166B4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432676, "uuid": "4b42523e-6e06-4983-9d06-127400ba3319", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432676, "uuid": "ee404d43-f50b-455d-92f2-a9e0f46ac916", "value": "6144:EKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:E9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432676, "uuid": "67b004a1-fa3f-4f94-8e58-8c67fd6faf76", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432676, "uuid": "55c4ac33-3cf3-4c82-abbc-d4a6e96071d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432676, "uuid": "aeef563d-8b06-49cf-ac00-4d2e40593c91", "value": "e141d2e1c89da0b36625a8b610ebc4a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203b9ed0-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639413949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413949, "uuid": "b13ea6cb-b284-4a28-a80e-c37ab6f40115", "comment": "Malware payload (AsyncRAT)", "value": "18301674f89a6a9f775545ca956d9f9c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413949, "uuid": "c9849990-de68-4ae1-8686-8edf12738ce3", "comment": "Malware payload (AsyncRAT)", "value": "3b286437b0eaf655a697c8da2f5011569e55beece2d690c71650140c3094bc7c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413949, "uuid": "717009da-ccae-4990-8e2e-4a212e20dcb5", "comment": "Malware payload (AsyncRAT)", "value": "3295a5ee49fc8833a92379a0061838b413e6a198", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413949, "uuid": "cb3b573f-9507-429b-a04b-c4b31e7aa02c", "comment": "Malware payload (AsyncRAT)", "value": "62515540440d1ba5e25a00e83fb95d30bb17162a6392d080b2fc0ab5e9d4b23e7b2e9c5f55fe177459ec8d0cf8c56e86", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413949, "uuid": "dbc9f972-3e66-4fa9-8db5-a8aefafb76b5", "value": "T126E30A0067D88126F37D0F789DADF241477ABD6F2713D97A1C8431AA0633B865A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413949, "uuid": "8f284f15-8b98-40b7-9e55-c6f1f5fde46b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413949, "uuid": "fdd8393c-8a41-43b8-be93-1d206e2cea7b", "value": "768:2u+t1TFNzX1WUVIfuPmo2qjH5h0tijEPI/zjbggX3i5CkI40BDPnBDZYDnA:2u+t1TFlq028/t/3bHXS5XX0lPBdAnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413949, "uuid": "0534a4ca-e5b6-4ca2-815d-50ad14e3305c", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413949, "uuid": "e0b393c9-2823-4d06-a380-1ab5d3654240", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413949, "uuid": "23a23cad-cec0-4afb-8426-bf0f582feda0", "value": "18301674f89a6a9f775545ca956d9f9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f2fee3-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408131, "uuid": "83da4d53-4ee4-4778-bb97-356640a6f318", "comment": "Malware payload (Formbook)", "value": "b97a228b145b109f2d658b0b5643a777", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408131, "uuid": "e8edc93e-f6f4-4ea2-936e-e71bc712c49f", "comment": "Malware payload (Formbook)", "value": "3bdd4c36219194b89e4f8df7a09278c233233ce3939a1cbc6d35361018c444e1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408131, "uuid": "9a756d3e-ff08-4c61-8a57-b77f7bd46c5e", "comment": "Malware payload (Formbook)", "value": "0f154af238b814b4311a383aaff9b770162b27e6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408131, "uuid": "36d1e756-aeff-44a6-8f04-ef258debdbfb", "comment": "Malware payload (Formbook)", "value": "321769ce0d06c8245ee552d03bf36996c00b85f59791d687d9b2549823382abbd98f0b2e99ae36edccd37691b7e757aa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408131, "uuid": "3a3775c9-36aa-4e33-91ae-9a5a046c8e69", "value": "T15452EEADD06706988F86A7B8172BAF8501CC766DF7889572763CA73467E1E3A5013C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408131, "uuid": "8209d7c5-addd-4106-9a91-1a2e9935ffe2", "value": "384:NWip6ww0pkUh9xc2R2O1TV5aZjHIWPr5x48qs:NWip6wwoXz7V0jHb5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408131, "uuid": "83f3b2fc-5f76-43dd-aa98-f330bb83ba45", "value": 13512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408131, "uuid": "890d3754-cd26-464e-9431-53b6e4fea311", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408131, "uuid": "fb00a827-59ed-4b0f-9350-47967cd4413a", "value": "ICITIUS33BU_D10307121121003486.PDF.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4f2dcf-5bfa-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639389164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389164, "uuid": "2a020684-583e-47af-8b92-65daacef975f", "comment": "Malware payload (AgentTesla)", "value": "6bb5459d6cd4378e20e11a334dc0ac39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389164, "uuid": "3fda24ac-b114-458f-bcb2-181547608034", "comment": "Malware payload (AgentTesla)", "value": "3c7030f0b0dcb8c0344a11c0431d5739776dfbe19c0be6b6f0da10ca2f0e74e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389164, "uuid": "b02e0613-5612-4b03-bfc6-0041fef92b98", "comment": "Malware payload (AgentTesla)", "value": "bf1a4c9b054572bee03eb0978d1594f1ab2c56a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389164, "uuid": "f3b0ab77-ee97-4ef7-8f94-dd6c8b757763", "comment": "Malware payload (AgentTesla)", "value": "bf037870d3cf242eebb7adf277f7e21af66d2a5314416c926fefa3139f13c3ffce2681f2a1e03748c1784bb534370494", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389164, "uuid": "867b14e2-161b-4124-9252-ce9091422e48", "value": "T1BC552317329DD647C9B9BBF506E2752367FE78242825E71A0DED91ED2B217C20700ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389164, "uuid": "08664c57-8775-4cf5-924e-114a1563653c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389164, "uuid": "42679630-d669-4553-8595-15790c16902a", "value": "24576:InlLeEWmf69lL0oz1NW91lf6lgqrV1gDdP9sHjOSmcQsMosV4E:9v9qO1NyDaV1IhyH6Smc4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639389164, "uuid": "23bab03c-35d9-4290-adf9-eea710ede878", "value": 1351680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639389164, "uuid": "cafad097-df21-4549-b9ba-6c4fd4426eed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389164, "uuid": "eed45d64-cd61-4cab-baf3-af34934238cc", "value": "F\u0130YAT TEKL\u0130F\u0130 TALEP RFQ_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7c9337-5c52-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639427176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427176, "uuid": "ae9ba9f3-bfde-4295-a0e5-80720de78dd2", "comment": "Malware payload (Dridex)", "value": "429db8693d90fb67bcb897578c035e36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427176, "uuid": "e1dd15bc-02fb-408f-842b-526232d9edce", "comment": "Malware payload (Dridex)", "value": "3ccdc391b7cab2de27453c65ce062cda1f4020d110ff4c20323484f9910507e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427176, "uuid": "1e874f51-e088-40ee-8487-0e4b688a177d", "comment": "Malware payload (Dridex)", "value": "5f9d569bae0c813113752b502542ac85670d7062", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427176, "uuid": "e6928f30-1a57-4a70-bc12-9a83fd11cd26", "comment": "Malware payload (Dridex)", "value": "17e6b01bc77188fbbf9f8381f3798488736ceaba3b0132ad3dda6a11825c49f03fa285fe783044126c24ea96b62b9940", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427176, "uuid": "ec35111b-cacb-4e01-89af-6b063a0d3e6c", "value": "T120B4B0D1F05FE94AFA5F46712E189932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427176, "uuid": "e04c752f-e488-4cda-a5c0-afead70f91bb", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427176, "uuid": "a2260f27-ee1c-4955-9128-ba13b12ed4bb", "value": "6144:mKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:m9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427176, "uuid": "d32a6fae-8b35-4b21-a65b-b210e6335458", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427176, "uuid": "c3e64000-e6d9-45fa-b6cc-f77ad5894b6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427176, "uuid": "03157bb4-7482-40c3-8359-9cce19abf20f", "value": "429db8693d90fb67bcb897578c035e36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4069bcb2-5c47-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639422163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422163, "uuid": "d12ccec7-60e7-4ca8-833f-f379d67617ff", "comment": "Malware payload (AgentTesla)", "value": "1bf613f053dace7564da02daea4547ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422163, "uuid": "3ef6b455-4df8-4ffe-afa3-99e8d7198986", "comment": "Malware payload (AgentTesla)", "value": "3cd55ad06b5ef66d68fb444ab399f60954ac6712a27d106c14323b9ae64fe991", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422163, "uuid": "03c061e3-bdf4-4277-bf67-44eb4db21e8b", "comment": "Malware payload (AgentTesla)", "value": "2d84c74c2786cea684ac64948156782d51536077", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422163, "uuid": "bc8b0e1d-0503-4bde-bcb5-35208765df02", "comment": "Malware payload (AgentTesla)", "value": "64f5218c77d5fa60d671521e79cb83d2d2a08e6a98281336a1896fa623b163bd42e46c4fecb2343e69ea0cd191c40e76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422163, "uuid": "0ac81283-cd1f-4fdc-8a49-8dc114db87b2", "value": "T1D255332BBE246671C46587FE3E95051832B9E5091B3BFA3C1CDAA9DE093D7C14720AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422163, "uuid": "4edd3d71-4a6a-4d7c-8f75-42f1f48f1696", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422163, "uuid": "01578176-ecec-4240-b436-a551bca396fc", "value": "24576:cukw8UojOjohE6HdsPypv3roBEWlcOpMADdDpNs6f8aAXz4YbrlrWJ:6wQjOE7e6h38vlcOpMA5DpNFt6Rb0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639422163, "uuid": "fff000a0-10d1-48e1-aa6e-5ed53660a77c", "value": 1341952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639422163, "uuid": "b076d429-097a-4c3c-b317-3230f6edee3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422163, "uuid": "a11440b1-abc9-48b2-a16f-3394e9b67bf0", "value": "1bf613f053dace7564da02daea4547ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d083c668-5c51-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639426700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426700, "uuid": "ecbb16a4-8218-4c86-8883-2379ce55fa4b", "comment": "Malware payload (NanoCore)", "value": "5d75c5c25f157b7c1a31a9f9484593e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426700, "uuid": "a12fba45-14b5-4673-9fdc-451a1b11ec7d", "comment": "Malware payload (NanoCore)", "value": "3d043c739ba79ca87d7cf68cd2782ba338fcd9ffa7360db990e7c0a6f66af5e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426700, "uuid": "4325353b-ae6f-4654-9637-99db3b361905", "comment": "Malware payload (NanoCore)", "value": "030ba4f6ee6e74b185d7e2ef272105e6fd6743d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426700, "uuid": "c2f7d5bf-9113-4aeb-9a67-7cacbbb4cc8e", "comment": "Malware payload (NanoCore)", "value": "00abb945cda13261d0b6cb8d096b2f92ee2309b3fe318341cb0b710c27b4d156a686d23da578c0d0b156251fecb491bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426700, "uuid": "5d1c70c4-ebd7-403d-8d09-75c72fd4f330", "value": "T19565330523A84F21F46363F27A93B1B913F6A868C863F3804DE656D19E7E3F496501E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426700, "uuid": "c8732ffc-8e5e-4cdc-ba48-411ed38283ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426700, "uuid": "0d392865-29cd-4a5e-ba95-f85298ab4a2a", "value": "24576:TnspUl2xHhEgcYutBh4l9M5ltaLv7g8D3cfeOAqfV3eD8EkXIiaXYoy:LsulkhETrP4l+5lug8DMNu4EkXHaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426700, "uuid": "ebccd51b-b623-4b96-853c-b944f9f73904", "value": 1492480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426700, "uuid": "9ac65379-d9b8-4f0f-96bd-edee1411436d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426700, "uuid": "bf486854-de17-46c5-a210-14178cb17144", "value": "5d75c5c25f157b7c1a31a9f9484593e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3667b0c7-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639415274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415274, "uuid": "49ac5918-4368-45b3-9ee0-b61454b8637f", "comment": "Malware payload (Formbook)", "value": "ee22c65cd54b6233cf8e817b0b81ed9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415274, "uuid": "a202bfa2-e4b0-4c48-b2c1-3f3c40bcb851", "comment": "Malware payload (Formbook)", "value": "3d3faeb64e64373190bcc22870dc85136d89549bd73bbfa79bf74551003658ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415274, "uuid": "16fd9237-0f9e-4fc8-a887-054cc673dd89", "comment": "Malware payload (Formbook)", "value": "256325d5dbf1087274709a9d6fca4fada7dd5fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415274, "uuid": "45409b95-ef5a-4907-95e6-81ac545d2f94", "comment": "Malware payload (Formbook)", "value": "fb38843a270327c579a55a7953fe73166a0fb7c15b4dfe632d65adee25e6e938896c972fbe9ac8a652d7c0bec618d065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415274, "uuid": "6e4ca029-3ad7-443e-b6f5-b169e3aa0303", "value": "T174A4233D39D26537D3C005742A7A267AEA77C18D83A9DDD397289FFDB920A034E44A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415274, "uuid": "f5fbbe22-2ade-4e67-82fa-ef23b01b7a0b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415274, "uuid": "274fe367-90a0-4fd6-aa1f-8b5de838c2c4", "value": "12288:3wypyjwogRQjC74plHQ18Qj14fDHNeNKNhpn:gyUr7G8XHbY4f7NIKNhpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415274, "uuid": "df819f5f-fe94-466c-b2ff-980b560300e7", "value": 467248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415274, "uuid": "9a278da6-ef7f-480c-9ba2-04cd343eaad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415274, "uuid": "4cfc74d6-9d24-438e-89c1-12b32f5a65b2", "value": "ee22c65cd54b6233cf8e817b0b81ed9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6697beb6-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639407624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407624, "uuid": "def4f3a7-fa5b-481b-8645-f32e66987d86", "comment": "Malware payload (Socelars)", "value": "bf10f3a708a69cf386f75ee48e2c0d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407624, "uuid": "0ca68934-2d8b-402c-9f62-65f9f307ed2d", "comment": "Malware payload (Socelars)", "value": "3e1c337647cbfe0c68d5d848334bd52bc362a14e108385f1eea03e79adba0f70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407624, "uuid": "89111f71-ef6b-4ff4-a07f-19bb1e07e9eb", "comment": "Malware payload (Socelars)", "value": "8f46bf12723677524d47a17f614e5d858bf3e5e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407624, "uuid": "90b818e3-86aa-4a17-92ba-23b034e0b4ab", "comment": "Malware payload (Socelars)", "value": "395a2b906f0aa60118791b936a28c36c10567e924f8d4546f7f7cd3be7765af1cacb29b54c15d869d1004ec79bde7dab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407624, "uuid": "75b6cfe0-b5fd-4015-9cb1-bd0b4bc5c66a", "value": "T1A8659F11F642A036ECE300B282FF5AFE9D6CB621030854D7E3C45D695E619E37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407624, "uuid": "0727f02b-f8c9-4ccb-9e46-82bfef9d4b28", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407624, "uuid": "edb811cc-09f7-4d17-9915-1adef3b57f7a", "value": "24576:ZaApxEmUociWVxvX2LfeEyS2ZrU2xbVGUpgrnRiZOpdEw8j:ppLfvjqltirnRiZOpOw8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407624, "uuid": "aa63e401-e9c5-4d25-bb64-f2901e595634", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407624, "uuid": "c655daa6-2bd8-42fa-ac5b-52a815af0020", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407624, "uuid": "116c31df-db58-4896-9033-921713c1eb5e", "value": "bf10f3a708a69cf386f75ee48e2c0d41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699f961d-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639407629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407629, "uuid": "377eb878-f01e-4423-a7e3-148b4be9af34", "comment": "Malware payload (Smoke Loader)", "value": "377544805ade302b4ee478c15d320f45", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407629, "uuid": "d9337518-6a3c-4ab8-a319-aeb113fe373e", "comment": "Malware payload (Smoke Loader)", "value": "3f0641e7f1e3af84ea7a287cbb78850b92042b96cba8b10d28d035f5ec732ed7", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407629, "uuid": "485900c4-c051-49dc-aa1f-85bf80256ed3", "comment": "Malware payload (Smoke Loader)", "value": "a9e3c91d34e020fb58efbb76f13d5ec446e80fb8", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407629, "uuid": "38bbaee5-0bc7-4924-b4c6-2742b656b2cd", "comment": "Malware payload (Smoke Loader)", "value": "3a868f81bad27e4fc618fcd0dce8ae136573464d9ecc2d2e3af5c5de40253370671a88afaf83452734cbe806a07fbfc3", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407629, "uuid": "e3eb8126-edc7-463f-9a48-def6329f0db8", "value": "T1E7148CC271DDD471C7A2793094709AA45F7BF8B3EA20454F72782BAE2F722C05A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407629, "uuid": "42cf1b2b-de88-452e-baac-efacfe2ef9c4", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407629, "uuid": "9c87f46b-4508-4bab-97e8-0137f3cedcbe", "value": "3072:7Ft0ues/sIkDlofLmkZi75GBhsZVggjcGkNIVqIzmmZSsdb932:RX/eofCkf0b7ITsqKmMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407629, "uuid": "1a0704c1-6834-4c60-b114-af83f3ccac7b", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407629, "uuid": "36f3ee1a-7b93-4cd5-93f3-bc13b69e172a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407629, "uuid": "594b3ee1-f9b0-4fe7-8f5a-a027eef15e72", "value": "377544805ade302b4ee478c15d320f45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e8da78-5c2a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639409764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639409764, "uuid": "381b2681-83bf-46d8-b90c-5488587c8c85", "comment": "Malware payload (Loki)", "value": "ed6eb3a25781a404a13ddd11a1649d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639409764, "uuid": "cde2da0e-4a0f-4633-8e9e-6f04f18de765", "comment": "Malware payload (Loki)", "value": "3f35409ed1b633ce1ad0b565116695f74fef88080ede1ce265b96f32a1f98afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639409764, "uuid": "cf6f3f65-4795-4ae9-965b-135fdfa601ff", "comment": "Malware payload (Loki)", "value": "047381fa8b22162c54f309d44742dccec175042f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639409764, "uuid": "7bdb163e-36c7-4d3e-896d-e663ab2f59df", "comment": "Malware payload (Loki)", "value": "0c184c61c5a47d0f6c05d3334cd4eca174c1cdbecac6b3126ef1bad120cf84ddfe50910b58a8cd20868cdac41963000f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639409764, "uuid": "4093ed3b-896a-484e-8483-f1cced3274eb", "value": "T16245122967A49E15F46E4BB890B1C130C332AD056826C32EBDC43DEF7E73760A90579B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639409764, "uuid": "e59da91f-bc74-44b9-ba3a-996ecf71e150", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639409764, "uuid": "e2f75656-e692-4cf4-8191-ceb46b5a4288", "value": "24576:nc0KeJK1goOPXM03feV3462+Vu++XOHtEga:n3KyK1gBPXDveGWg+yOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639409764, "uuid": "2259f591-5707-4e5c-a75c-cbdf9af79542", "value": 1237504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639409764, "uuid": "9d694669-5091-403f-8dda-a782a976f888", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639409764, "uuid": "24d6eaa7-cbd6-43af-920c-005170b965d1", "value": "SecuriteInfo.com.Trojan.Siggen16.5169.23703.21116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d12d8ee-5c46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639421647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421647, "uuid": "56bf7930-1dcf-4902-b6e4-3e2f31ff8308", "comment": "Malware payload (Vjw0rm)", "value": "0dfd936ef5362d6532650276d65d140c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421647, "uuid": "4647a4b9-e906-49b9-8f0d-bb85120c1543", "comment": "Malware payload (Vjw0rm)", "value": "3f6cb1cc82738a84df939a7e311a487a8d7fc261fc177b00ddf26a56175fd050", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421647, "uuid": "3000c103-50da-4c65-8ecb-6058ffc505ae", "comment": "Malware payload (Vjw0rm)", "value": "3f904ab0619f5938ac5c01aa661c4bb30a2a53bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421647, "uuid": "49e12c9a-bead-46a1-a5f0-0aae670ae6a2", "comment": "Malware payload (Vjw0rm)", "value": "bb47f3d744a6928318348f4b80ce339dbc5faa1c78240d199b39c1a508375a26e20258353fffc7d71df4cdead7f7265d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421647, "uuid": "d81fe2fa-33a9-413e-8516-76752e8cb3f2", "value": "T1BCA27DDDAD15B889D7206221627E4FD9AFB8434FA402929D3C2DB2405F72610D6EFF2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421647, "uuid": "06b1e75f-9df5-4772-abf0-9a38e21592c3", "value": "384:tm3uw38LWlze6OjKLTa22AhDIiQQPlo8k/aETM2TL04vZLH0w/L/F/Q/CGe:olsitbbW22CDIXco8k/bL08nd0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639421647, "uuid": "a6b7f9b9-1180-4a6f-b53a-4682a286b509", "value": 23074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639421647, "uuid": "09c4905b-255a-4b11-97ae-fa5ff77bc6ea", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421647, "uuid": "96bedeaa-3a06-4b8f-ac64-76e8c9049534", "value": "receipt_ups.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482a936d-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639407573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407573, "uuid": "cd94cf9b-01c6-4736-a682-3aefb22504b1", "comment": "Malware payload", "value": "e030f933c60c81c56e8f114cbb926161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407573, "uuid": "6c926060-6fb2-41f3-b668-2d91cffa5217", "comment": "Malware payload", "value": "3faef66c4c791783359a718a147fa3f9a58e88ae5e27542590f8a984c6437132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407573, "uuid": "63dc7d76-c714-4675-852f-601ce96f91d3", "comment": "Malware payload", "value": "e5ae425ea2bb66e60764633b2e9e964400dd35b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407573, "uuid": "f3a9cb52-4fc5-4d88-aef8-34c000271746", "comment": "Malware payload", "value": "b9c0d74fcabf4675428b56a2f0871e6948be3566663091ff87b43f167904a0383263845c5dd059b9c4ccbc7ea6dec24e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407573, "uuid": "ad317fff-2aeb-461b-a429-fe69df5be8a8", "value": "T112763311B6D0DA75E213423346AD7F86C6BBFB750E74856303D18B5E29F900E8923EA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407573, "uuid": "f956fd93-af24-4b7d-a7de-3eb4f6fc9c76", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407573, "uuid": "5ea4d563-55d6-4002-9331-cf04c9d7ddd6", "value": "196608:91OK62w+hOYwGlmnH8BWnUjWs3pPTgTHS57ga8bE9V:3OK6+QslokCUb1F9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407573, "uuid": "bad5284a-eebf-4a40-ba73-d8a9e83aed2f", "value": 7602532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407573, "uuid": "0e2b1b42-1c82-4c99-a45a-504197c4d14f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407573, "uuid": "853dc7aa-bf93-43c1-80e9-f8ccfec2349a", "value": "e030f933c60c81c56e8f114cbb926161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b2c9f2-5c15-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400647, "uuid": "2d2b25ca-3d75-4634-b683-40567268801c", "comment": "Malware payload (Mirai)", "value": "85ad42272a83d42abb200ff8fb908594", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400647, "uuid": "b3c5a707-6095-40e6-b2cb-e42a44285979", "comment": "Malware payload (Mirai)", "value": "3fdb7ceeec4df4899ee124fe6222257fa446d46c7526ba30ebe64b6fd15f434d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400647, "uuid": "5981d8b9-5d38-41a0-b692-fe09396b08a4", "comment": "Malware payload (Mirai)", "value": "57f13e29f1c72034e4731f292192035c5ceeac50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400647, "uuid": "a6e54446-475d-4c58-b487-c94596126fb0", "comment": "Malware payload (Mirai)", "value": "e3fad20a5762702d9f773421dcde6797238257cc1c7f49f873c28bab790342beea1ab090bdff79e3ffae6d12f5197a86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400647, "uuid": "1677057e-6b22-44ab-8b4e-84263441f3d4", "value": "T12803F16C120B66FBE398D5B313B927D06F3D9FA5F08FFD0A4159C4A64E495323D429A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400647, "uuid": "aff073d7-064b-44a5-a39c-2bdbbbed8f98", "value": "768:wnbats/V3RoVhcYL8Ubt1euyTmMqUkomPoBXZvzBFl2TQdJgGlzDpUYs/:wbJhgHL8KtYuyXqUVFqQ3VqYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400647, "uuid": "3cb7a7fc-be7f-46ab-bc4e-d069fbfdb73f", "value": 38652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400647, "uuid": "8aa1cff1-6dbf-44d2-97fe-5071cc24d45c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400647, "uuid": "d520f04e-ae74-4a23-ac06-b0cabc8ab335", "value": "85ad42272a83d42abb200ff8fb908594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293a7da1-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639408380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408380, "uuid": "17d28da9-9c86-4911-a97c-97a96252098b", "comment": "Malware payload (Loki)", "value": "f4e7d7950531cdc621d75b5c55a37311", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408380, "uuid": "c27ab578-621c-4f23-b800-b9a120ea2782", "comment": "Malware payload (Loki)", "value": "41d6b9f0551032caac20d89dd7ebab905262a0a23e0a59a8021094290643eae3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408380, "uuid": "5f8bf412-9caa-4a7f-9a5b-beac3ad7bd2a", "comment": "Malware payload (Loki)", "value": "0bd33c2b157296df2b17d909b923e79e47472d1a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408380, "uuid": "8dad3f16-87b0-40a4-911f-d524b876c7dc", "comment": "Malware payload (Loki)", "value": "4adf279e52092ee860b7d58385c02be89e0b062f902012039294bab579492c44931d2e80bd364ef9d5b069984b9f13ed", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408380, "uuid": "fe25cddb-1215-406c-977c-0d2d23aee03a", "value": "T12334128AF234037CEBF4E57E1E856183A6E1EE596504BB15D781FA087FB08A1C43875B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408380, "uuid": "16f05ca1-4e1e-42b2-81a0-735fdd0fac8b", "value": "6144:Wj6/MCblcJyoklUIWbZfxifecPntJHYZsl:W8b2J1ZIWt0WinHasl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408380, "uuid": "a925c533-066b-4971-acf2-28f4a5bae881", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408380, "uuid": "9102ebb4-0cbf-4823-b076-2ff1c6f6c1fc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408380, "uuid": "92441f8f-f28f-4d48-8285-42887828c5b9", "value": "FINAL_REVISED_PI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de283b1e-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639408684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408684, "uuid": "43ab03b0-305c-4960-95d3-e755a5038859", "comment": "Malware payload (STRRAT)", "value": "b6dfbc43cb551d1c52da19a0709fb5ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408684, "uuid": "2a80c302-99db-4174-a862-c6dc4153b310", "comment": "Malware payload (STRRAT)", "value": "423a355fb8233f9681ad718fb887df922942594b6ada5e926b1ecf4e67b6cd71", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408684, "uuid": "ddc8f5c0-9831-4353-a7ab-5ea59205eec4", "comment": "Malware payload (STRRAT)", "value": "c5b2c6093e12a8797d587533f2ab7e56622e8de5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408684, "uuid": "c503493f-ef8d-40ad-80c8-4eaf075ba178", "comment": "Malware payload (STRRAT)", "value": "9da5c2c9c70a2d1c9c26bdc20f67840b1183886177f7d687968aff996455b9b1f350db14d5462bdfba8ed1cb0f86af47", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408684, "uuid": "130a4cb1-0345-409d-a0cf-2ce202f3f81a", "value": "T14D04BE11BACC19BDC768822643F9C4E45ABCC3E674C52443B6DEEBB4BBA3D0125721D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408684, "uuid": "36890255-4b14-461c-8c3c-60bf35886220", "value": "3072:um7T2BUf39GzVSiG03rBeTmXUsrQw8x88CM61lmK0YtV:13eUf38zsiG4eTmEs+xrb6jm4tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408684, "uuid": "00c65a16-9603-44ea-8689-2d85bbdc3fe5", "value": 186933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408684, "uuid": "c3db8154-1159-40b6-bc5a-995dfc087914", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408684, "uuid": "35a09f12-84dd-4515-bf87-90017d0330dc", "value": "Request_For_Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1637b48-5be0-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639378088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378088, "uuid": "5ce84830-7199-439e-9ac8-d16e2b18bdf6", "comment": "Malware payload (AgentTesla)", "value": "a92bab2be5ae5dfb7a0ac9cd902f431a", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378088, "uuid": "f8566437-ddcb-486b-aced-3c9c5c224c8b", "comment": "Malware payload (AgentTesla)", "value": "42e93d726f70a1f410ab41d1647adafa5c822c59f6af12a48751b9951f3c144c", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378088, "uuid": "287ecf04-8307-441d-9604-ca4b7c31e3fa", "comment": "Malware payload (AgentTesla)", "value": "ea3fb237e667b2c3880981a3eda489f068713563", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639378088, "uuid": "a7c2bcae-cbea-4455-8483-3536e25d29ab", "comment": "Malware payload (AgentTesla)", "value": "c5fcb12cab9ee95bb63ad50b3392090031270792a64e5e568d6707d31f3e864db2b72b305fcc9288149747a447e15051", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378088, "uuid": "7ce9d57f-5c25-4e28-9a8a-943a13070906", "value": "T1FA553372FAC766E18C28D23307E0B35D45E384E723B2E22581E9ED58F490D6B8139B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378088, "uuid": "a775f41f-8d73-4fac-a732-d7afb2e84544", "value": "24576:HNgC0JguCW3n1ASYgDSo35/5DbaOM+RzR8iI3m88GvNroP+KkBKpWun7w1cKnfoN:Hn0ORWX1A7Ab3d5vXM+R98pxvNroP+lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639378088, "uuid": "c92199ac-6a6c-4c27-9474-d35097d8a9f5", "value": 1313711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639378088, "uuid": "325e5f47-a609-4128-aaf0-8b97bf5e73a7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639378088, "uuid": "4cc5dd8d-7dc5-4d29-bcf4-f58dcc74bb85", "value": "BL & Shipping Documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdee0a18-5c4f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639425917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425917, "uuid": "d0bf804b-3b13-4c13-9eb8-77e6c73a2998", "comment": "Malware payload (Loki)", "value": "871f82357c062c133a2d24c8c58260ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425917, "uuid": "dd270573-380f-4d69-bf85-fa56e83e9d6f", "comment": "Malware payload (Loki)", "value": "4336f282e645d804811211b06a5b770f6890ed874f2b334710ebd60da51f43d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425917, "uuid": "62ee041b-9ac1-4bec-b03a-6d2098ccc3bd", "comment": "Malware payload (Loki)", "value": "c7b050f57273e31329b38a3325d7caa07eb8cc4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425917, "uuid": "9ee9fe8f-fff6-4b0e-ac8d-3bbfa0bdf5be", "comment": "Malware payload (Loki)", "value": "a72ffd9dc38802dbdc824426066af9142c4e421485042430b74e9c554103274340efa493ae6e0c17c0385bd6d845042c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425917, "uuid": "0cd8c929-72a6-4d23-91c2-7b91f639445f", "value": "T13FB4585473705B41C8325E30E0594E1EAE667F6C2CBEB43DA26CF654E27F68348A9DC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425917, "uuid": "eb2d5b16-e36d-41d4-9aef-aefdda6c81dc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425917, "uuid": "2c1ce621-0160-46d1-9152-e179061191e0", "value": "6144:eGiWnzGk0O2ZyZsZesixGDh44oyH04zSXR4RC9CZgH/6il2s5p:lnZ0PZyZsZpiYJJU34RWCZgHy+5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425917, "uuid": "623af0cd-8af5-4f31-98e1-bf0c2103ba9e", "value": 495392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425917, "uuid": "e827cfb5-2045-43ef-9640-3ed6afe9d3f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425917, "uuid": "dfc4690e-ac1a-4cdd-a62a-8c58b3ff5a38", "value": "871f82357c062c133a2d24c8c58260ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ed8d6b-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639388244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388244, "uuid": "2d4ce645-e1c3-4c35-a22c-e3257d053a3c", "comment": "Malware payload (AgentTesla)", "value": "a40fec3dde6124b06b5cdb9ff897200d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388244, "uuid": "727ae247-301d-4422-b166-c19b059134f7", "comment": "Malware payload (AgentTesla)", "value": "44171a2b857e4117f9db3df80a395e0f68e83017bcfc4f42cc2f8fa45a244c56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388244, "uuid": "c8aa7bc6-fb6e-4fea-a5c4-a97aeb1c9067", "comment": "Malware payload (AgentTesla)", "value": "cbc943ece1940932017a2d9254d4d43e95c26a6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388244, "uuid": "53daba93-258e-41b0-abee-80b03e6184a0", "comment": "Malware payload (AgentTesla)", "value": "cda9fab995364b1791b46f7daee9af56f1c36414a4368ec23d346f7807f5e72a7f78855bd8080ce0b6bda058e1045801", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388244, "uuid": "22efe12f-d25e-4e2c-9423-76428bcdceae", "value": "T1F0553305319CCB77D42857F41A20238907F38D19BB25FA1C7DE968EB5AE27811B607DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388244, "uuid": "bbae19b2-1e0d-4864-a468-eee53c85e582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388244, "uuid": "31bd1217-df79-405e-a3de-d2b1e2a1f12a", "value": "24576:8+iq6r7j79iI1Q0zrbNJA7pRMtSz9OOYsqxY+ubNsHksBWLxAlMP:mq6HwYzrBJAFX0OYsv+INVsBWLxAlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388244, "uuid": "4ba1157d-1342-4bcd-8ba1-087265e910a8", "value": 1323008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388244, "uuid": "6c859d47-a067-4612-89ce-fda63f3c09d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388244, "uuid": "305231fd-fa78-4645-877a-ac333455360b", "value": "DHL SHIPMENT ARRIVAL NOTICEHAWB R129724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c35b5d7-5c04-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639393514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393514, "uuid": "b3620ae9-d212-435a-bcf4-c7d835acfe92", "comment": "Malware payload (NanoCore)", "value": "be84d84b0c5c6e528d7754998948d226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393514, "uuid": "3b7c456b-9e4c-4507-a97f-8b9e57c28abb", "comment": "Malware payload (NanoCore)", "value": "44c29f91fc5b6402e6ccebd127c390b8058658f129f208a986faa82edb281e7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393514, "uuid": "d99f0aca-a0ff-4b34-9883-41d69e575cc9", "comment": "Malware payload (NanoCore)", "value": "ce374d98b1e7ec5688efd70b73630abded41c3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393514, "uuid": "abc36d26-4403-4607-b17e-d1ef1b5dc9e2", "comment": "Malware payload (NanoCore)", "value": "54bd97763a75b9ac9434561487c4a64856b1f447e89c9c209f3930f153bb4e361a81403fd1baa641934f7297ef5b41c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393514, "uuid": "594b1ba5-94cb-4545-a7e5-58e6e634aafa", "value": "T1612533387BB984C2EEFE477254BB60201B75362B9185DB0C6D48D8CA3AAE340B655773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393514, "uuid": "14cb4c59-da33-4b2b-81bd-358fa1728370", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393514, "uuid": "1b462028-b67f-416e-99b6-1cf013f0c551", "value": "24576:sMWFd0JIkPSIYzL2WCzap1GxBB+Ake3lmUd6ZYuGd:sMA0qkPtaSVO1Gxu3klb8iuGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639393514, "uuid": "e4d1118f-fbac-4f19-9afd-46354bba63fc", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639393514, "uuid": "6f57e35f-8e35-4e7a-96ac-11639a7c29b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393514, "uuid": "b695704a-e5ae-4365-a248-b1dcf3c88a16", "value": "specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35d45a3-5bf5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639387110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387110, "uuid": "c7955233-90fe-45d6-821f-5737457ac5df", "comment": "Malware payload (AgentTesla)", "value": "093c0775a304d904a88c90fc85aa9c46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387110, "uuid": "d518537f-89bc-4ad0-82a7-eb705d08fe8e", "comment": "Malware payload (AgentTesla)", "value": "44e3e6d3abf7b21c3b6c830f7c6d01f87f55f78981bb66e9c83744f491cca217", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387110, "uuid": "d70c2105-9a87-4504-abd1-a1d797c6355f", "comment": "Malware payload (AgentTesla)", "value": "4136e2fe7bd5046c7bb6c549b1754b98352f5482", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387110, "uuid": "8242e9be-5cca-44b8-9795-6b209e615526", "comment": "Malware payload (AgentTesla)", "value": "0a8e83600477d563d260562f9ad2d44fb7cb3e2375f9fb31abfd2012e0448e1ecfb6978c1da579c8ed4b268ee9109ca5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387110, "uuid": "68f60098-403b-445d-9ca8-8934f3aefe6d", "value": "T1F04533AD90E2F7CDDEB26809A16B99DC26F00372587F2615C398E05815E72F4FB78760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387110, "uuid": "76bcc5f6-6e23-4f5f-81ba-7181f573f8f7", "value": "24576:t8bQU2+hcE0GH25UhxhiXNAt38EfCXagShCm4jPMNltOxdQ6b/OONscOnOHtqcOo:t8bQ7Q0GHuNusE6qgShCAV7uOnOMcOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639387110, "uuid": "8b8aa5ce-d92e-4e1c-849c-b679512e07ff", "value": 1269741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639387110, "uuid": "19d58ab9-ac5d-42da-9c06-2365621c99b7", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387110, "uuid": "c1019aef-15dc-4de3-b10f-b7b9c6645beb", "value": "Purchase Order_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bb2f7b-5bef-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639384427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639384427, "uuid": "a398e10a-b737-4565-b4e4-97de8a19180d", "comment": "Malware payload (CoinMiner)", "value": "ec07adfcdf6e3e4a1e84191eb1cf6a91", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639384427, "uuid": "6ce0ff3b-0c58-40be-9a76-26a5170aadf6", "comment": "Malware payload (CoinMiner)", "value": "457b254439cdbbc167b45abc09d9531b59ac7b104e847e453e5abd016991a6e2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639384427, "uuid": "93039b7b-42c3-4ef1-98da-479979ba10c0", "comment": "Malware payload (CoinMiner)", "value": "cc2ca49a55f8021022c53942cecd7b702f4d9773", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639384427, "uuid": "f9c63f2d-b922-4ea4-ab14-3924acb91f3b", "comment": "Malware payload (CoinMiner)", "value": "5c6062f78d31dc8acc6f3dcea9c259786f484d6c70e2f0b82cb493cb47ee7132248c62277e0f11a9b887e716af276b1c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639384427, "uuid": "850cabf9-c405-4c79-9bf4-d524cc1d2793", "value": "T1EEF533B4AFBEA0C6F25E60386F563E3641BCB105B1AAF475CDC196D3FD248152990E0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639384427, "uuid": "6447cf05-6871-43af-8f8d-ab1611f5ccd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639384427, "uuid": "0bcec644-b430-4158-809b-5487ff34f767", "value": "98304:ltDjVJvzyVB3GxsuvPNI9g978a4dSwtCneQx7:lRVsysLdTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639384427, "uuid": "a1e62a0d-96d4-4ccb-baac-8c99c5e83ec9", "value": 3519488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639384427, "uuid": "d7c9b4d8-4763-4a28-bf94-1e7e8a952e8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639384427, "uuid": "921f0362-82e2-4861-87fc-af3caefe5aa6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f1831a-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408613, "uuid": "bdf61042-2d64-416b-8064-4a0a5fc3488c", "comment": "Malware payload (Formbook)", "value": "549a89432ce280384c6cc7253e98ac12", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408613, "uuid": "4681b177-386b-4447-a1d1-ac466b7bd49e", "comment": "Malware payload (Formbook)", "value": "46e552f153c21cfc25638d0fdf90cc5c1158d001cb5b2da8313d80132ab518a3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408613, "uuid": "ddd584a3-98bd-4448-a6e8-f28c8a5ae646", "comment": "Malware payload (Formbook)", "value": "448488df293a545617c929088beb6088c2d2125a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408613, "uuid": "5b59a8e4-4ce3-48c8-9258-301f62440b8d", "comment": "Malware payload (Formbook)", "value": "2f9141151e949b227d882a5b651d94853431346b5e24f6d44e6662196a9f0dbe6d6f2f617c6b4c27e8d32301ccf2dbbb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408613, "uuid": "b6050abc-97b3-4c84-9dbb-70855db54825", "value": "T19EE4011436819153E2D06B389F25F3B18735AC9DAA78A98F26E13E9F3FFD4C36015581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408613, "uuid": "28848f6c-a26f-419d-b52a-c522525aa33b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408613, "uuid": "d96c2b43-a672-4bcf-acc3-0f0508011e45", "value": "12288:2BKTwZZvD7hJmbjDPv3hbc2mo1yH4ZhJaMkIQj14J+wD7VCzbjn43c:2EUhD7hJmrx1s6hgqY4JxQzbIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408613, "uuid": "f81602e3-90ea-4dac-9d07-e3a7ab121ff1", "value": 667748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408613, "uuid": "7af9b0dd-6635-48ad-9a1f-514830c289a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408613, "uuid": "9d464809-a071-42c0-a8a4-de6e4d4ceb60", "value": "DHL_AWB_NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bddb386-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639407714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407714, "uuid": "aa540d15-608c-4e27-b7b2-338f7dfc001e", "comment": "Malware payload (Formbook)", "value": "b898400abfc46205dcdda77c84f01591", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407714, "uuid": "6d55f54a-2ee1-4617-9c68-2755d94c27c6", "comment": "Malware payload (Formbook)", "value": "474a986eae85622d39271668086c51af6ec1d4aaaa7f92e7606c9565444fe1dd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407714, "uuid": "bc20c6df-2fb0-4a6c-b092-890387aa4f18", "comment": "Malware payload (Formbook)", "value": "cfb4351942caae2897ff3de441554dcbb43f3eca", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407714, "uuid": "e724edbc-f936-41a7-9b87-d67d76038120", "comment": "Malware payload (Formbook)", "value": "dc5e0461798ba86b9528ef905ea8432839f7a8ec0f5a51581bafdd03e5b0312b4d3504e50c5301e7b2d6b4db4517ee08", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407714, "uuid": "c432c8c2-287b-4236-9f7d-84ffe09278ff", "value": "T14984EB50912E3D6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407714, "uuid": "9e18e1b2-5927-4a93-b535-0e3c94216c9d", "value": "1536:iCwDDDDDDDQKEFHa6gBK5VmVOoOPaV10IucHzf7hKfedzFz76mAg5eeVhMDw5wfg:iXDDDDDDDkPIx1dzFtr5RDAw5wfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407714, "uuid": "868a57e1-fc97-4619-87d9-c6f083daaac0", "value": 392757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407714, "uuid": "67d81abe-0dd5-49ab-9f9b-c1eb78d4e256", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407714, "uuid": "2e522100-0a9c-4c7c-be4e-4d947b58e49b", "value": "RICOSTA Schuhfabriken GmbH_MATERIAL ORDER_36007.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07d88e4-5bc7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639367402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367402, "uuid": "44d72d32-ebb7-417d-811a-9a1e9f7a72bc", "comment": "Malware payload (Mirai)", "value": "bc4464f89a2f4595659dfa183c17dcdb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367402, "uuid": "3799d53d-5b92-48ec-a9b0-85ee0d8a70a4", "comment": "Malware payload (Mirai)", "value": "48974453dcba07fc23ee13bee714e7073114be92650fc55bf60bd2520f04b50a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367402, "uuid": "f0d96d69-29e2-467d-9f11-7d23351a6b3f", "comment": "Malware payload (Mirai)", "value": "da9fc732eed5cc7a75625d3149ebaf6a24511ee7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367402, "uuid": "74d71c75-3dbc-4da4-add9-8ea5af6910ac", "comment": "Malware payload (Mirai)", "value": "4ccc72e764899dd923e281e63cda7f49548918b3f364c045efaabc3fecf1c29aa0ca308f4b5ff59e3e34e432af212f7b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367402, "uuid": "ce3ae593-2ffe-494a-95d6-d36db9ad92dc", "value": "T1BB23F271B10599E3BEA0D837E4E1ACC374BB1E76C0BBB19312B88ED087668176578457", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367402, "uuid": "71050c1e-46f7-434f-983e-dd4e3038596e", "value": "768:ctf3ZnAnCh5cx6kq4SDNmfHwerUSFAsYs4PGXG9q3UELiLnI2t7+uFPS+z:ch3ZAnCko42m/werUUH0erLiU2tiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639367402, "uuid": "7f3ff00f-a378-4823-a2eb-c0ea8e439cde", "value": 46792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639367402, "uuid": "daa4e63d-7186-4a4a-a75c-b38ad740b3e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367402, "uuid": "d1c38f18-d941-4688-ad90-e35202488922", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a955a6b-5c3a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639416516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416516, "uuid": "77586032-31e6-4724-b536-c2bfa67b3a81", "comment": "Malware payload", "value": "2ddcdf98752406d187efc1374904a9f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416516, "uuid": "ae526222-2f0d-4289-a615-b15be632c522", "comment": "Malware payload", "value": "491bf2537082d6dd325f1a4dea915e28db8f8950eb7798b49a3bd41515128645", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416516, "uuid": "dc9ef593-0817-460e-9cd7-3928400dbb36", "comment": "Malware payload", "value": "a7770d077873bdef1a80b240dd402057c0897749", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416516, "uuid": "21688569-71e3-4d82-ada6-86dc9055ecbe", "comment": "Malware payload", "value": "59a7a16df80a540f310d995ef0ebfeb1ad637336edf213ad4dedb1bfe5c81ee336af715c2ee2653d0a7677e3af599f99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416516, "uuid": "5523b704-0ba2-44bc-aa03-4444b1816917", "value": "T1F755AE5A32154D69D9A7E17CC4534F4BEAA074019370E6EB17A08BAE1F273E21E7F720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416516, "uuid": "0938324f-1e36-4d43-ae1c-20d94a7b63d1", "value": "4ca54a6ae85170224dd88abf6fab85e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416516, "uuid": "0f41a4b6-f040-43fa-a9a5-d66ba4eed38d", "value": "24576:GO/fQIFzuTDe1V/uUa16a1wRtbBVshvzMdVgnZ0TtvLZNPbU7uQsoTdo+H3v:GGfvJa16aOfoTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639416516, "uuid": "31019c30-3320-4a23-ab03-2db1f0198777", "value": 1404928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639416516, "uuid": "07be6db8-3418-4825-8a8b-26819afa3ff3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416516, "uuid": "5a8093de-4693-4e1b-a24e-2c5c8b0087f7", "value": "2ddcdf98752406d187efc1374904a9f0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea2cd40-5c52-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639427126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427126, "uuid": "67efd364-7f00-484e-a6e8-ea536c6f8751", "comment": "Malware payload", "value": "1f543c1b5e1f5ed03e41c7b648dd7730", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427126, "uuid": "554ca977-f6a5-4afa-9d70-aae2d1f8104d", "comment": "Malware payload", "value": "49c2584adbb3064dc9fe7a92c9bad9c76a3ed046f07bb8b911808c47a4d6060e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427126, "uuid": "9f4e5496-20f9-4a86-9dbe-70915037eda8", "comment": "Malware payload", "value": "620d3c90cf2ed99d0e5a1923b9e700e78360292f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427126, "uuid": "f6693a34-74ff-48c2-879b-085de1810650", "comment": "Malware payload", "value": "cb8157eb1ef2a93edc3a55cae062d2184448ad8f47865300b057fcc0b282b04f7aa6a04d31bc480afe2cd0158b5907f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427126, "uuid": "baa6e39d-7fe5-4913-a839-41195db68935", "value": "T17645335475A04FE7C91383B775E21F8607F2AA0C6332F6885DDA82CB4A16BDA56813D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427126, "uuid": "5310bfa9-e35d-4d8c-845b-db9c2c2f4ca0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427126, "uuid": "1bebe0a0-48a1-4854-908e-12f965914119", "value": "24576:H8gpbNB2suQUrBRtpf7liJ94zj1iIaAhaWkchtdiiiaHr:pnAy4fZi4aWvdBi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427126, "uuid": "ca87ba9b-e345-44f4-a7dc-bb6a357d7efd", "value": 1199616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427126, "uuid": "1430cbb0-1dea-4804-bca3-dc6e125655c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427126, "uuid": "1e7a7c18-ec23-461b-921e-db03afac66db", "value": "1f543c1b5e1f5ed03e41c7b648dd7730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7baad9b9-5c33-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639413672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413672, "uuid": "7fdc6ec4-5943-4b1a-8714-e913675121c1", "comment": "Malware payload (Quakbot)", "value": "0f695430614b093c07e6409eeaf652b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413672, "uuid": "33b55a95-4e2a-483c-b9ba-67cc06d4643e", "comment": "Malware payload (Quakbot)", "value": "49e60ed35ea8c2e29b4462c51e4796abfa7576ffdd9388be1443c2a933439971", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413672, "uuid": "e886884f-86e2-4531-a37e-8d8d4db0d601", "comment": "Malware payload (Quakbot)", "value": "c372374cedda6d9338e264bb616b7a0a746345f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413672, "uuid": "6bbc2893-519d-4b2e-9145-4a349883f44a", "comment": "Malware payload (Quakbot)", "value": "4f9582e66a8378f8f72035fb1cd0c842294e0444731fd57a54d52a44490105def5842073311cccde231a8d15d8fb5566", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413672, "uuid": "0d088fbc-e528-460d-ab86-211d8e01edee", "value": "T1D1E4AF37F2D14937C16F263D8D5B7258E92B7E112E38A84E6BE41D4C9F3AA403526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413672, "uuid": "64bed203-415a-46c3-b5f5-18370b2a8655", "value": "779533981cce29e233fa98f54323909b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413672, "uuid": "417d1324-16fc-4a2b-a288-14bc171f20a9", "value": "12288:l4V3PLzRyyTYI8N1pYekopeZWPNyGgpEMaLClRMpuTiq5zcRr:WfLwu8N1CYKWozEMaLC0gOq5ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413672, "uuid": "d83f20c1-0d9c-4325-87e6-8801de27bfdc", "value": 704883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413672, "uuid": "781999dd-1001-4fe8-9bc6-67318a4da79e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413672, "uuid": "a11dee2a-0d10-4b0e-b6c6-82ae70a9f761", "value": "49e60ed35ea8c2e29b4462c51e4796abfa7576ffdd9388be1443c2a933439971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26192f9-5bf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639387672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387672, "uuid": "f7d733fe-c610-4c3e-8da9-02c3868b81c7", "comment": "Malware payload (RemcosRAT)", "value": "6d7aca4592a1041e1e33327d3dda323a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387672, "uuid": "40c8b271-5a69-4f4d-b3af-d0b768c27c75", "comment": "Malware payload (RemcosRAT)", "value": "4afefb73e99678c987858f79095a203a3df18eeeb0fe7b59571325613f4a3dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387672, "uuid": "2bdf7b98-a9fd-471d-b056-197dea9e0e49", "comment": "Malware payload (RemcosRAT)", "value": "6211c8c8330f703a6b9499406be418d42e3ea828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387672, "uuid": "82c24629-8c3c-44f5-abaa-35192cd69157", "comment": "Malware payload (RemcosRAT)", "value": "12a6ce4a2a9b72ad70621c21587f25bd5f957745dbb4cecfff504e490617447606a4299830d0c8021bc39986badda77a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387672, "uuid": "68429af9-7942-4515-b318-8b7bdd10fff3", "value": "T154F49F23F1F09877D1B32A38DC5B966498F9BF002A34A4466BF43D488F356B17A35297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387672, "uuid": "e49f5b2e-fee5-494c-aa94-03ecad6271ff", "value": "fa0e7f1e414f64ce479e9b2ae5bbfdde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387672, "uuid": "6dc4ed9d-475c-46d5-b401-e8341d44e827", "value": "12288:x3+1u3fSageKokouFWsr1wYs60jHD0dhc1squpMQ:x3+iboodOLf0f0dmmNpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639387672, "uuid": "0c9935db-77ca-427d-a3c7-86eb97f0b9da", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639387672, "uuid": "55385e79-44b5-4d69-86d3-38d2f8035973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387672, "uuid": "43025153-1402-498a-905d-63eb7f779333", "value": "EP40111671A20211113,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899c26be-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408542, "uuid": "a5afa919-7781-4dc1-b5b5-a86ecb84cbc8", "comment": "Malware payload (AgentTesla)", "value": "60b8253c073e08180cc608cdc81eb770", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408542, "uuid": "424fa271-3343-416a-992b-5ea5406abcf4", "comment": "Malware payload (AgentTesla)", "value": "4b4a6652aa65956cf7eadd95c18c29f3959aff4d55af3c1c49aa79fe63ad56e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408542, "uuid": "b20cf43b-8154-49ee-9aa6-b05d7a9f4f0f", "comment": "Malware payload (AgentTesla)", "value": "d832976c6bf62b5d1bd9f31e608b481b01707907", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408542, "uuid": "c27f1da6-8746-447d-90f5-64f159f44311", "comment": "Malware payload (AgentTesla)", "value": "507e86fe7325f193b0295234cdd03bcbb3c7a53e592b07cecc91057db3f7dc67aafc9060502c136fad1c66a31f1ae5be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408542, "uuid": "9ef1ebf0-b995-4083-8f91-44036f22568c", "value": "T1DF55231B32589FB4D04F47FA25B219A587B8E82AB3A2F78C1CC376DA05B5BC543442D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408542, "uuid": "d4a2b0be-9060-43f2-bd77-5edd3ce1ebbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408542, "uuid": "ed43801a-2468-416a-aaf9-9a4323b37670", "value": "24576:B+nvlZMQG2fPCVoOjEUzjJ9dXWsYjymMt44/sDDTrTv2TEbB0WDKSQ:snte2HCVoOzPfdGsoHMm/OTS2MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408542, "uuid": "9ab54576-ea16-4ae9-b822-fe5e9e594f2a", "value": 1385472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408542, "uuid": "e8d22a8b-0ea9-46b5-b188-a33921852847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408542, "uuid": "a9ac77c6-cb1f-4c81-b953-d72e70a5cfb6", "value": "TNT AWB_ CI_IMAGE from TNT AWB# 167095453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e6f2fc-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639395116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395116, "uuid": "8af45860-42e3-4cae-9fed-9b6141232fb4", "comment": "Malware payload", "value": "5687fc1165c2a2b2b84ea3e349f31989", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395116, "uuid": "5a688c5e-9e19-4caa-a6ca-cc0333820d4d", "comment": "Malware payload", "value": "4ba1d6b4cb8e88f510f37d80bf11dafb590581e8902d0599d7dab94b2b46b77d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395116, "uuid": "1a1ca29d-806e-489c-942e-a6a0b8080d42", "comment": "Malware payload", "value": "e35ba1238e3dcddf358cda4c5dd499c5684c9842", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395116, "uuid": "15c44949-fcf8-4bc5-b063-de3cee2cdf16", "comment": "Malware payload", "value": "cba23174d6ea017a888140b24d89e4614eb33765914626f59e0cbe9cf425ba7b446b4df61ddcdc4a2092f62187c6aea8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395116, "uuid": "b633da1b-8292-4a5a-8373-7a4d61ccd520", "value": "T1043122A969174C25755288A7B631FFC79057310513260730B6E2646FF2CA8F0B7623DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395116, "uuid": "228624ca-47f3-40c4-a378-66f6aa69115e", "value": "48:UfJNwRk4E3a9rC7fwsvgrC7t8af/ckoEy3S13:U2kH3ErCDwXrCRJf04y3S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395116, "uuid": "b9206c6b-cc96-41f8-a4db-5fcfcb6f21ec", "value": 1874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395116, "uuid": "20508a2b-5924-4a2e-886a-313dad1197ad", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395116, "uuid": "64581454-c9ed-41bf-9bc4-16215fca2702", "value": "Shipping Document Arrival - Tracking.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75eb097-5c1f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639405210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639405210, "uuid": "1bddce18-0fd3-4a29-b352-3de4bf7be18e", "comment": "Malware payload (Formbook)", "value": "a0d55e0a1d28e681680a6a88700a06fe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639405210, "uuid": "7f61e586-5000-40f0-a648-0f5d4c55cfac", "comment": "Malware payload (Formbook)", "value": "4bc046f4ece9e9cd78d4f9bfb9fc49e3bd458f7d0dee608cb73be6468341c137", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639405210, "uuid": "97dac420-802e-4dac-b5aa-37221cc5c365", "comment": "Malware payload (Formbook)", "value": "23337f670eba5d9c50efe44742b49ab472e78f98", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639405210, "uuid": "c3959671-c1d9-4af8-8dbe-4bd13b8d6c96", "comment": "Malware payload (Formbook)", "value": "0c0760ee44515b989399a914734cb0188a75b78f2e4b4c53888ecee7f1122d5712e3643ea3e566a4111fb6cb0cbd922b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639405210, "uuid": "659f749a-25bc-4def-a992-4cc5275d2897", "value": "T1FD0523128FC06580850799FBD4C7308EBD673EA86D0B028EDE7BC742FA4C8DA854E9D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639405210, "uuid": "9ece6b12-fcc2-48d3-abf2-ed296f3b221c", "value": "24576:PJkohUji339hSm6LhePr0YLq7Z87W9bkfuwvN7+1uI1t:/nS5AT0ZR9auJs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639405210, "uuid": "5f431921-0e60-4260-810f-3cecf070a670", "value": 848960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639405210, "uuid": "e02aa9da-dace-44e4-829a-13febce9010c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639405210, "uuid": "e3faaec8-e74c-4d41-9967-5c9a600cff42", "value": "aaaaa.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84945ff5-5c61-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433444, "uuid": "92d5e6cd-ca24-4469-b153-0a8e56d341f5", "comment": "Malware payload", "value": "047a036d0bb96de7a1b67241b07fa57e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433444, "uuid": "bc351886-e3f9-45e8-923b-b6a1146e4f58", "comment": "Malware payload", "value": "4be9ec9531463b38d7ae64a9eadc41563632c3d72778df4dde0a2d4f37d36ba7", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433444, "uuid": "4c5db408-54af-48d0-84e1-39be7d47ebfe", "comment": "Malware payload", "value": "7ad041335f056618138442c3bdced95092d080d8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433444, "uuid": "b229d46e-a077-44e9-8c2c-2908f228f76a", "comment": "Malware payload", "value": "41d1ed4158685cd24fee9771572b54148c0c2b8784f5f80518821d5248a44b0e00d92428c32a17790c24a4ffde72dad0", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433444, "uuid": "e0cf4a0f-4ff2-4914-afdc-8faec5eeaf09", "value": "T18F642339F90928550B7EC951817EF3B8628468FCDFB4B48FE8F2013866F4B7AA451D15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433444, "uuid": "5e0851d8-f7c2-473a-bd66-b925a3282d1c", "value": "6144:KlJMUYSYJXZ6cZW7Ms1Ki9Jr4oTx29ctID81k1yesYofYA:iJnBgXZ61Q2Z6odAct81hsY0YA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433444, "uuid": "21c896ab-d41a-4283-a9f4-3df39e7932f3", "value": 317496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433444, "uuid": "edfba765-5702-4f81-ab78-9b3378a74762", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433444, "uuid": "cf210ba9-3b02-4f19-93c6-b94c19002bb3", "value": "PO_2021YG1012.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a87339-5bed-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639383626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383626, "uuid": "f1ce0b9c-6fd3-4595-8d6b-3093d44057dd", "comment": "Malware payload (Loki)", "value": "51839d5ecb8c81c99b3e32ab4067e0e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383626, "uuid": "384efa78-3ab0-44e1-afdb-45f7cb10a212", "comment": "Malware payload (Loki)", "value": "4d0349959fb2c6f9213d37e76a6885fab08e2cc5b664c19906c41c2b82c584a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383626, "uuid": "7b33722f-89bd-4ab9-8739-b69b33ed5cce", "comment": "Malware payload (Loki)", "value": "2b15d19a20d2bb9bde8a08e36eae75b3d0f70a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383626, "uuid": "d7033271-0495-4253-bf7a-bd253f428215", "comment": "Malware payload (Loki)", "value": "193326a08e27cba4e94af979a3cb2c2a0130950c79e4f4accb86751aa8cad90b0800e97b3ebe1df5f542e0765ea847fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383626, "uuid": "ca11a71d-b67e-4868-b05d-a1608b02b7a8", "value": "T1F7A4238DB6542D0FDBB45A301877A7F3F37B99E48138152FBB786F0684D538A0602EA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383626, "uuid": "3d9fd4c8-27a7-49c5-af81-d92504fb2c9f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383626, "uuid": "22cbbf7e-b75d-47fc-84b2-e49da14d8be7", "value": "12288:XnyO56TNFQKx1b+tOcueRtdIcDeyinoOXoHR5:XdOnb+tOGCcq3cH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639383626, "uuid": "e807983a-a2bd-4a90-8ebd-cdb96c1f0176", "value": 465734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639383626, "uuid": "983b71b5-9597-4183-b80e-72f30a979971", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383626, "uuid": "f181062b-1285-4675-8fab-b830594ed73b", "value": "SOA Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac1c8e9-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408383, "uuid": "5f7b9ca6-1b16-4349-9564-0aaee0fad29b", "comment": "Malware payload (Formbook)", "value": "44745d37c7b0c3f2b8bf3f49e49b6fa9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408383, "uuid": "83dba9d6-813a-4feb-9111-1ce2b4266119", "comment": "Malware payload (Formbook)", "value": "4d2bdbb88b155c4ac890f127ef69fbc511a4991d6bece1d3354932e27c2fae2e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408383, "uuid": "ba2c48bd-cf83-454b-9fe8-31b9c1311242", "comment": "Malware payload (Formbook)", "value": "d32ae96578d90b42d5c1e7b37a6fe88225e10f2b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408383, "uuid": "d1a8dfee-b3df-4c38-976e-84b99007524c", "comment": "Malware payload (Formbook)", "value": "3e72e35ea496eb4d6e53ed544a06210c11b0e4081e05073cce908a8135333fca4274b16edf6f7da0196f2cfec4448711", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408383, "uuid": "31a94e67-4207-44b2-a7c1-b31da08412b7", "value": "T1FA64127BB9ECC58EE122213BC8072B5D6F63FD277436DA86B0807B18C1BC7805BA5465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408383, "uuid": "ab647701-0bcb-4829-a65c-c10e371ba3b2", "value": "6144:Nbdmsy4aKgAoQTaUBKlB/gyUR1WBJ8wmtl3+W9B+gKy7zERq:NBSxKg11UBaBgTSfmtoYRKcEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408383, "uuid": "425c3d2a-3d2c-40ca-9e51-d292de865b94", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408383, "uuid": "23186410-668a-4e8f-8d09-eeda3ace442f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408383, "uuid": "055396fe-3911-4db2-b189-71442a1c31b6", "value": "Item No 31111.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6eecc3-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386835, "uuid": "5c327bdc-b2cb-4293-92c6-8278c9d396f7", "comment": "Malware payload (Mirai)", "value": "2ba0902f31e9b13e12601cabfb83a3d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386835, "uuid": "13a93759-6ed1-4b9b-ae43-f4de489aed3e", "comment": "Malware payload (Mirai)", "value": "4dfebbf3b3b034b747fe1399fb2b01d507c301ee2d7794cbc536a3ab9ad3506b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386835, "uuid": "a12340bc-b655-47e7-8c19-b9349ac6d7ec", "comment": "Malware payload (Mirai)", "value": "29531804f4c6d82d9749bb1ec28140107868ddf9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386835, "uuid": "83487ab6-d196-459f-9b77-3735b6997e3c", "comment": "Malware payload (Mirai)", "value": "4ecefc71b58ed63f61b508656a992af3e3de8bf0cfff840f7544f2b2387baa6f2cc0c7ee64a1954b7c0a376d173c0170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386835, "uuid": "b5c2b4bb-b36a-407c-a7b2-04cbb9bebfa6", "value": "T1E0A30896F800DF77F40AE67604D34B25B670BBE14E532622732739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386835, "uuid": "25d85ae9-18bd-479f-83bb-eb348ca2244d", "value": "3072:pNerWBIvC/IymEdH8ffNBOKmuxVqDr78fz1e:pNerWBIrym+89BOKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386835, "uuid": "e0657ed6-2a27-434e-a8bb-4bd0b1789fc7", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386835, "uuid": "e8d86538-4d1b-41f7-b879-1005cc94e3d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386835, "uuid": "29455f8b-29da-491e-9d67-d1d8447a85f6", "value": "2ba0902f31e9b13e12601cabfb83a3d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cd46f3-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425989, "uuid": "ab57110c-b40c-48ea-b810-99eedc6bcd49", "comment": "Malware payload (RedLineStealer)", "value": "13f72892f4e329ce7feea8567fec20a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425989, "uuid": "b45b0888-6350-4cf8-afad-f751c46978b0", "comment": "Malware payload (RedLineStealer)", "value": "4ebd7dfe64f723af52e2991ee85ad2d173266e2b5df8b918f8ce052e43c1c96f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425989, "uuid": "9a5135ea-99c2-40b6-abef-94d850f91e4c", "comment": "Malware payload (RedLineStealer)", "value": "12fc1c3b91c53bf5aed7c3789ac94eb4840d555a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425989, "uuid": "da5be40a-2a4a-4f53-9b4b-143b127c3347", "comment": "Malware payload (RedLineStealer)", "value": "753e73f6448bda83718cb284f33567658a8b0956aa493d594c4e84ada7460074bc6bdbb135174889f1f406facac05fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425989, "uuid": "e30c58b4-e654-4a63-9314-76855dedf5c2", "value": "T1B464E1D135A0D872C2A329319870CBA44E7FB9F1FA70914BB7742BAE6F776D05621312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425989, "uuid": "5d74a5c3-ece5-4f1f-851d-5b178099d5c0", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425989, "uuid": "882c4f26-bbfa-48d3-96a1-c42ce51c41cc", "value": "6144:Qh7MbIweOC1EtsGjDoe6trIMrGrDyBG1osX9Ob7ITsqJ:QRMSEJford3rCuD8Q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425989, "uuid": "1595f770-bcbd-4dde-aa91-9049c1e4eb7d", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425989, "uuid": "936c8d86-e667-4bc7-b200-9879613ccb3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425989, "uuid": "1adf547d-879e-42fa-b036-38bfaeaed17e", "value": "13f72892f4e329ce7feea8567fec20a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5541d5f9-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639414038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414038, "uuid": "d5ac9236-1b25-439a-b063-460a1afd5d82", "comment": "Malware payload (njrat)", "value": "223fe0971e3093c48957b34f5f7e5d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414038, "uuid": "11a4d547-3950-4e1b-9fe0-d9152b99af2c", "comment": "Malware payload (njrat)", "value": "4f26208a480c3c01ee313f6b8fa9f6e132ec02ab3e179600f0bb965f97cb610d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414038, "uuid": "222a2e6e-1e87-4ebd-a27c-519ebce4bdb5", "comment": "Malware payload (njrat)", "value": "1355cb6ddd9d1f6098cc48f683d154c46cd61a64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414038, "uuid": "de43ef63-fc59-411a-889c-1b7865b1bd7a", "comment": "Malware payload (njrat)", "value": "31bff3ea8eeb2b079b8b185fe0e1c2549a244b8d4e7ffa45dab8334a1a962640be40c38a1ad537d63c5227cf5507b130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414038, "uuid": "d42f4735-19e8-45ea-b5d3-e2999d4575d1", "value": "T16093E84977E56524E0BF56F79971F2004F78B44B1612E39D48F218AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414038, "uuid": "bfd24e7c-ffde-4c57-b033-ea388bd43f51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414038, "uuid": "6281a714-bbcb-4e6c-b548-3f46ea930598", "value": "768:rY3/65hWXxyFcxovUKUJuROprXtwN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3usGdp4gM:a6HWhIUKcuOJnPhBjEwzGi1dDKD4gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414038, "uuid": "42401f7d-1374-4939-abaa-5aaf0419830d", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414038, "uuid": "a11d1083-a2be-41c0-a5b8-3b53f26bab33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414038, "uuid": "3b3a89c4-9698-486c-8701-31ee038f7b56", "value": "223fe0971e3093c48957b34f5f7e5d57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fa75fa-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426112, "uuid": "f1735ad2-5aac-4479-a798-87d99b486194", "comment": "Malware payload (RedLineStealer)", "value": "a8aaf380bd17bb07032a47fbd3ef277f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426112, "uuid": "25bb73a5-c4ac-43e3-a6fd-e8e169032250", "comment": "Malware payload (RedLineStealer)", "value": "4f941f52e17cd7ae054b7ff995cee4dbd5c2181001e997577d4e1f24f1e980a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426112, "uuid": "78bec643-1f4d-44f7-a383-e66fb199f1f2", "comment": "Malware payload (RedLineStealer)", "value": "f475fce4b83b0a2b317b4a541c3788205a835804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426112, "uuid": "726ffd6d-c5b6-4a1f-9134-c65afbdacba8", "comment": "Malware payload (RedLineStealer)", "value": "e42b6ddf8fc911a0544ca217aeacacab1aaea865ebee9adc0641671e38afb88d30b79568a217bcc73804d2ffc362aa43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426112, "uuid": "64fce7c8-58de-4b6a-a826-6373af6c6cf9", "value": "T1D4B4F72839FB4019F2B3EF759BE4B5979A5FF6633707A15E2050038A4B13A81DE8163D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426112, "uuid": "20caf9b9-7aa2-4be9-971b-e27091260716", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426112, "uuid": "75811ea2-f73b-4abc-adfb-9a8eabb40ad5", "value": "12288:xF6ttSucPBXPRdKK4r24w/kKtSpufHLovj5COAzZ60t6G6kJ:TckugP2/lFAGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426112, "uuid": "c23149c0-eea8-46f5-a438-9c79b76f9b58", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426112, "uuid": "173161ab-ef5b-4cb2-b080-f84212f10cc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426112, "uuid": "4e9ad9fc-906e-4a1a-8c04-507c77837164", "value": "a8aaf380bd17bb07032a47fbd3ef277f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5308d460-5c1a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639402867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402867, "uuid": "97f2c746-71a7-44d8-a3db-64f4b56b3520", "comment": "Malware payload (Formbook)", "value": "2322588e2c9c29b510555a0eebb3d890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402867, "uuid": "28997808-d7d1-4d0c-87fc-b1154fa1f991", "comment": "Malware payload (Formbook)", "value": "50621d72fe37e9c85fdffca11257fb4c132fd20e6075fd0f2c853c3f7fb23721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402867, "uuid": "eeb7c816-01b0-4a2d-884d-ece684b16f2e", "comment": "Malware payload (Formbook)", "value": "3272bd75c52c15ea35a1de14e459f1c39e199902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402867, "uuid": "a5f6d97f-5baf-4ffc-860a-8474717bd923", "comment": "Malware payload (Formbook)", "value": "50397049c5efecda5858df2f996233521026d3a6d7235fe132b9c1209ea776e0500ee8370c73b2ee33e367aecfc74e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402867, "uuid": "4cf514b7-a6b7-44f4-ae54-318be0533672", "value": "T15AA423063F80F4B7D8D18E7015516B7E97BA916C56021CF71330FFA82EC5E9A249EA89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402867, "uuid": "fa23a973-2607-4616-844f-4d1eda211752", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402867, "uuid": "cc778e09-e977-4f1c-a622-08d28b660e62", "value": "12288:jgPOZNe/p5KDZLk/NSeAMau++xGQj14t+wD7VCz8jn4LDJx0:0ae/HgZLklpAMauvkY4txQz8sJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639402867, "uuid": "6c5c69ca-4b63-4eb0-9d91-ffdeba6c40ee", "value": 472868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639402867, "uuid": "a4c3d60a-e0f5-4087-ad56-a33da47e1de7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402867, "uuid": "222f72bd-c754-4521-9b78-a7495d829a3c", "value": "binjuju.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b92ac4-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426042, "uuid": "491d7895-f989-4962-88f5-171064185dec", "comment": "Malware payload (RedLineStealer)", "value": "0c6990c3796276b9f571618cab1d722e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426042, "uuid": "1c78e0d1-4256-4ec6-a9a2-ccf51f9d9425", "comment": "Malware payload (RedLineStealer)", "value": "50cb0b1096a587e8cd09950357d17a6257c0173a8e3b2c9f803901d695b2233c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426042, "uuid": "c722bfed-b027-490d-b91a-9de90d59de58", "comment": "Malware payload (RedLineStealer)", "value": "2228c0dbd4293139f03e580631680faac5200824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426042, "uuid": "b0aca7c5-fbeb-4905-a2e9-d4db5b902d72", "comment": "Malware payload (RedLineStealer)", "value": "97c57c9bce320fddcc5110b163b7fc812421ee376dc3b7426446c87f76c782699cb78116b3b2de5cda033ed319d2c832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426042, "uuid": "2b0ad9d4-6c04-4288-bbde-b4f6995adea3", "value": "T1B564E0D071F1C872C99278F69829EBE42E7BBD51D970490A73782B9F7F722D05A21312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426042, "uuid": "f9fda9dd-c0e3-415a-a61d-1c77c7039d41", "value": "16daddd238d0a16baac8dce0ea4061f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426042, "uuid": "b10ee660-88b4-4327-bddb-132769202be7", "value": "6144:FFhpWh6+vT3P9EGtpvf20pHk5cv8xWoU14Xr3Kub7ITsqyV/:FFW4+bfCU2wEtOarh7HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426042, "uuid": "7b87e1c6-7e51-404f-bafd-90c23f008f02", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426042, "uuid": "811b1a5a-62a9-49ea-8890-db272e71c97d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426042, "uuid": "218f14e4-8700-4180-8e53-e970f5a63bc1", "value": "0c6990c3796276b9f571618cab1d722e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d74753-5c13-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400073, "uuid": "8500bac6-583e-454d-9177-44287e49643f", "comment": "Malware payload (Mirai)", "value": "1c048c2557b840628e388871e5b890c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400073, "uuid": "e04410b7-8837-433e-9e00-61971aea1035", "comment": "Malware payload (Mirai)", "value": "50f794f4493712b8757b15fe24cd83b601bc9cece734c94eb9b3c76a7ef75418", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400073, "uuid": "c636c657-3c1d-40be-8a66-b09a8b608382", "comment": "Malware payload (Mirai)", "value": "ccccb28f8808bda4a6e3fc81edff1e380a6d7ca8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400073, "uuid": "2fef36c3-95a2-4c7d-92f9-dffd7e7e94dc", "comment": "Malware payload (Mirai)", "value": "4e582871737e18873040159344315eb3e7b5fc76c53c37cd8f784d1c0d6f289e2ad5f93043e50c6ce64b91b66a6eb812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400073, "uuid": "18e3d34f-5efa-4ab6-9efc-ccc209ee926f", "value": "T104F2E1B2A3D194F1E7B15C72ADDC04DDE27E35B8E5C021A478618F7C0AE85862EEF451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400073, "uuid": "9ab63028-c833-46c9-9d0d-5894527e58cd", "value": "768:G0Iecs7AQTtD9+qP0Xpp6ZeNrl65a9xmM8c3U5:lZcJeN9+HXpPNrsGDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400073, "uuid": "ca11915c-c4d7-49d6-bafa-ac1c67c2535e", "value": 37452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400073, "uuid": "82dba855-5fc1-44e3-be8f-dcbed3de499f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400073, "uuid": "d77c2cfb-308b-4371-8dfd-a62ba22002c3", "value": "1c048c2557b840628e388871e5b890c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065c09fe-5bec-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639382981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639382981, "uuid": "9c832526-890c-4a5c-993a-f901cc06f6c7", "comment": "Malware payload (Heodo)", "value": "9a74ef879f2228f3153edcfee50f94fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639382981, "uuid": "98b21986-164e-495b-b23b-502946e27a53", "comment": "Malware payload (Heodo)", "value": "512b56f2d3116e5fb77ebf2c89965c5025786e1f17d13238b01097e46ea1e319", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639382981, "uuid": "04d834dc-fe8c-45b3-99a1-349d61448abe", "comment": "Malware payload (Heodo)", "value": "5cdb75e021ef32886f1404eadefbff034caa8059", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639382981, "uuid": "be2be2c6-5e7e-48ff-91b2-4bfe212db375", "comment": "Malware payload (Heodo)", "value": "3a828cab6e3376308221f28b004ab95b2e6de43e4faa34fa15adfc43102f7a148b0c51b2923ee6ca9a0234bb79227195", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639382981, "uuid": "362eceee-6dd2-4543-80f1-3ea7226de9ab", "value": "T17424CF10A540A136E9F314BB86FED57A8A3C67600B8465DF83DC6C758FB56D1BA301CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639382981, "uuid": "9f4ba943-643e-49dd-bf79-46355297d0ff", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBT:6jIG/pjjuLbJLmGshoCUnWTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639382981, "uuid": "8a4dfc4d-5464-48aa-8099-a21efd3e2146", "value": 225427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639382981, "uuid": "8b90a7b8-548f-4ea0-9e88-f891ab06bf36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639382981, "uuid": "08282898-6034-49c4-9d06-e37dae28dcf8", "value": "emotet_exe_e5_512b56f2d3116e5fb77ebf2c89965c5025786e1f17d13238b01097e46ea1e319_2021-12-13__080936.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acae5ce1-5c18-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639402158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402158, "uuid": "36e44d90-311e-4233-99f6-8bf28ed72f22", "comment": "Malware payload", "value": "c07ceedb56ded8c747c01262849c4492", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402158, "uuid": "dded3b91-12c3-481e-b52e-c3b92706f94b", "comment": "Malware payload", "value": "5252a1d85841381ef3e4d9370444694f1e3758fc7973764cbe05e75964aacf3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402158, "uuid": "b8dffa3e-5796-4741-8445-6b3bdfa0a9f2", "comment": "Malware payload", "value": "c81eecf5cce9abc9dc0fdf81c70e4de08701cbe4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402158, "uuid": "e8623727-5938-4abf-b11f-ef925347a86f", "comment": "Malware payload", "value": "570dcc52ad330f5c5b04ba2db02911508e237bdc5490e9ec8055139b486070a1670489445ff013e467ad7127992a2796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402158, "uuid": "582ae5fb-23b2-4649-96f9-2f4ad594f723", "value": "T1CFC4BE5D34D7D6CCF87AD7B53B65719403B5ADF2E507E2CDF898344B4823A807A222A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402158, "uuid": "83b5712c-acbf-4703-8926-9a093cf9bddf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402158, "uuid": "67753832-9bc5-497b-b23c-3aa1e6a5ef21", "value": "12288:/9WfOeVlnICK/i1NpdEZ6dyiUeA2seexxmOyRpP3N8hvA:iOknIdCpddceA2RexgOyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639402158, "uuid": "5cd9a7d0-362f-4748-b499-16cabbc04aa4", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639402158, "uuid": "f4fe7b75-0b0f-4e4b-8582-aafee26b29ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402158, "uuid": "f92500ca-d49b-4a5f-92e6-58394a3d74bc", "value": "c07ceedb56ded8c747c01262849c4492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3afbfb-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639426156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426156, "uuid": "36e79a75-d14b-4cd1-bae4-15c8eae15282", "comment": "Malware payload (Vjw0rm)", "value": "d3d3edd039a3e591e822bb981e7e1fc7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426156, "uuid": "06c2825c-f781-4bec-b39e-02ced627ff35", "comment": "Malware payload (Vjw0rm)", "value": "528452ce702d1bc05f0c968137625ae1518faf152aeac200948e39974c6ef4cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426156, "uuid": "7fa62a03-799e-4001-9f5e-b0902fe8dca5", "comment": "Malware payload (Vjw0rm)", "value": "dc79c1c6268f32dbe746394868db3d23bd4e4126", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426156, "uuid": "6e191b29-6f78-4558-94fe-bb1f5b1d9da4", "comment": "Malware payload (Vjw0rm)", "value": "088382d14e0e015acc43aac3fde5656cba7a170aae90d8fb5068bde24e0b67397d6f82135d84ae5dfde77bddafff4700", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426156, "uuid": "7316d268-d52e-4339-a86f-3f8b5795ecf5", "value": "T1E3647D90FAD0657AAA8664E754EF630F23B8A15375019049F2D1F6302FFBFC0961BE16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426156, "uuid": "a5315ed8-0044-4324-b376-b0dca0f4284b", "value": "6144:OaLfslZvvb4tNj0ncIQFZ2DWUolx++3PgMaoXn:LV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426156, "uuid": "f4130df6-1aa3-4c51-99bc-b8d8c2080cc5", "value": 314721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426156, "uuid": "237c3359-6a65-4e8e-a50a-4d3ad7b60169", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426156, "uuid": "71ef3409-4f2f-44b6-8b77-f051c7724e81", "value": "Order20827.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1eb9440-5bd3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639372612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639372612, "uuid": "5af9c4ca-4ffb-4f7d-805d-111c4312bed2", "comment": "Malware payload", "value": "1ab294056a88af28f4fb34c569896d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639372612, "uuid": "f51d74fb-e879-48ca-9f23-77709d3cc8e4", "comment": "Malware payload", "value": "528c9b116c4ff8b5050c3ccdaece07f61072fc311e6620c80fe228669b999f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639372612, "uuid": "5b035617-f16e-4cfe-83ed-2021432d028c", "comment": "Malware payload", "value": "d51a1781a98e40d2d81c4663c35d78bddf1c6760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639372612, "uuid": "75b3fab3-9b7b-4099-9079-43b78a81e36f", "comment": "Malware payload", "value": "9e99d4cdba1304ecf8ee2fa13809428cfc27203c2ca5c499bdfd7cb203ee5484263ebdb233b29cbcd517e8956a6541d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639372612, "uuid": "514bc35a-0bde-47ac-82d5-2c2ede702b70", "value": "T139F4BE6E38D7D6DCF836D3B63A72A0800361BDF1E157E1DEE994311B4827A906623673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639372612, "uuid": "f5024ae6-181c-45c2-97c3-1b0b1bdc76a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639372612, "uuid": "462271e4-d901-4a4c-8ad6-896291ac8b5f", "value": "12288:MdIXe+TCnIGFgHNjd8n74ftEDm8+gi5a/b5z4SdoVm2tXBcttttxtttOIeewsfpX:FeZnIuKz8n741gF8zFbLIusQUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639372612, "uuid": "0481f8f8-daf7-4035-b868-045e55cd6fe3", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639372612, "uuid": "112db56e-e0d5-4a84-a5d3-53831083cf96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639372612, "uuid": "0fc66218-8ae2-4e59-844d-e70b1368bae3", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf90b1d-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639388413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388413, "uuid": "838a9787-f13d-4711-adbf-9dcdb8852856", "comment": "Malware payload (AgentTesla)", "value": "3ffda9a6d62ab8d4aac598457a08f730", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388413, "uuid": "11eb84c6-b6d7-4fa7-9468-9599c038c581", "comment": "Malware payload (AgentTesla)", "value": "52ed1f55fc478480a57ed96fe586bd3625f92d09937375b36bb2adc5ff5b09f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388413, "uuid": "1aab343c-f433-4793-a1cc-e101a0cd4a12", "comment": "Malware payload (AgentTesla)", "value": "300913dafafa4bb2d36a3b7074153da3c41e135c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388413, "uuid": "0cca3624-e514-4093-be74-0d16c057d1f9", "comment": "Malware payload (AgentTesla)", "value": "fd621860be6a86503ed4a51349a81a22015dcf08e0a3138bb4a7cc280ab2fa60472467b63eb6cfa98760c28a4c756d16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388413, "uuid": "b31b9299-4d0c-4b57-80a9-b92d8b574f49", "value": "T1AA440286E7D24383D25AAAB6706343C317F6810D3DA217960CE431AE0D9F7D97647ECA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388413, "uuid": "e5761896-f8eb-4f9a-8645-0fca31558fad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388413, "uuid": "f3df6656-6b22-4a4f-b57d-e90c0363a40d", "value": "6144:vnCEqcETdcgxQkgMAOp8uIjLQZOBPz52YkoJ8L:sn3ek7AOvyLQZOBPz52B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388413, "uuid": "1aef1c28-9ce3-40a5-a8a0-912ab1ac8978", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388413, "uuid": "ee786595-0f12-41cc-8da8-46fd9e927bbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388413, "uuid": "a9bf940f-3af7-4a50-93a9-b4679308330d", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9764292f-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639408565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408565, "uuid": "f3c842c1-cb3d-433b-ade5-1dfef2576da8", "comment": "Malware payload (AveMariaRAT)", "value": "e4e0323ceba11b181c22244fd6008f1a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408565, "uuid": "3033bdde-3da9-4997-972b-db0cb0ea8ebc", "comment": "Malware payload (AveMariaRAT)", "value": "5487c1ef902810f3267051bc4e38f25a4d57683568e8834a8451b92e97976f25", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408565, "uuid": "4fdcf6db-85f8-4617-8c39-cd57a344ce34", "comment": "Malware payload (AveMariaRAT)", "value": "d731a81cc0358ae48c36fd6ef501a0936e2d6177", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408565, "uuid": "b753be32-868f-4f52-9e6a-804f69d2ea95", "comment": "Malware payload (AveMariaRAT)", "value": "1ab33f3b68b274170c8718a6f5ae39e0b3f2e362c9d592a270b195d393561647e4f5588a169591c8d6ca333bba603661", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408565, "uuid": "b8c7d903-9ec1-499d-8c65-bac86f0fcab8", "value": "T1F2742357B5C5AEBFF2930B341F36B635E77E59C41105491B87961F4ABE822CACC02227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408565, "uuid": "ec6534e0-48f6-41c1-aae1-f6821b165f0e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408565, "uuid": "067020b1-6b9c-4abb-9540-d1d7f25179d5", "value": "6144:rGi7tgKDVsV/W6wePqcxG0BtAxVPd9ZqBI8faMdD13kdEqvXpERiuDj6m7:dTDVM/WBek0BiaGYKy0EF36i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408565, "uuid": "51c03326-dedf-4ecb-875e-be124dbdb049", "value": 363252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408565, "uuid": "9a5df35b-46c9-4af8-920b-99bf52ce8cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408565, "uuid": "28508b4b-9acd-4389-895d-83da0e550a9b", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04612a2-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355805, "uuid": "f09246da-8a06-496f-9d0a-b4e27c760202", "comment": "Malware payload (RedLineStealer)", "value": "085c58a76a19563771c1fdbd2d820541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355805, "uuid": "0cd26cc2-4f2a-4fef-9502-8ec029d6d245", "comment": "Malware payload (RedLineStealer)", "value": "54afccc5e077a7d98d31be5df1aa56e64e3b8eff2c006d1aea1dbe6dce2398d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355805, "uuid": "b9ec0698-bab9-4d79-9cb8-173cded56d43", "comment": "Malware payload (RedLineStealer)", "value": "9799f20f53e3bf8e865761425c6b0ae6deea257d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355805, "uuid": "cee09bce-732e-4aaa-9885-37a7a025f308", "comment": "Malware payload (RedLineStealer)", "value": "276b1bd64184c9e11e0c82931fe078eee99045e4988f82f94c40d675e241f83bed57f6cc62cf86071a399a11998177d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355805, "uuid": "8fff40f9-2f82-4b1d-9e4a-b203bc921700", "value": "T13A653360F784B10EC1AD76F15E63131903F65D953AC8A8EEBFB512E102994A9D328F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355805, "uuid": "4367c7f1-6b5e-48e2-a0d0-aa96f3fd6dbb", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355805, "uuid": "9a847857-8205-4f50-9655-476f4ac8276b", "value": "24576:D+N15VNjIRL1Xzt5gc9UWThsuKBxWAkJVBuOjFIz5pgInTSV6IkEaHNYK3t7oy3D:D+NpNKL1DR93hj9Akojj2V6INavU6NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355805, "uuid": "2b8decb9-a06e-4951-ac1f-5b0ddc969a63", "value": 1414904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355805, "uuid": "d3c199e9-dd06-41e6-8dc3-d9c64d05c954", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355805, "uuid": "f84e50ab-dd21-4ec8-8bfc-1655178436d8", "value": "SecuriteInfo.com.Trojan.GenericKD.47633255.31324.21633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f059c9-5c46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639421661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421661, "uuid": "db970165-abf1-4bf8-92e7-b5f5c735c086", "comment": "Malware payload (Vjw0rm)", "value": "422a51830d190a1e37b9a45c05ce539a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421661, "uuid": "9fa5cb0d-1318-49d2-ad3a-9d15307de470", "comment": "Malware payload (Vjw0rm)", "value": "54b582961ebc52c5017f65743f7e96715ca76ac77a285708f33e76cf6159cecd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421661, "uuid": "5e1ed0c4-182c-449d-ae29-3d1743e24b4d", "comment": "Malware payload (Vjw0rm)", "value": "022c845c213e2cc1b311e37a1ee9eae32410441e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421661, "uuid": "dd8bd050-11a9-4612-907e-ad800122f587", "comment": "Malware payload (Vjw0rm)", "value": "904fc9bed5a879183a878df2959c340c7be2c5e7c11eb064e5b343c2e26b35fd7904324ffaf54f42b37b4a9496ea9e3d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421661, "uuid": "c44fac80-895c-4975-ab11-a8a165fef442", "value": "T1CA12BF8F27C650B244834708CA4BCDAC7F794DB09480FB7545C6AA4E34F2E2695F395A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421661, "uuid": "e2d059f7-2bc0-4bc6-a0c3-fd0389bc6732", "value": "192:tq17hrtlYa6IxyD6StNkfDk5h33lZTdcVFgnPPcpG6iZsN:tq17hZf6ND6uifDGhlZmFWf6iZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639421661, "uuid": "050d83b5-57b0-4ee3-a09c-5ed4c2cddce2", "value": 9577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639421661, "uuid": "d946f39a-0c3d-43a6-ac9b-8c37501c1e62", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421661, "uuid": "cbc8845e-3b3e-4243-9a98-f6004fba3363", "value": "#00957.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381362c3-5c06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639394232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639394232, "uuid": "d0b7d179-00b7-43d0-904d-dd4ed0b617b8", "comment": "Malware payload (Formbook)", "value": "6bf6716cac6d17349b421a39a264fd31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639394232, "uuid": "2334062c-c3c1-4823-b7c4-1e276c892c72", "comment": "Malware payload (Formbook)", "value": "54f23ae0cb97a0c71ea4c016cda34864398ff3d5939197eeada160d89f230ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639394232, "uuid": "44194443-e776-4571-8ea9-7dfef7b8aa49", "comment": "Malware payload (Formbook)", "value": "9a3d2c0c3a2f903417c3a541a5b8a6e0faab7b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639394232, "uuid": "731151fd-93a9-4587-bb92-bebf5c648a07", "comment": "Malware payload (Formbook)", "value": "1c71c1a74b7b9d4e3036ead20b5a799a175fafd443adb1fd76d631fe0e60ff945bd0af7110a57f5c82f34cd7da08880b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639394232, "uuid": "b659a312-c58d-4c85-b35b-e927f20b09f8", "value": "T1AD45230B3FA48320F03D07BC51E45A4152B545397E16F6AC0DEAAADB37693E2C6259CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639394232, "uuid": "66a03a31-4702-4b71-9fc7-e260d0eb26f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639394232, "uuid": "12c53a58-e655-4376-86b2-6ec3418e6c56", "value": "24576:Kl7J/hWTNhsVfyIULx51/GnO12gMUldKfNuLhk:2lsNkfyIULxCnO1jMaKfNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639394232, "uuid": "12aa19b1-53ca-43dd-b070-6185621ffc7f", "value": 1258496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639394232, "uuid": "be57adb7-16d4-4c44-a7d2-45f0016fd73e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639394232, "uuid": "b180a959-0b9a-45b2-bc8a-c6eef8b822e7", "value": "PRODUCT-LIST VACUUM BREAKER VALVE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3146f43-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639415591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415591, "uuid": "30a633f4-7637-40ab-b642-12b75c559ed5", "comment": "Malware payload (Formbook)", "value": "4d50ca07e1bc5f7ea745cc7e01f8e9ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415591, "uuid": "792291b1-42d4-456b-be1f-b5a404f3902c", "comment": "Malware payload (Formbook)", "value": "55028ddc6704717154ae4a43603da57d1099caee821c64c92722519f00c88e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415591, "uuid": "5dadf0a0-79ea-47d9-84bf-9f3d54da5f6a", "comment": "Malware payload (Formbook)", "value": "82018de19c15987527ed0b063393863561340ca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415591, "uuid": "ef9c992f-2626-4ef9-bf97-50d7d67e0654", "comment": "Malware payload (Formbook)", "value": "42c68ef49b9db0b724254b0db0437ce87b76837b1136dad0b88032b85f5b91debaa8fbc18336709bc7978bd3eba4715b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415591, "uuid": "b3eb3428-c579-44a6-8cd7-2724af7026d1", "value": "T16A5523023AA48A22C66C5B7DC9AF512003BC6A4A3EF1FE9D7CE773C675263D145146E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415591, "uuid": "c4d90521-e0da-4143-be22-705e3b4d6ef2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415591, "uuid": "c65e6d5e-9949-4f85-b92d-bb40012c8ade", "value": "24576:9ZSidKFBjDAhQAGHf+LYm6Pj6W5nwLfd9bbv0mOv16m0pNqAV:Ddd0BNAG/+LBmGYnwDXPMm+1cpNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415591, "uuid": "c9cd873e-00db-4490-85aa-0a0a305c429e", "value": 1321984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415591, "uuid": "9260db06-385c-4fad-a38c-ea1dc078cc37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415591, "uuid": "196f94aa-23b9-4d48-8f1a-86b3485993da", "value": "4d50ca07e1bc5f7ea745cc7e01f8e9ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e3e9c7-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639415300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415300, "uuid": "93b20332-7d8f-427e-b4c7-4acac4e93136", "comment": "Malware payload (Smoke Loader)", "value": "88efe3b315749f26e060075c0defad08", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415300, "uuid": "81f2f2ac-66c5-4279-8d5c-20eb9a6d9b8b", "comment": "Malware payload (Smoke Loader)", "value": "550e4267d7c73ab5a829721af8699f3b629865841f0feaf512e6048cb85fc604", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415300, "uuid": "d1cea803-cbe0-442d-8e16-79fa41b7f533", "comment": "Malware payload (Smoke Loader)", "value": "757e7ead7f7ac618e13d74e40338448336794de3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415300, "uuid": "9be3683a-5215-4f99-88d7-2f8252895435", "comment": "Malware payload (Smoke Loader)", "value": "dd6e0e4e9c391430eac6322db39c8c4df0f6da00ca554d99c8ea450f107357f084a399ec8b5a541bc312ab8382c6f868", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415300, "uuid": "9e44ca00-44b3-4195-b93f-0fedba3586b9", "value": "T153148CC175D0D7F1D6A33970B860AAA45E7BFCADDA20444B327827AE2F7E3C05925352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415300, "uuid": "dc879395-c2b2-45e9-9ae1-2ec9117628c6", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415300, "uuid": "d3cf5092-ef2a-4f94-a779-9090d0b32c6d", "value": "3072:8t0BOM/axZp0iPIb75GcyAx/qnU59sohsZVggjcGkNIVqIZh2:FH/axZp0iPXJAxMTb7ITsqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415300, "uuid": "332196db-7b77-4eaa-b334-38708df1d78a", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415300, "uuid": "ffb4af25-d51f-4a21-8091-c6228c7d23a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415300, "uuid": "2b1232d0-7cae-4838-ab0d-94d2e6d52d6d", "value": "88efe3b315749f26e060075c0defad08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2951bab-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639408664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408664, "uuid": "0cec8ff4-c472-46ff-8831-8b30111b9eea", "comment": "Malware payload (Vjw0rm)", "value": "87abfdba2290a31df0d97e91cc4b1195", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408664, "uuid": "ae229925-a153-426e-bb56-25dd1661ece3", "comment": "Malware payload (Vjw0rm)", "value": "556e3aa4f1bdf16c72a2ab22884b935936386f69ca4977a6e815bcc1eb3b9408", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408664, "uuid": "06748002-e1b6-4191-90fa-ca76cae2555e", "comment": "Malware payload (Vjw0rm)", "value": "04ccec1a839efb216cfab4c6bf35e25b1b320157", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408664, "uuid": "dd3d00bd-ecc6-4e72-84da-7ebe3d9a1549", "comment": "Malware payload (Vjw0rm)", "value": "e7de6976ee337ec15833be3be8c41b06e55189a348fa2375ebd9986fd808a2ae66a4228a8e67d605e09f2142a926f00c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408664, "uuid": "9354a1d0-716e-4351-93a4-7786baa06c21", "value": "T189B49ED0BAC034BA699A29E317BF120E23FD524B7144D049E143FD642EEBEC8A717E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408664, "uuid": "fd362929-485c-4c8a-b53b-87214dd32151", "value": "6144:OaLfslZvvb4tNj0ncIQFZ2DWUoyYOQ8Qo56OVLaMRGNoFJJ5Npvuddypko9Fku/p:cGykmf5NcdqkXG/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408664, "uuid": "f28c8a23-9643-49f0-a95d-78e1d2b9fd92", "value": 503025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408664, "uuid": "68383584-8f49-4179-8589-3d3d3598d5ec", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408664, "uuid": "dd78fdd6-e378-41fd-bf00-cbf3741bab07", "value": "SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fd1a64-5c18-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639402149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402149, "uuid": "05a7d318-3c49-422f-b43e-fb41da9b8e71", "comment": "Malware payload (Loki)", "value": "d9d128bf333d3259618197d10c1d4e02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402149, "uuid": "331862af-f5be-449c-9f6d-51009cd8e4a5", "comment": "Malware payload (Loki)", "value": "565019514aad9fd425d39f381b67cc52e4de4134f5d038fabff1ce2a08c3866b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402149, "uuid": "74e9db78-fa79-41db-9214-d081680382b5", "comment": "Malware payload (Loki)", "value": "c79da654869c2a4db3e45b7b9d4b51059937a693", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402149, "uuid": "bf423e1e-83e2-4ba6-b2a4-bfc2aa887a98", "comment": "Malware payload (Loki)", "value": "3c6d2bc8758e3d3ca6e39773d4c9e327432c0f3eb7673d1924c3389d6794df6dbbd380ac455c9999d254af80a4de855f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402149, "uuid": "ba28a362-a80b-43fc-9ada-28eebece04f5", "value": "T16AA4DFF0BB83C118D0D1CABC1859DB515F37848B43D22B227F1FEE68D89B16A3596AD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402149, "uuid": "58347637-8db2-4508-a1c3-d17989ee6cd6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402149, "uuid": "29cb41f0-82b4-4c74-bc31-8f469747a4af", "value": "6144:TGiBHz8ZX685hNuRc9DuAeyrRtmNoVjqhpBuG4V7cJyri/kHhqDoppJFHwGrFlD4:WmqTe/kBqkcelq2YQZSSyTQeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639402149, "uuid": "1bd8706f-dd3d-4108-ac5d-253743c0b252", "value": 480128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639402149, "uuid": "7574b1ec-4c22-43f5-be18-082bcd189711", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402149, "uuid": "05e2071e-c6f4-4441-a170-616b2facdc48", "value": "d9d128bf333d3259618197d10c1d4e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446d5f7b-5c46-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639421740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421740, "uuid": "fe83c33c-d04f-4c22-b8f2-c5a98e6f41ba", "comment": "Malware payload (RedLineStealer)", "value": "cf9b65f6d5f2ade5d2cc53b0455828bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421740, "uuid": "0f2d0736-4688-48cf-9051-952d853b70f2", "comment": "Malware payload (RedLineStealer)", "value": "565c28d07068af2ed6afd5ccae4a479b881471ed14fe0d5f9b3b3b2a9d8a1b07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421740, "uuid": "467e6547-1053-443b-98c7-9d5d25d45136", "comment": "Malware payload (RedLineStealer)", "value": "dc299f2a76ce5123f1dd17a5e5f853566976ae20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421740, "uuid": "b0e6296f-52d0-432f-ae13-b0add59ebad5", "comment": "Malware payload (RedLineStealer)", "value": "e080000f29ad6256ba95afce2dfa28a95cd1064fdeb3b069f2748bd36c2604b7d74818a8554edd8d122abc297b87d206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421740, "uuid": "29f91311-54b6-4f5c-a773-d295087458bc", "value": "T1DD6533DF93887FA1C708A6F1084DB39DD2D691BE7111A64BEE4E45CBCE0C251AF604B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421740, "uuid": "f01f5371-2030-4801-94d6-e75ec832a65d", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421740, "uuid": "78c28da0-9d29-40f4-99bc-9846613d097e", "value": "24576:u/zLl6ZV+YFtANHH4GU9JPylsI/pgBGzkEaHNYK36ApXiSbEG:XWYrQn4tJPylsmbNajbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639421740, "uuid": "1b0b11e2-25c2-4056-b5ea-faa72c7f5969", "value": 1428192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639421740, "uuid": "2db5938e-e9b8-4f6d-b905-67c563502280", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421740, "uuid": "03f26331-5dc0-4e3c-87f1-71de6c9f0682", "value": "cf9b65f6d5f2ade5d2cc53b0455828bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441fb1bc-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426035, "uuid": "30e04db4-c85c-42db-b0db-7125ad52ecf6", "comment": "Malware payload (RedLineStealer)", "value": "0ef8ecdb9d545ce8818dd287830ee96b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426035, "uuid": "847f1697-66f2-43e2-afe8-b0a483331910", "comment": "Malware payload (RedLineStealer)", "value": "567ff027274666786dde140763b12fc15caa484ab41805f5e92289c105dc5ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426035, "uuid": "28beaf20-ca01-40ac-b9fe-04fe0acd9074", "comment": "Malware payload (RedLineStealer)", "value": "a6d7df750b5305b2760eca13e7fe094a834b198d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426035, "uuid": "7918e0db-763f-4447-98d3-35653ed9ba8a", "comment": "Malware payload (RedLineStealer)", "value": "9da92f968a6fd2734415b35579cf1ecbc459ebea34ff4e25511b23f6cfd2edd71e7f69f1e4e183f716e0667dac8e8b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426035, "uuid": "a05cab32-0376-4adf-a458-f0209e702fc5", "value": "T139149CD171D0F471D5A22D3488618BE40E7BF8A1EA70855B337C2BAF2F6F2C05A26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426035, "uuid": "4da4d975-7915-49e8-ac38-996054c1e48f", "value": "da86082cd27b859e55ff9843cf87f36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426035, "uuid": "d5b2fb71-2d8a-4273-a496-99df816c3a90", "value": "3072:Tua0+PMhE6rf3pM9GPoHyAY5G0hsZVggjcGkNIVqIW2e0p/fg1Vs32:FkhZxMMapnb7ITsq3xE/Y1V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426035, "uuid": "fc03bfe2-0fc7-401c-a64b-1ea249d0af7a", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426035, "uuid": "dd661b6f-aea7-487b-955a-de15a08db808", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426035, "uuid": "942461e3-f354-458e-a4b1-2a75caa035fb", "value": "0ef8ecdb9d545ce8818dd287830ee96b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708b0e68-5c31-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639412795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412795, "uuid": "87480497-2275-44af-ab98-805fd311e86b", "comment": "Malware payload (Formbook)", "value": "4e731283193fca71a76a4346d199595f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412795, "uuid": "0f8e4a80-db85-4523-9bc1-b911bb4fa20a", "comment": "Malware payload (Formbook)", "value": "5688ff1de947643ec028101c8ef356b6242f08fb18bba13064643ed0985e8caf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412795, "uuid": "c170cce4-1cd8-4ce5-ab4d-1c5ad2d55de2", "comment": "Malware payload (Formbook)", "value": "87fde37d43b2e958a99c5a8b8148e011c532f37c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412795, "uuid": "9bee22eb-166f-481e-a6a0-34c72e3a7978", "comment": "Malware payload (Formbook)", "value": "f05f1dbf14cb7d63b474734b92f08492ea53a453b9529e49d34cb6c6509a5372b65f9a191aaa8f0561a3896be463bd2b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412795, "uuid": "048572e7-0a66-4130-b05f-9c2b3098d6e8", "value": "T1227533188A26A9BC50311B2F13BC717FF2EB725F05A56E26D3712DD366B90D103AF618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412795, "uuid": "2f592ae5-f499-47ff-9fad-1a7e56331b3d", "value": "24576:LYa/VG4Ydt/TBHaCwwb3b1kSI8HP1nP0Vqy49IEKrug5DeAGj9Hj17Rfmmeorrll:kv4YdnfwgHP1nh7KKgfKJlfmbjO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639412795, "uuid": "606d5744-51fc-4b02-8d1e-f4e1c2daefcb", "value": 1618114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639412795, "uuid": "0960d718-5b47-4e2e-a5a6-fccb71110e93", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412795, "uuid": "06f4452e-2e57-44eb-806d-ca6cc0d77190", "value": "CCF08122021_00000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e9ad1c-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639414091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414091, "uuid": "56b450f0-fb4b-4c49-ba06-9b00d94c0313", "comment": "Malware payload (njrat)", "value": "44dba82c2ae65a2332940d741520d3db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414091, "uuid": "26904df6-f4f1-49fa-a302-6a53e0061f16", "comment": "Malware payload (njrat)", "value": "56e6f2114ddf4a7e78eba500bf66bddccdb2ce051e9ccefd238cef54d11d3c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414091, "uuid": "8c28d6b7-3500-4e42-a1da-e980ce2408d7", "comment": "Malware payload (njrat)", "value": "46dd600540cde151d9edf92ceb796f12c0682680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414091, "uuid": "58c88519-8823-4dba-b1ee-4c46fe0e75e7", "comment": "Malware payload (njrat)", "value": "30744ac80b83875b8d908643628e16d59afb2a5928a4c7a573aa79efa906b40c5ee1d7ee9c8114e0ab2f63fbc51a6876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414091, "uuid": "85cf7b4a-5df2-475b-b5c2-669f3a3d5d30", "value": "T1A293E84977E56524E1BF56F75871F2404E34B48B1602E39E48F219AA0B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414091, "uuid": "8b9940a6-5798-4c81-b45b-496ec218157e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414091, "uuid": "3ed63545-fe1f-42e1-bf32-17a07c845d0d", "value": "1536:yuM1GkeUqZJO53NSimjEwzGi1dDRDOgS:yuXUqZJOpAOi1dVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414091, "uuid": "cb2ed39c-7fbf-425d-bac5-971ad155a526", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414091, "uuid": "aa4cb691-aed4-4e28-b939-dbc7a8370a17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414091, "uuid": "8b5b2e6f-b819-4178-9aa4-44d5eca9d5b3", "value": "44dba82c2ae65a2332940d741520d3db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ca8d42-5c3e-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1639418298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418298, "uuid": "7c0b4d41-bfb6-4011-9ded-0c9ad596ae3a", "comment": "Malware payload (GuLoader)", "value": "7fa5baf72b8d253159e6641049f75781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418298, "uuid": "f83e736a-e7f7-41be-8bf8-c540a171ad58", "comment": "Malware payload (GuLoader)", "value": "571fd9810e79d880b9574fcb05ac0fd224d7df6b36b44b5d6049845b8532e06e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418298, "uuid": "2150c368-5c8a-4919-8556-2ef29f9253fa", "comment": "Malware payload (GuLoader)", "value": "dc09842baae817121ef73c8557b34c49b1e048a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418298, "uuid": "27bae713-4156-4bd3-921b-346ac4ad249f", "comment": "Malware payload (GuLoader)", "value": "d1d477627abdc5fbb5de7aaf95bd694d4e3a83ea0843386d02a5c15e87df280cc19a68ccfdf2048ee240382f0602a70e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418298, "uuid": "da6393b6-663f-4845-ae99-b2562c312c01", "value": "T104F36B5F6340B15AF55F89B1203F9920DC962C710E271167FEDEBA2525B22FAC320B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418298, "uuid": "de227f11-b5d0-4017-9d69-a0799d5bed0f", "value": "46370dcbfda16c3cddad2b398dc47b9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418298, "uuid": "f802b389-4735-45b3-b9f0-b98f61aae4ce", "value": "1536:ho31KAWnbLrOg9MmRfnbhaggjZ7f+FWU9EXuDfnx5CNiFazYGA7BLDaHiIQoCfGZ:KFOLrOeLkjZjaL9EXMfVLup3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639418298, "uuid": "bbd3a2f9-340b-41b9-b666-6f9f3697acd6", "value": 168018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639418298, "uuid": "c774b921-d754-40f6-a6e7-1ed3a01532b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418298, "uuid": "35cc75da-c290-4304-bba1-5a2e1a6e93b6", "value": "Strikedd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d011af1-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1639414104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414104, "uuid": "5538f51d-183a-4ef6-ba1d-d7ee803735b7", "comment": "Malware payload (QuasarRAT)", "value": "07bc50f900c95233e323f9cfb8f4abe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414104, "uuid": "6978c9dd-e655-49a7-bdc0-8a5798a97738", "comment": "Malware payload (QuasarRAT)", "value": "5724c5e79efbb3e6749c3fed21ef2def67cf6fa273821a93b615b7d6608d2d30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414104, "uuid": "17baf1a4-312f-47ae-b76d-0103c4aad459", "comment": "Malware payload (QuasarRAT)", "value": "7f9398c04e6717c2e19612cf144e9e840c887d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414104, "uuid": "26b022f1-cd93-4d6e-884b-419463a6d4c5", "comment": "Malware payload (QuasarRAT)", "value": "b356d407e4badfdeabaf077a90bb86c6a20406ada656726088f5d7b0edd00eabbd94835a0f3ce0ebef5350f7fdc9c3dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414104, "uuid": "675ee0bb-d7e5-4147-83eb-b7e1b0d2268f", "value": "T17E749D1373A8E53BD1FE173AE43206194BB4D893B616E38F5A1A56F92D133868D503B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414104, "uuid": "da91f553-ea51-4256-a204-f08e1de0f765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414104, "uuid": "149e5c04-ce4d-455d-b07a-dc79a4efc854", "value": "3072:lur9+7QRqiqCFFiEKdpyDcsvjz+R5O4zA99bdS3mmww/EThmbfmAO8v2OgfOBE56:lUqQ4i1FFiEKlPAA5jbf8OzB+RJ9y0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414104, "uuid": "3965ed41-b23a-4cbf-befa-16544a62b280", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414104, "uuid": "cb06539a-186a-4507-82ff-db9c57d7c7ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414104, "uuid": "2e5bfa25-e6bd-4b5f-8896-32a7fcb89730", "value": "07bc50f900c95233e323f9cfb8f4abe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66216a2e-5c0b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639396456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396456, "uuid": "c06aceb5-050a-4324-907e-ee7c153ed63a", "comment": "Malware payload (AgentTesla)", "value": "fce83c966098826840b4042459ced956", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396456, "uuid": "dfad667e-7a07-4168-8ec0-fc29b7a5618b", "comment": "Malware payload (AgentTesla)", "value": "57b6aa3c03aec368d510057fe785ef335b5b3575a8f7cfd1faad1d0910fdb9d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396456, "uuid": "197d35b2-bcb6-4e10-8f9a-5f5dadc9b18f", "comment": "Malware payload (AgentTesla)", "value": "f4401696769629b1ae996b2d3c42fc36d0d1ee80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396456, "uuid": "98bbf37f-c53e-44f3-8324-68ee4fcd373a", "comment": "Malware payload (AgentTesla)", "value": "6576182d984f0cf720ccf26ecbd913642307cd6e15bf15a5bfb7229688b82d1db841a6b713cbf190adc8c850e740b4a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396456, "uuid": "62ec2c96-f254-4b16-9156-fcb69ce66a33", "value": "T1F355121A33A08D14E57E17B89476C230C735BD056026D32FAAE96DAF7E73B609D143A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396456, "uuid": "cdac59b4-cc75-4b7a-b341-734a843f31f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396456, "uuid": "d9d66f60-cfe4-4440-8bcc-f7e667c35c71", "value": "24576:3tXOHtEgndxaahQKAWhZB7/+seoNW5W06YgOROunD87TH1JIEt:3dOygndxlTAWhZB7KGaWJYNRVnQL1yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639396456, "uuid": "ad8fce2c-92bc-43d8-b675-fc3e476ef345", "value": 1401856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639396456, "uuid": "f694843b-30c4-4203-9f3c-2a62ffc521a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396456, "uuid": "acf6de29-6cb7-4d2c-9fc3-2a9bf6eb7f02", "value": "SOA_01112021_NOV_2021.PDF(122KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83aaf1d1-5bd1-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639371595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639371595, "uuid": "220a7c7c-efd0-4cb3-a0c4-e51025f6532d", "comment": "Malware payload (SnakeKeylogger)", "value": "28b4a6b83ce224ed0e69e8ff0a6d2454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639371595, "uuid": "855d12e1-1cfd-4674-8595-9162aef34078", "comment": "Malware payload (SnakeKeylogger)", "value": "5916982f424b7a89ca9b07d6db1e194acd92fec181cbc8559dd6dcf91e35a5e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639371595, "uuid": "277d0b81-0fcf-4392-8118-fe19e24643f5", "comment": "Malware payload (SnakeKeylogger)", "value": "a86c89431bea8a00bf995942799ed59a256bb272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639371595, "uuid": "6a729b60-e302-42cc-8dba-413321be4f1a", "comment": "Malware payload (SnakeKeylogger)", "value": "dbcebfb394fa8a481d1ff7ce8d21adc0e9a2a7c19d243705d17f9e512fde66855863e5ae9219eb446d051500e9ef54e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639371595, "uuid": "08360b78-ed8d-45a8-bbfc-247f2d6f4732", "value": "T1D045121933905914E1BF1BB86071C130C731BD067526A32EAAD9BEEF7EB3B608A44757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639371595, "uuid": "b57c96f4-bd6a-43f3-84ef-f2724fea3615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639371595, "uuid": "67484553-836b-4032-9a90-ff36600d7a9b", "value": "24576:3Ce7Xkd3GnN9gRVLmvCz7U8ohow3UC0uaXXOHtEga:yQiKLvC7U8oBUC0uaHOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639371595, "uuid": "3267d500-7ac2-44c4-819c-cd133ebb190e", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639371595, "uuid": "493405a9-2627-466f-ad56-e31b4882f004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639371595, "uuid": "80d8cf90-8aa0-4dad-b314-6b03d455f581", "value": "0003456785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53203e71-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426060, "uuid": "75391d19-0e3a-4a51-9efa-e9b3c51c40c3", "comment": "Malware payload (RedLineStealer)", "value": "ed509a2d7c959f70ee7db1bc97b88213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426060, "uuid": "c9b61f7f-23ed-4a3e-9996-bdd6085d2e94", "comment": "Malware payload (RedLineStealer)", "value": "5935fcdc28e873cfab7988cb41322a3ba7534f2b89ccd4e0a52fd7ef4e3a394a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426060, "uuid": "019fcf90-80a3-4d35-903e-bc59a3a35a98", "comment": "Malware payload (RedLineStealer)", "value": "f93f6b69c3e96085b7a4a36b5478e849a18eaf2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426060, "uuid": "3d42ae63-cfaf-4c83-a1b5-242ab79798d8", "comment": "Malware payload (RedLineStealer)", "value": "65e70c41c38955fa112d3819e8e633c44833738c8a88d5c30dfe3ba8c8c8f3e09d2d606464194f9fef6349dec3185f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426060, "uuid": "4430c3fe-0efb-4b9f-b7ad-f8015d05d262", "value": "T1E174D0C2B5E1D433C192693998608BD41D3BB851EE2CD187F7742BAE6FF26F08925352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426060, "uuid": "a5b94383-9a98-4b12-98c0-e0a5bd43f4bf", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426060, "uuid": "389afee0-4678-4d30-9c73-697b1871f4b1", "value": "6144:a6c9EcMiEN7MhiDunKcyj5jSfp3Vb7ITsqLwXK:vc9Ec7a7hLcKNSfp57cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426060, "uuid": "65760e68-4195-47d2-96ef-1529eccb7790", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426060, "uuid": "b3f9e8fa-ea00-4b86-a6ab-0df9069499cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426060, "uuid": "234dbf70-8ed2-4107-adaa-d6478135195b", "value": "ed509a2d7c959f70ee7db1bc97b88213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7057cdd-5c5f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639432670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432670, "uuid": "59344260-118b-4714-8965-d4be3e167d55", "comment": "Malware payload", "value": "7e13728a352528d876f1037a4f97a928", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432670, "uuid": "a0626689-4523-4841-9541-76d1eda1b834", "comment": "Malware payload", "value": "59ac15b6de9e5065e58ccc24797e3bb36e2a4eb4348e83979781cc880a3456c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432670, "uuid": "c63baa85-e5aa-48de-bffa-a31f1a3cb292", "comment": "Malware payload", "value": "d49c865566649adcd4c8114c3a3785080ee44c3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432670, "uuid": "f85e2cfd-211b-48ea-bcde-a7c98a036611", "comment": "Malware payload", "value": "235f533b4714d2dda83de7356f59159bb0aa30b23ac660390b20ee7c0be4456a090226a34b882ba88925553679d30223", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432670, "uuid": "39c74fd6-b8cf-46a4-8a6b-d63fceae0325", "value": "T108B4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432670, "uuid": "b9e881e3-288e-4b35-bd31-a94b16c196a9", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432670, "uuid": "8f4f3930-e775-400d-93a7-b9de581a5988", "value": "6144:LKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:L9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432670, "uuid": "9944013a-36f5-47ab-93f4-33d4bb009952", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432670, "uuid": "ff00440f-2bc6-45b6-bee2-2e511a4b068a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432670, "uuid": "6b384f19-2bfe-4f0b-a9b9-fe40bfb44ed2", "value": "7e13728a352528d876f1037a4f97a928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552eac11-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639395140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395140, "uuid": "9d7c903e-1814-441d-887a-e5da81bc24cb", "comment": "Malware payload (Formbook)", "value": "2cfc471c98297049ddaca7d214c80eb0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395140, "uuid": "5d15c705-1b19-47f4-af0e-8b80b0ac0987", "comment": "Malware payload (Formbook)", "value": "59e2d1ead37c41c3c8d806c396274ed22ebcd12f792b818d08b291227128f205", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395140, "uuid": "3a478760-b82f-494a-aca4-e0e82fc0434f", "comment": "Malware payload (Formbook)", "value": "d1eb1adf05b9d98bc13921486724b7f12468ef3c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395140, "uuid": "12011aba-47a7-4e0e-9bd1-693a80eff67d", "comment": "Malware payload (Formbook)", "value": "1e06a5800ae331092ab83aa036292ec8ebb04a89a2798cf488c8132428e5c8d0a71fa0be71156bb46fefbfd6dc3821b8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395140, "uuid": "a49f0b1f-ec19-4824-9f25-e51248853014", "value": "T1FB55121963E48A19E56E03B9A5B6C1348332BE05A436831F7ACC7DAF7FB37918905353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395140, "uuid": "d43654c1-ac99-40ff-8640-92f7bcd47ce7", "value": "24576:Clh8JSZX2ZKrRirSkNHtT49yNmIC3Ev+D365VjdcSSXOHtEga:w8QBjGdNTDoW+Dq5VjeSOOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395140, "uuid": "f600bdff-faf0-4c4c-acdc-085d73011d73", "value": 1378304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395140, "uuid": "3b3728e9-278a-44e3-9576-d77479358c76", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395140, "uuid": "bdf680f2-decd-48a5-bd07-d9d0315b018f", "value": "Tax Payment Invoice Monday, December 13, 2021,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fe334e-5c56-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639428512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428512, "uuid": "1dcf12ab-3e34-4be0-b7fe-d3f84b3742cf", "comment": "Malware payload", "value": "bffdcb8c8322622a02dfa14a1e1e8b7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428512, "uuid": "b0b2a6b0-3010-4fd3-9d02-22a4f93ce13a", "comment": "Malware payload", "value": "5a0fc16ddaa9c8df91c3f94936c17b14955a24b1a501510f0a5be1031ff95a3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428512, "uuid": "c6d1e1b5-04bd-4184-b6f0-f0b622afc0e4", "comment": "Malware payload", "value": "997f4dcea42434f3f50bcb657a2ab98403f393a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428512, "uuid": "5bf23177-5290-407f-a128-e63751fe03b0", "comment": "Malware payload", "value": "e7b4418dda1b94cc8f51b952a9e2d82ff6ee3306d336f4be76e93ba59b11d46310fd3a5c1e30b1e5c4be84452c95da60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428512, "uuid": "9517ba71-5a3b-43d4-99af-ad0fa3f70388", "value": "T143B523407E75EF65E9FC07F2A8A141901370AE6670D2E0392ED629CA7879F90DB10D9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428512, "uuid": "d264592e-2319-48c7-bb67-818a7233f25d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428512, "uuid": "82a3a431-715c-4d52-8b5c-2196df13531e", "value": "49152:Udm7v3mjKRJkXgcO9xQkUCbyDxs/AWwnPBhFLtgU4WxmrIcU:TPzbcO3QdpNoAW0LJgUsUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639428512, "uuid": "7aa0897b-ac7d-4bce-927b-ec9fa41b11d8", "value": 2289152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639428512, "uuid": "2a7e1322-04d0-4aea-b09d-f705e0e9097f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428512, "uuid": "10696776-5327-4728-942b-e8866a9ee2b1", "value": "bffdcb8c8322622a02dfa14a1e1e8b7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3b02d6-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1639407957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407957, "uuid": "5daa815b-c6d5-46bf-83db-d806c253cc6a", "comment": "Malware payload (Matiex)", "value": "2fe0d9dfd0fbaa96190944e7476165e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407957, "uuid": "e5d6fc97-73c6-4918-aa47-7508da0b0bcd", "comment": "Malware payload (Matiex)", "value": "5a973c144d49d4ca870852219ed8de091cd22359160c82f00c1c5868ab0b124f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407957, "uuid": "0704273b-5fcf-444c-80c3-90b320cf2d12", "comment": "Malware payload (Matiex)", "value": "4d19923e1648170f22388b60d5b2eee85e894136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407957, "uuid": "dea346da-12b5-46d9-b455-6a85547c3648", "comment": "Malware payload (Matiex)", "value": "ff36a636244045c83cf79d6e0d5000756df044f81c387d78c6605f0cd6c6d76595b3a922659e0f2ff24c6feccb347ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407957, "uuid": "28611b09-5d58-41ec-8ae7-f2a3df4ed2ec", "value": "T197B40234B0E57EABE2F68BF720A4973497B1181F461AF908CDB4B5E489833D45B90D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407957, "uuid": "16393446-a4ed-434e-8623-37520b1d62ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407957, "uuid": "1b0ee47c-5d6a-4ebd-a421-6b7183dfc22b", "value": "12288:+s103Jq8HcD+jrGR2rUukDHLFxTvV2spsimeDONZ53v/Gs1sSG:Y3Uuc6ja2rUuYTtDbmeM3v/GsKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407957, "uuid": "f8bd4916-2bb4-483b-85ce-6b8ea37be437", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407957, "uuid": "983c69c9-f93e-4a91-bb0c-fe501ba8f104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407957, "uuid": "eeb2acc0-56aa-422d-b551-b6a90ec2873d", "value": "2fe0d9dfd0fbaa96190944e7476165e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a63b6a9-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639395148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395148, "uuid": "d4e433ec-8b8f-4c25-8060-47ca90614998", "comment": "Malware payload (NanoCore)", "value": "d246c7b0df57b9724865f1d5508b7692", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395148, "uuid": "07f25f99-04c8-496d-b5e9-d561cf459c5f", "comment": "Malware payload (NanoCore)", "value": "5b2e1119edf02a25ff3e7720e2608050d3015284e8875caed639563b074b39bb", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395148, "uuid": "642e5059-73cc-469e-b75a-6cd2bac383d7", "comment": "Malware payload (NanoCore)", "value": "677caee1cd8d06b149d19c95a31a0d0996f31853", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395148, "uuid": "fef7d7ff-ce5c-4fdf-99bc-6c9135e548ef", "comment": "Malware payload (NanoCore)", "value": "c5b97a05f6ab0e3643efc4632dcb99a0a5ed5a9718102ace85c4e09a26583beece954330f32deef71dc41407802c627e", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395148, "uuid": "d75628a4-ec20-46c9-8be6-243bcbae5dc1", "value": "T1FB5533A5D5508EE4970EFD9D97A86428F4C0FFCF8650130DE0E27D62A59BF38EA842D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395148, "uuid": "d1f9b252-069a-4c7c-8e51-fee6173a2342", "value": "24576:nOy14eH62+f6sx7navj0x5NbthlMjvRpMpkBYJc9cvUfUKNW4zVTd9JfZA0:OyyeH6dDxzavKbthlMXMpkz9cvYNXRdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395148, "uuid": "eb7f43e8-8f0b-4013-9dfe-24a729737c43", "value": 1308908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395148, "uuid": "a4f66591-4d71-4426-8d7c-0985b17e34b2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395148, "uuid": "9e4e5349-c6b9-4737-9bf8-72e12010be70", "value": "Shipping Documents_scanned_6210021311000.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa0f023-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639425938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425938, "uuid": "0e225557-c528-43b0-a9ec-99368a2976c2", "comment": "Malware payload (Loki)", "value": "9cf103dc701f567e19d79203c3bbcdce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425938, "uuid": "0e211c39-d154-435c-8b70-eead513663ea", "comment": "Malware payload (Loki)", "value": "5b68bc6511098e14069c0e856efe19d665835260e6cd917c8c6c732e23bc0dc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425938, "uuid": "a4a54228-2f3f-4e0f-9f32-fbdc7f4e5a84", "comment": "Malware payload (Loki)", "value": "4dc4dcac4e15834784041d4513e1b18d843a5c8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425938, "uuid": "c3c58a44-6166-4224-bf2d-2330d292e5b3", "comment": "Malware payload (Loki)", "value": "d715ef8cc040ab6b7231b02fdecc23e2b513c625010edf70a1a14d93ca63aeab55ad97dd6310ee933c635292e8f8de6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425938, "uuid": "d7367d8d-40d7-482d-8265-b3e5c23bfcd7", "value": "T15145230670AC9720C5AE0BF45592CD0103EAA00F3731E3E99D9FB2FE2977BA15A516D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425938, "uuid": "50b3ba2d-e02c-4481-b08f-2f9d409fb6c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425938, "uuid": "5a2d21d1-f42e-4ea5-8456-84e21acfd62c", "value": "24576:6c5wuOEHmbU4ssH9XpTbjbjGn/jiwWPREr:SuaU4ssH9XJTwuNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425938, "uuid": "1de285cd-58dc-4e08-badc-b08e06c183cf", "value": 1210880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425938, "uuid": "10ee8195-a63f-41c8-badb-806905f82851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425938, "uuid": "55210619-40b0-419f-9efb-086c39ade4c6", "value": "9cf103dc701f567e19d79203c3bbcdce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5498a29f-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426062, "uuid": "ecf36268-fca1-44f8-90a3-6107e38a8835", "comment": "Malware payload (RedLineStealer)", "value": "6f3b70766510b394f056ba24b19c5199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426062, "uuid": "5ced302a-0266-47ce-ae7f-23d1759f7912", "comment": "Malware payload (RedLineStealer)", "value": "5b8c9ed6087dbbc394b3f74772a67f40ba9fa2826dfb68816bff750f76ab806d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426062, "uuid": "ce7967ac-c66d-4e85-8fd0-01fbc9af878f", "comment": "Malware payload (RedLineStealer)", "value": "7f60c58456045b3343ea44e2baeb8e20b419bc68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426062, "uuid": "1e2416ab-b22e-49d2-b40f-1fe1fcffe856", "comment": "Malware payload (RedLineStealer)", "value": "ed9b1b65b6abe2d7fd52fbbb5fe950c230ce9ac700332365225b979129a45f57293c1b568ceba4e3aaf2239134559765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426062, "uuid": "c8066377-2e16-4788-8e39-713261ca1146", "value": "T1F474D0C176F0E431C6B369358B71CAE45E7FBC52E960518B37782B9E2FA26D04A21317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426062, "uuid": "4f66179f-1541-456f-95e4-5349128fb056", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426062, "uuid": "844dad79-7b67-4e7c-811e-25f0c3b17713", "value": "6144:R6+el0f9MJRfprGOq0Qi0y4DlkOb7ITsq2Sk7Ws:wzl01kprGP0l0y+B7KkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426062, "uuid": "4b11f1a5-812d-40ab-8834-fc43bffa0f35", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426062, "uuid": "b72d5619-2f8b-4f47-98c0-ba63852e3a59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426062, "uuid": "af438fd2-aebc-4e4e-b17b-d0ec83d71a9c", "value": "6f3b70766510b394f056ba24b19c5199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ec3d95-5c51-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639426731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426731, "uuid": "46bf3733-d85c-459c-bc09-3ecaab3d09d5", "comment": "Malware payload", "value": "51073366764aeecfa7d52f5b0461f180", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426731, "uuid": "2eaa63a6-6106-4d66-b939-4c3d4e9511ce", "comment": "Malware payload", "value": "5c17631af38e9a8910015e2ca160a7d9505c9ca8863be9258b3e30411301a03f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426731, "uuid": "72bb34e3-7617-4c85-a95f-2de52cc6866c", "comment": "Malware payload", "value": "e3fd794e18a216a797ee55aa8260e444476fe259", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426731, "uuid": "177bff74-9d02-4bbf-a9fe-8ac41cd48d40", "comment": "Malware payload", "value": "b5c25789adfe385548153df91168f1edf4d755052314be1744f56fca2f2dec1cd10d568e72d33642cc23e65eadfc3e8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426731, "uuid": "6235e942-2f8f-42eb-9757-7cd3319d5df7", "value": "T149B4B0D1F05FE94AFA5F46712E189932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426731, "uuid": "8aaaae29-a350-4e1e-a805-7c55f141bfd6", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426731, "uuid": "85bafd83-1a1d-4622-8f91-57729c0cbb98", "value": "6144:BKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:B9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426731, "uuid": "01c95197-bea3-42f7-a193-6411af8a97f0", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426731, "uuid": "45f61490-6fa8-45c6-b20b-bf00056e3211", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426731, "uuid": "8838d638-26c9-4f6c-b6e4-5b34ac621f71", "value": "51073366764aeecfa7d52f5b0461f180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66843dfa-5c57-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639429099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429099, "uuid": "1cffb3a6-ceaf-42c4-bd9a-5b12d07b0901", "comment": "Malware payload", "value": "afdfd01af747b150d37bf2639030e0ed", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429099, "uuid": "70146b0d-9d74-4b6b-a184-09af687e7720", "comment": "Malware payload", "value": "5c6d8f7171e7d56dd19c000b61bbbec553537538b6bab5d56d247c6e235c11bd", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429099, "uuid": "609907f4-15bf-44cd-82eb-a8508b7f70fe", "comment": "Malware payload", "value": "4383d8c355dbe58fe3c7c2084613882d69d990b4", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429099, "uuid": "70bec4fc-faac-4f90-b544-9d3d22abf3a5", "comment": "Malware payload", "value": "fcf134024bbc2842838b0ffece28ec52ada9e1a20abe4ff95d923344294bfa31746e8ccd4adafccb46c376c7ef188864", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429099, "uuid": "e80108dd-cf91-432b-bd4a-930a96b18190", "value": "T18104123FEA626D15F2BB1171118EB8F0C116BE12EFB41D2FB946904493E46539B0F3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429099, "uuid": "b6efc3f0-7662-4f69-8576-1cb387b37dca", "value": "3072:m/ZDhYaKK3ZHf9d477DnT+mVi8SAST93HDgmNSbVDAKWTtiBmW18P3TT05cAeddP:uYYlf9d473n9SgmNSbNF4isW18fBAe3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639429099, "uuid": "ee070922-a08e-4e93-a42e-0dfe87686fba", "value": 185105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639429099, "uuid": "56c547a6-9279-4dcf-82c4-4efc12ddb8d8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429099, "uuid": "1dfb9c68-da00-4f67-a507-c6616d57f492", "value": "attachment.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cac683e-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639407930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407930, "uuid": "fd0f9e63-a8af-41b5-a9b2-6d5378f3d830", "comment": "Malware payload", "value": "22242b8796b72c7b32645605335b70cc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407930, "uuid": "091e291f-a4dd-4355-a324-e274b61b1018", "comment": "Malware payload", "value": "5cb847ba07146c06284356b67071621020c41395807685f6dbae061fa603bc5e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407930, "uuid": "f1bb957b-c6b7-4fcf-b551-d058cefda935", "comment": "Malware payload", "value": "38ddf9ea63c0ce577f3743264a47a7cfd1b5a223", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407930, "uuid": "c9e0a0d3-9ebc-4500-8914-c6c66f8d053f", "comment": "Malware payload", "value": "777c9d5ba4216e7da9ccbae4f7b966c4d918c216d82d0f3565f197cc4cf1982737dc9088061d738edfaa455ba1b2937c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407930, "uuid": "74681bc7-60f4-400f-8981-d342666f0762", "value": "T18DC57F23F2C18537C0772A3C8D5BA799EA3A7E102E38544B7BE41E4C5F356817A192DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407930, "uuid": "9d936c7a-2f6e-4d69-a06d-61bc1ccae8d5", "value": "49152:VOEB2ltJsl6r/iv9toDa5PaMfTSBTPTlYOYL5A:RB2l7URZacTImOYFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407930, "uuid": "a9113944-6af3-4b50-9a1f-60f57228a943", "value": 2611200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407930, "uuid": "f70dd752-b95f-49cb-962a-e5040d9f7cba", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407930, "uuid": "28e92e11-68fe-4285-b5dd-45f357f0d742", "value": "factura_LustresF43_NFe0206.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301cc110-5c15-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400661, "uuid": "0485477f-c8c0-4e82-8f89-6f8666f2a030", "comment": "Malware payload (Mirai)", "value": "55325e3b11e957996dddc83dd9607eb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400661, "uuid": "721304f9-e514-4490-b3b2-90e5528a4c5f", "comment": "Malware payload (Mirai)", "value": "5d9c29b8485b14bfe698c50b73e04da8210c30b70b600babf6583e8f733feef1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400661, "uuid": "7d6ca9e5-fb09-4b9f-af3a-83acab196246", "comment": "Malware payload (Mirai)", "value": "e3538a0c567f06d5686d840ffe6ac8780d62600f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400661, "uuid": "7744dd81-47c7-42eb-b822-6be2f1a91105", "comment": "Malware payload (Mirai)", "value": "1cbbcc04e04006823c73f142d182174ee01f6d5455da1e7a250b0c5cd544387d7646156590d0a346ef3a0383ba6731be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400661, "uuid": "268f24ef-aa8c-4e0d-a245-5c1edb0d33e7", "value": "T1575302907D0BA023CA83412565BA83666DCD7230D2AD2FB69F958BB3046D5D7D33AC1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400661, "uuid": "6835214d-c0e5-4d6f-bd19-0f466181f0ec", "value": "1536:LB0ZsmAvFWwAvudmb/25W4g4oacWEkkFqLz2qkM4aUML9u:L2amIodj2A4Ma/SuWTRA9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400661, "uuid": "0f19aa3d-6396-44f2-808f-571c89770aaf", "value": 62364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400661, "uuid": "961fd28d-2c26-4e6a-bd8e-91f9ede15d5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400661, "uuid": "db2f2380-dde5-42d6-9ea0-a8dae4ac3d6f", "value": "55325e3b11e957996dddc83dd9607eb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa8d28f-5c33-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639413483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413483, "uuid": "491bbe5a-0e1a-4daa-80ec-0935c8cbef8b", "comment": "Malware payload (IcedID)", "value": "62ecf5b291ea8b3c2fdd77737524c806", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413483, "uuid": "04efa165-841a-4975-929e-c323d45ad1c3", "comment": "Malware payload (IcedID)", "value": "61552a7870e7a4f4340490482a29e2fd7613d31d01f5e4aa1db96821070b50b1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413483, "uuid": "ce3116d0-9d18-45e3-9e08-7d3ed1174c3a", "comment": "Malware payload (IcedID)", "value": "06386ec99fae3628c44c7ee32c0de366cafae310", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413483, "uuid": "7bcafb1b-2e77-44f2-8e17-de6809cb0266", "comment": "Malware payload (IcedID)", "value": "346b922e2e8d0fb2717d1c4871c6c24255a7a8dcbad7f68435c338bbf4d33972ec0a6807e2bc1c4757615998bb2ea9b3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413483, "uuid": "48a8c71c-0ae1-443d-a86d-8cdad913bcd9", "value": "T17F13C014D4229E00C69E467E60ED11F0BFB342C792D59A039ED3EA0F4C511EEDA5F69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413483, "uuid": "c87a6485-3bd5-4419-84b4-7da4324f41a2", "value": "768:K+L18n0BKW2rq/eEflhRSfwdDQWk/HQFYNTUrLfxl1Ihx:sn8KWG0lhRSfwd8WgZMLfxqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413483, "uuid": "c0537218-981f-4b10-a0e7-ce7e20d17778", "value": 44250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413483, "uuid": "63d822d7-8153-4732-9c4e-5bb98ce05bcd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413483, "uuid": "89669994-fd84-4fdf-af27-447b31135911", "value": "adjure-12.13.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0707a1-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639408121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408121, "uuid": "438c6b4d-8c71-40e9-bfad-4104db00d264", "comment": "Malware payload", "value": "8075554d450a22c915f272a48edda05d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408121, "uuid": "434b001f-16ab-46f3-a141-b06636380dd1", "comment": "Malware payload", "value": "6262527d82f36c2c56ad94b4a8ab9fb80848a1049527c3629d8bf83763b5d34b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408121, "uuid": "bd10e36d-3db5-42ae-a8af-ea5871f77510", "comment": "Malware payload", "value": "26d0a6aec8c7e9e3ee433b1d6234af16e2d6c1ce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408121, "uuid": "8025fdf2-7ef8-4f4b-84af-970420fc6f6d", "comment": "Malware payload", "value": "f946e61aa48fa1cc38de0171a5a751a29d84bf66326278c95a62e228d97ce5e431d0be5232253b9e7259c2b4ac2823b4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408121, "uuid": "310b83ea-c8e1-4010-9e3e-52dc734d783c", "value": "T10961D85AA7745593CF2641F9DC32FD8146D9F2C602DB10893EADF89303B533A953AC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408121, "uuid": "665bd429-1bee-4869-975f-5467cad3aaa6", "value": "48:/X6itIKbCyHEDX4R4B2NMzAkennHzi/hwAEDQbQu0txETRs0tbekA9l33asVgI9V:PzIKbSElu2HzAOxms0Ze3l33IMQKo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408121, "uuid": "c9ba5ff3-ac0b-45f6-8dcd-2f7d604cab92", "value": 3448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408121, "uuid": "58e13008-3456-45a7-b20a-8846655b2b1f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408121, "uuid": "5a2acbd8-5aca-4eb1-83e1-d3f27ac2f33e", "value": "DECEMBER ORDER 9980488.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969ae099-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408134, "uuid": "3ddc3b22-9824-417c-a132-14cc293d4d8d", "comment": "Malware payload (AgentTesla)", "value": "cbf62d784ba5cf3abac78bdeea7d6378", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408134, "uuid": "04b26bf3-88f4-4fd6-a7e5-63ea4482c424", "comment": "Malware payload (AgentTesla)", "value": "62ec107ea6d4ed40169000475c64d2345895e48cc5ba557ced8971234a0c3b46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408134, "uuid": "1499d9b5-0c6e-45f3-9677-fe0ad11060c7", "comment": "Malware payload (AgentTesla)", "value": "812cd6a75a09eb54e44b2a5c7a496d5f2084e5f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408134, "uuid": "df00bb1c-7601-4f79-a636-ca7c42a30a08", "comment": "Malware payload (AgentTesla)", "value": "c333375450f49f28a3ca46dd94fc2665f77cc9d065a85e7ffca4398d03370ceb9d21e3e2a86a5e779594cbfe115669f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408134, "uuid": "4e9471e8-1fe2-4e46-afb8-95395bb8f37e", "value": "T1587119782A7C3B82EE7244E8F5B2F4B604C4B19832DF14C9301CF8490B613689B7B049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408134, "uuid": "f36fc79b-5a72-4ad4-bd4f-c99e7fa903e5", "value": "48:cB3f636QsMebE3GzhPBFfjNRu+CEBPiesSZgpo5Koeu0pWdQptrNERdYH2WZI8eo:cNfTMega1L7ClhKf0Ud8trNBWnpC9MO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408134, "uuid": "d6e89b60-2f8e-4ac9-a1e9-7365c0796dc3", "value": 3701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408134, "uuid": "7515bb9b-7d57-4d9f-a983-ccbad1f72ed4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408134, "uuid": "4086fd3b-89dd-46e2-8195-218be5e8f7da", "value": "MT103CIEL220009.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8cd535-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408309, "uuid": "475d74f0-2afa-4496-b477-2541beeb1e2d", "comment": "Malware payload (Formbook)", "value": "567248278e09cf6968be5471122aa38a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408309, "uuid": "f7c7cbdc-966c-4f37-bf0c-53ac4696d54b", "comment": "Malware payload (Formbook)", "value": "630cda95d9be61fb7bd3bddc4aacde78cc7c5a92dc303e0b354a2f81e2c4a855", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408309, "uuid": "60736466-e646-433f-8a18-ac088d91cc96", "comment": "Malware payload (Formbook)", "value": "32220dfb875eb221eb1a33ae77e43cc08e07748f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408309, "uuid": "55940953-2bcd-4b88-90e5-5708d5dab50f", "comment": "Malware payload (Formbook)", "value": "ec3f87b4995059135e89d5ae8204e3cd1f048ec114685c16c93f2f21b25c68d2596e17afcef8f019afab07c86032165d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408309, "uuid": "b7be264a-c599-4612-9a27-4d75f124aff2", "value": "T1750502C6D75B066ED222E5F4A9843A2B64FCEC1306A9C659C2E1B0C9F6FC1D1C0BD4D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408309, "uuid": "d3a89fec-e43f-4849-9739-5e9ce941fa21", "value": "12288:E1xpu2BUUUYn+sIIVX/RCE8zIiAq6PwoY2fqyg4FNwkrTSIxQ6olTysOsHNH:EBu25DIIVXb8zI/Y2yyLTSWQ66yDcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408309, "uuid": "6217d67c-3ed8-43f2-b858-6ac93262a64d", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408309, "uuid": "a0918ce9-f12e-4343-ae2d-fe1a1ef9d209", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408309, "uuid": "ab9c68d2-e1b9-4483-89f2-2762c0612cf4", "value": "GE00006892.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170dfc16-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639407920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407920, "uuid": "0c8e3449-a03e-4853-af10-29323ea3481c", "comment": "Malware payload", "value": "39d8b158f92f93df5eb0face0c9d1d82", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407920, "uuid": "7c02ee88-0694-49ce-9aca-bf8e4f9ed28c", "comment": "Malware payload", "value": "631a4b2ebee6eb24e58b9f84eabfe9664459ecd9845f59e5baf6b08143c62f42", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407920, "uuid": "4aec997f-2060-4918-b22f-58454a8e45f3", "comment": "Malware payload", "value": "7ebdc0ef56da32fe0511d10ebf08393062f48129", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407920, "uuid": "347168b4-c769-4cde-a82e-2b5160624c1d", "comment": "Malware payload", "value": "44c61d0a0c6647cbadd52894dc273d41cdebc1edca5831478b7a60c6d4f0640efe9a42ffb319dbb57ca67f9c3edc94fb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407920, "uuid": "a9c20824-05dd-48fb-a074-ce4d6b0d6a80", "value": "T1C146233372468135D0FD85785A3BFF9920F62A688BD144FF62D89DC929729D0D633A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407920, "uuid": "02c7db75-c85a-4c57-a4d9-ad54a2711c0e", "value": "98304:lYMeNAG9WU7a4W7hLExHbyC88JX/lCntJzfITd8CnipuuteEYmNB:69Z+aFrtOzR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407920, "uuid": "a369b604-a6bd-46d7-bb4e-41836954878e", "value": 5869568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407920, "uuid": "fc399003-a47a-403c-9773-7fad270c457d", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407920, "uuid": "2bfff4b6-ccb4-4d9d-9e37-a3fe50ee1c7b", "value": "39d8b158f92f93df5eb0face0c9d1d82.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d202ecfa-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639407804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407804, "uuid": "7ce9e033-70ca-4267-a961-e250963ae6c1", "comment": "Malware payload (Gafgyt)", "value": "dca638bc267bc18d6b476325aaf015c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407804, "uuid": "4e1261bb-9329-4f34-b3b4-1a6b8145e653", "comment": "Malware payload (Gafgyt)", "value": "632c319120af06db8ef674f1e6e2fc6bb2f5b158e9d80dc03cd386f3923e3b64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407804, "uuid": "90e66c34-11d0-4226-98f9-74274146a9c9", "comment": "Malware payload (Gafgyt)", "value": "efb8b49374b72a620dfa9f428b478bbf22fcb2d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407804, "uuid": "30da3568-14c5-479e-9e5f-21ab7e9b759b", "comment": "Malware payload (Gafgyt)", "value": "37dc7a996abfb8f3c994f19bfa0a14e5c07017d960d46efd1b86d52aae46e4581f2a5f3937fddbac77a7eeda8571d8db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407804, "uuid": "aa364a82-300e-4b3a-a97a-582f0ae33769", "value": "T125B30804F8448727C2D327BAF78E439D7735566457DB33116A38BEB82BC6B982E29170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407804, "uuid": "2774eaea-6db2-4585-adb6-7b90a642ac06", "value": "3072:9lX2jKRi0ZDvCTp2v7DSubUmGVrQAXiUXouX:6j6ZUp2v7DImGVrQAXiUXouX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407804, "uuid": "dc215d64-8377-4729-9d57-5ee1808653fe", "value": 112657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407804, "uuid": "e9254bdf-2cdf-4fa8-a273-989bce9a2284", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407804, "uuid": "abee70a1-77b0-43b3-9a50-4069fc489d9e", "value": "dca638bc267bc18d6b476325aaf015c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47281662-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426040, "uuid": "27f1fb61-e491-4019-b266-0ffb6b7899b2", "comment": "Malware payload (RedLineStealer)", "value": "0f5c746cfef3ce156dfebf6087dae616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426040, "uuid": "86673fed-e79a-4c1e-9075-d720a19c57e2", "comment": "Malware payload (RedLineStealer)", "value": "63dcc3bd3a873ccab35985e9bafcb941780ecc8ab04f333b00fcb8617c7e3203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426040, "uuid": "17c5cfb9-7feb-4ed4-88d1-9cdc7e8f8849", "comment": "Malware payload (RedLineStealer)", "value": "36f33965b37c4ba2669401a9a9df790604304119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426040, "uuid": "b87490de-8ac7-48f9-9aa3-268107d9ae33", "comment": "Malware payload (RedLineStealer)", "value": "e86be0cfae212fcc0d57313fa666d9c3bdef61de688fcf7f3f1caadb78cddca841999185be69f3b0f644dc31e9f7b941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426040, "uuid": "92b91c3f-0b15-482f-87c8-e3f1151b9750", "value": "T19564D0C23690C871C7A32D34C875CAB48D7BB861D960849B77783BAE6FB27C05A25317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426040, "uuid": "774ffe78-9afb-4d52-b490-5f4dd26a987b", "value": "890535c33f1fc2a002e2ca470b68a66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426040, "uuid": "90de5ae9-244a-4a36-b028-65c4dba62ac7", "value": "6144:ZyeE24QUwSm5E2WN9MMkeuC1hoShJ2hjy4b7ITsqV02:ZHEDPwiN9MzBC1ihj77W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426040, "uuid": "be63b4a5-d91a-4b5c-a015-46e5ec2af47e", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426040, "uuid": "da335b55-4a38-46d3-ba38-d2dfdcf0ee9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426040, "uuid": "93094509-a5b1-45e2-89de-9c4f87c1dc70", "value": "0f5c746cfef3ce156dfebf6087dae616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a323b1c-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426018, "uuid": "8827749d-d4d5-4fd8-b980-37a91aae3331", "comment": "Malware payload (RedLineStealer)", "value": "00bb1d4807cf4fdb5d5fa1382b5cc524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426018, "uuid": "906250ec-f956-483d-869d-f6091fd6597e", "comment": "Malware payload (RedLineStealer)", "value": "6534af2c6d30d7f766a208854e7a38e8bfe00762327402a8cf0694d9a32fee38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426018, "uuid": "eb20c1be-592a-432d-9b8a-dbc0ad7e1da0", "comment": "Malware payload (RedLineStealer)", "value": "52f11d343d934e8e949f2f24d516b0b3235226cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426018, "uuid": "dc5403d9-ab95-4b76-9379-e3a753cc87c3", "comment": "Malware payload (RedLineStealer)", "value": "7964aa14f97eaa535029dddeedb6cc22e9cbcb317edc5405e111a232c31f32a2b42f11d5c44bef24d0adce740067f877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426018, "uuid": "23f441ff-70ba-4a28-8c3d-8acd8426615b", "value": "T10A64E1C1B6E0C472C5A26B31C8A0CAE44D3FB861E960517B77783B9E6B726D0493537E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426018, "uuid": "4921b1fc-db8f-48b9-b5f7-97d4601efa03", "value": "da86082cd27b859e55ff9843cf87f36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426018, "uuid": "da944fd2-82b1-4c2e-a942-100843fab6c9", "value": "6144:3WJmC84biV44GZRIWC5kJOKj0NGH4ELcNFBceJPb7ITsqWHuN:3omr4bFJZCh5QR0NGH4VNrceN7FO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426018, "uuid": "2f3ab05e-2ab5-4da9-9a71-f02b34383506", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426018, "uuid": "202bb7e9-42df-49e9-bc3c-b42a026153e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426018, "uuid": "12af7329-4167-48b5-b080-da17c2129291", "value": "00bb1d4807cf4fdb5d5fa1382b5cc524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d857331b-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639426283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426283, "uuid": "a47caf22-f20d-4f99-82e3-875667a41914", "comment": "Malware payload", "value": "f25f99160f53de6443616a127637d90a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426283, "uuid": "81e77182-da68-476d-80ef-194a88f50cc5", "comment": "Malware payload", "value": "660fe8ad69670eeba2c95a5a011a8bf98b0effb5398cf1ff6c3a8a759a3bc0c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426283, "uuid": "3ee31120-5ce0-4e8e-831d-119f219f4f4d", "comment": "Malware payload", "value": "fc2d05b74442ce84eaee52562b74ed85371f0777", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426283, "uuid": "c1490d56-b417-42df-a541-6d87034195ff", "comment": "Malware payload", "value": "5357ec496accb4be26bb0c06b7d950c09898df10fa3c4b985710de979d04f067175164612986a9144587342e0f54bbcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426283, "uuid": "f1a8c084-8323-4660-8a93-1eb7ec255a01", "value": "T18D55121A33B5AE55E06F17B9C470C2348736BD04A822C31EAAD53DAF7E3379189057A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426283, "uuid": "3419a58a-1f60-40a0-82b1-f215f6ddd0c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426283, "uuid": "f2d0d770-dc70-4464-8c3e-225c1bfd1411", "value": "24576:Ch3UCC6Z1ofjOlU5xNdTWisX99ZillP6tAXOHtEga:Qy6ZYjOuPNlWiM9MlecOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426283, "uuid": "97a53bf8-f9cb-431c-a141-58564bfb19c3", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426283, "uuid": "fddc5099-ae85-40d6-929e-ff4709e32440", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426283, "uuid": "7032c7c6-2460-4938-a658-ecaf77efdf27", "value": "f25f99160f53de6443616a127637d90a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4ee8e5-5c3f-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639419041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419041, "uuid": "30e36f77-5326-46f8-9e9d-737386d327d0", "comment": "Malware payload (OskiStealer)", "value": "2ca75633e72f1577f91c95af18a7426f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419041, "uuid": "3aa27b99-5ee1-4aa5-9daa-41b3410d96ca", "comment": "Malware payload (OskiStealer)", "value": "662cd105cb4bb0060036ea229c5a391a932ba4a9fbb5cb6020ba027026085058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419041, "uuid": "d1b4b712-9d79-43c8-b72c-1a9019c348e1", "comment": "Malware payload (OskiStealer)", "value": "a71f3b37f5f669ee853a673bf567adbfff2fdc9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419041, "uuid": "0a88218d-bd3b-4eae-8b9c-c5b8ca759845", "comment": "Malware payload (OskiStealer)", "value": "490f009fa812e8cc1c608abc6e420d7b2181be491df6b7a439b93e14522b9480c6aa061ed6a02555f77e61d7573b6776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419041, "uuid": "87ff610c-52e3-4a71-abaf-c352f61ea2f4", "value": "T11A55126D77989C10E57F17B8A070C1308339AD05A826C32FA9D96CEF7E73B9099057A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419041, "uuid": "67da93b8-2dba-4b46-888f-6f3a7919c8f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419041, "uuid": "146380be-b7cd-4b24-8b7c-2efab576c31f", "value": "24576:XrO3HAys6tZ1mZpkbxMgncwaHgiG9RGA8cM0WYxYJ3kMEXOHtEgaFGG:XaHCkbgfuR/xYJ3H4OygaFGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639419041, "uuid": "3edd85ce-4eb9-4b7c-a87d-9eabdd8828ed", "value": 1352704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639419041, "uuid": "bf59016f-3f90-4585-b6fb-ccda0d373071", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419041, "uuid": "bf755bb6-7d1d-4b8c-b39a-329de3408d6b", "value": "2ca75633e72f1577f91c95af18a7426f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29236302-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639407521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407521, "uuid": "6b894b21-aca5-41cc-982f-f1062ccf5ffd", "comment": "Malware payload (Gafgyt)", "value": "ddcbb1118638030d6d634a127b5093c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407521, "uuid": "c2e9fb54-95ec-48af-ae86-ff1d93604626", "comment": "Malware payload (Gafgyt)", "value": "67a4b71386edc73e6b350d37b2369f3c89bd3410d814562a8e99d16dd3b07db1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407521, "uuid": "9447f40b-db97-4da6-a1b3-34ad055bd92e", "comment": "Malware payload (Gafgyt)", "value": "c88678106e97fb69427c6391f21ee550591037d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407521, "uuid": "32e5f26a-3442-4332-ab3c-5abfda2d550d", "comment": "Malware payload (Gafgyt)", "value": "1787146acd8317547c86692e7750f1b10078e433fbcc9cad6c49eca56b3c9bf760f2fae770c2173c0ad29f7608b387f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407521, "uuid": "1a0835e5-f440-4763-a9ef-c7dd6bad012a", "value": "T1C6C32905E8918767C2E217BAB79A425D33332B6893CB33255938AFB41BC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407521, "uuid": "598c5e72-f4f3-40a0-af58-358c5b5af4bb", "value": "3072:KdB2qwap6KVXPi4jv8x+QMDkmDhZmTQOIsXAqE:aRwap6Kt6+QMDHZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407521, "uuid": "581ce027-af6d-49d9-8a82-145057022773", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407521, "uuid": "e266d224-bd77-423f-820d-b8c70c79228b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407521, "uuid": "0e2802cb-87ef-489a-b93f-bdfa99a7b02a", "value": "ddcbb1118638030d6d634a127b5093c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900aeb90-5c04-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639393520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393520, "uuid": "b6c9389d-fde9-42ff-896c-382c01642de2", "comment": "Malware payload (NanoCore)", "value": "09f2566880de5dbdbec129f92cd84e94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393520, "uuid": "8eaf591f-8aa8-4a62-ba2f-58a60ab8e3e5", "comment": "Malware payload (NanoCore)", "value": "681b71e1387d3969b8fddf7ec2e33584e6c39f9ddde0a85a649201b29fe74134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393520, "uuid": "6a85cf54-20ca-42dd-8747-138a6c5b1853", "comment": "Malware payload (NanoCore)", "value": "1b443816462b4bb253dda7144f98e4d01d06450f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393520, "uuid": "c5a76366-369a-4be0-aebb-d1b67abd8109", "comment": "Malware payload (NanoCore)", "value": "96a2297083bb4648733717a4c108d2288ebeeeaa16aa2f33ce5113c9aab1b7827113ba3778f56b63665844a71f1598bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393520, "uuid": "619d7723-1ae6-4092-aabe-355a0cee0bee", "value": "T17B25BF0277A14F64D55EF37B0098A96813E3BEC72D50C78D6F4B4F58B9632C62E1E24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393520, "uuid": "dacc055c-3880-4610-bcdd-ceffe701a509", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393520, "uuid": "f9f4055a-4485-4954-ba89-35e9b3f1e8cf", "value": "12288:nDCY7oJ3QnG0afLYnMQXo+dyfTIt7oN1VPmbIMOCf9Ia8raQIAMFpC:nOYQ3Qnv2LYnfXofb4Ewd8rTPqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639393520, "uuid": "ed10da9e-a9dc-4086-b0d5-12af3810feb0", "value": 1029072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639393520, "uuid": "97749c7d-7232-42b5-b3da-b3ba72016771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393520, "uuid": "77036856-6b92-4149-9c81-6c4a7cd977b4", "value": "1b443816462b4bb253dda7144f98e4d01d06450f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0adbc0-5c38-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639415715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415715, "uuid": "986c11ed-1798-4b40-9023-e08a04ab9358", "comment": "Malware payload", "value": "abcf9f2dec9eef99ca40a74abe5c2d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415715, "uuid": "3c091400-279e-428c-89a0-e176b3b3ff96", "comment": "Malware payload", "value": "682e442108abaeb67d6c64bd2117a33140d5f31b8fd2a9dcd3dae6becc07ea33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415715, "uuid": "be6a9e64-1cee-432c-9b57-a6eacf5ea497", "comment": "Malware payload", "value": "b6140ad857d4244df733b464008ebd259cbdd88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415715, "uuid": "cdf8dc85-717b-442f-af7d-4843269ab772", "comment": "Malware payload", "value": "2062696a970fa64c7aedacfc47569ab906a9615aebad0c6f76404fd66b0657b5e17afd3460a8aad7cbc6d9dbcaa64887", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415715, "uuid": "0d06c576-dd26-46c6-8ca5-d7ac5dd95ccc", "value": "T1B2C4AE1236D49BA4F9BFE7740CB1719003F5F9DBE610E19DFD98108E9862B808AB1772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415715, "uuid": "629ba817-338c-4d93-a393-067e192f1516", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415715, "uuid": "29c50f89-525f-47a2-8c69-4bc83f4f40d2", "value": "12288:lW2Zz37VXbGEgNTOiuSXISYpt27zSoTY:c21bGjTOiuSbr/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415715, "uuid": "bf23d780-1e0a-4a9c-b45f-b51361fca0e3", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415715, "uuid": "421a2c2b-24da-410e-a944-8bf1d23c2f48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415715, "uuid": "5c6f054b-a6a0-4f95-8c62-29d43a76e7b2", "value": "abcf9f2dec9eef99ca40a74abe5c2d57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca6641e-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407876, "uuid": "004f5213-a07a-4e2b-beba-d8367d5bd9f0", "comment": "Malware payload (SnakeKeylogger)", "value": "2e60221702dce353df65f1bee1f363de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407876, "uuid": "6699f4a3-8385-4b3a-9c76-acf6693763ad", "comment": "Malware payload (SnakeKeylogger)", "value": "68335c1904338240ef6c36cda7aa10a2b1fbdc1c722f9044d98da975e1a756ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407876, "uuid": "80d81bb0-6869-452f-b82f-8a3bfb5b38ab", "comment": "Malware payload (SnakeKeylogger)", "value": "f1f62db9e2ad38552b5436b186471ed540081c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407876, "uuid": "f681e6a6-57df-49aa-9fa0-1342f5fd3cc8", "comment": "Malware payload (SnakeKeylogger)", "value": "c7b9d2b8673b53f035186075917ae96643bc3daeefba0f3a10dc81b148ac7bec9f2727d17a8eea304edc87f97584f629", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407876, "uuid": "15a684ba-1ba6-4fda-9893-7143e1940d92", "value": "T12F45126963A49E24E17F1BB98071C130C3317E05B922D31F6AD53CEF7A737A09A09697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407876, "uuid": "77b7f260-6353-4b50-8b83-d5b1a3161828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407876, "uuid": "fcfa9813-410a-4c37-b624-95c9c68a4faa", "value": "24576:tiXOHtEgaUmKgYnZ1fQnJcJCFL7gyQV1mXWJ8wQJEWytR8S:YOyga7WZ1fQKJScy9mJ5tR8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407876, "uuid": "d0829131-7d97-48e0-a760-e684f02e328c", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407876, "uuid": "b72a8db5-ebe9-4415-812a-79527f5bde7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407876, "uuid": "f67b7ee8-05a2-49dd-b341-cadc62da234b", "value": "857684 BANK SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674efe97-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639426094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426094, "uuid": "ccdba0a9-0c76-4eb7-9d37-3298d8b08a61", "comment": "Malware payload (Loki)", "value": "132d7ff38b7bf7fd5c5c5938884c0e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426094, "uuid": "bb80f30a-aa02-4953-b88b-639bb2c5409e", "comment": "Malware payload (Loki)", "value": "68e8499535395fe33b9ff39217b5784362c4589026f1089a24287e70ecdc91d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426094, "uuid": "781e39fa-5ebf-4463-87a4-ba2d2facc580", "comment": "Malware payload (Loki)", "value": "4c17ece8a24a68674a6eeae3609486073f279d1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426094, "uuid": "d6c448a2-8730-4664-a996-6341ba404b2d", "comment": "Malware payload (Loki)", "value": "7339a99ae6750df40b8d530bb12027cae09a4cd05c54d9f7e0b81486a60e2cbc3048206bee33250e48bd81bdb22fa4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426094, "uuid": "a9c60281-18ea-49e0-a5a0-72bf3e71a8be", "value": "T18D45122973E44A15E16E17B98471C1348331BD06B92BC30E6AD87DEF3E73B90984A797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426094, "uuid": "61a708bf-4bfb-47e4-ad10-d0f941d68906", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426094, "uuid": "6249505b-2512-46e2-93f2-3de15e7529a7", "value": "24576:mjv6tiMA4ZjnkVuZ/ZhgTouiedOHtEge:e0A4ZLCuNZ27HOyge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426094, "uuid": "90b3fa39-c1de-42ed-8a0f-82c3dd1023a2", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426094, "uuid": "3151a87b-1b11-48ba-8619-217fd5320354", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426094, "uuid": "2dd5af97-5311-46b4-94c7-660e956bb040", "value": "ZH0008766420.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d64b41b-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425997, "uuid": "16cef35d-79bb-4f9c-beb9-86c49b681bfd", "comment": "Malware payload (RedLineStealer)", "value": "91f14985ea29c141c58bcdc347a4ea8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425997, "uuid": "03857161-6d2d-488c-af32-8a559a2646b3", "comment": "Malware payload (RedLineStealer)", "value": "6a257bd8b07322b7f6ae6ce4370c9c7a272855d9a9ca76f8932b94826ff3257f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425997, "uuid": "45a6ca8d-9b9a-4a5c-8834-ed09ce760574", "comment": "Malware payload (RedLineStealer)", "value": "a9717427912e76aa62d3f3876edfe4a320859fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425997, "uuid": "1dc2e0bb-2db5-4450-a0f5-1f220100b1a5", "comment": "Malware payload (RedLineStealer)", "value": "2b0299b1c90d18a28175fa5d9c4913f8d8602a6bbca4ba34e90befdebc0fdc57a5f013ee1be6a974dacc73f0ac7dc602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425997, "uuid": "e6214fde-3649-41b0-b787-6dab65c53328", "value": "T17564E0C176B0D473C4A37E3544219AD42E7BBC61EA6C814AF738779E6F726F05A2130A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425997, "uuid": "c33d00a1-1bcb-486a-a7bd-f3bbf6410f17", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425997, "uuid": "9d4ed360-d2b9-4ce7-b06b-c5c4d882f148", "value": "6144:cQ7vaHybyqqkLYvXYznWrUtMcJpObmB2C4b7ITsqB:ckvXqkkfYDWI7pOiBNI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425997, "uuid": "c28f804b-c092-4928-b86f-5c6053e3c169", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425997, "uuid": "d6acfbc0-3d43-4da2-a4b0-fa03e8010326", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425997, "uuid": "725c0218-70d5-49ce-ba63-6418c3b4e94d", "value": "91f14985ea29c141c58bcdc347a4ea8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11dd258-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407776, "uuid": "ef01280f-5bb6-47f7-91db-09713ac3a620", "comment": "Malware payload (SnakeKeylogger)", "value": "eb65ab707767847e2cf7aedef23935eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407776, "uuid": "62d67fd4-13ad-41fc-9708-c6c7c1d4805e", "comment": "Malware payload (SnakeKeylogger)", "value": "6a3ab5b55e9d2207c537a614a07cf4c662f9a3c75ae7297ade6cde040bbfaffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407776, "uuid": "e1fb0f2f-76a8-41b3-b4e0-f738d3d021d3", "comment": "Malware payload (SnakeKeylogger)", "value": "e574d20186525c47bd67baed2ceae27523bab6b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407776, "uuid": "a50fd328-c8a9-4325-b634-19820adf6b22", "comment": "Malware payload (SnakeKeylogger)", "value": "0133d9f6c526772060645dc75a3ffe40c5deda477fc2e9043f9ed6e0ae1e26e9c0a59364eb0ac6b6956dbc84609293f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407776, "uuid": "36e1dabb-449d-4661-85e6-ef3553d9985f", "value": "T10F45230BA71CE740D0AE89FCE1B16600A37426477512F79E1CCBF5E53A3A7D14625AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407776, "uuid": "004f9b65-d78e-4401-ab66-b56eeee2c8fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407776, "uuid": "08114aac-268e-4960-862b-0d9065ff80db", "value": "24576:iWyebSATyLFwbxjeK9+mrKtstabGqe6hydrmCmQ:VByJwsKgm+sQbt2rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407776, "uuid": "cd17b4b0-b447-4aca-a58d-c0cb52624ce7", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407776, "uuid": "7334940c-f557-40a9-9eff-dcc3a3fa6894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407776, "uuid": "3708d2b7-e984-45b0-920c-9c393cccd617", "value": "Account Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d08111b-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426023, "uuid": "c2a6c956-60a7-4762-8abc-49bf1c95de5e", "comment": "Malware payload (RedLineStealer)", "value": "eae5e1fab890c288494833ed40febdcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426023, "uuid": "e22194ae-b3bb-4f0a-b330-de905747fb5c", "comment": "Malware payload (RedLineStealer)", "value": "6b3f6341a2a66fd345ae55eed937c37b524165d96fa0fb7c56e2d91536bd1bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426023, "uuid": "cb0eff7d-6a40-4ab5-a25a-e76fdb3e07e6", "comment": "Malware payload (RedLineStealer)", "value": "eb225ceab8a5ff14a85ffc9b113b0d8b06192bc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426023, "uuid": "59e4e97c-049e-4229-987b-20162ea8d9db", "comment": "Malware payload (RedLineStealer)", "value": "858ef3c845ef3dc09b227145c6c37b58eb7813c796cf3a232b6edcaf4bc199e8f841f1a2fd791dab9c787e01466e780e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426023, "uuid": "4f04de70-8972-4b5b-ae7c-0dd7fdada897", "value": "T1A964E0C135A0D832C5F26D358B35D6E50E7FF951DA60818B77B82B6E6FB22D04A32316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426023, "uuid": "31add7c7-51a0-4fa8-b3c7-e981b74755ec", "value": "da86082cd27b859e55ff9843cf87f36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426023, "uuid": "997acd7e-341b-4527-8f79-cf7addcb4ac9", "value": "6144:eWJ7N2Zuisb3/c1sNgb6yuurWQAeAQp1Db7ITsq6TzYE:eoI6EIE6rQAepd7XTzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426023, "uuid": "db76bcd1-7ebb-4dc6-b83a-c30829f54584", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426023, "uuid": "b499627f-1f6a-4d4d-ac76-702c188b2dab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426023, "uuid": "0736e773-a0a2-4b5a-a861-d766a1e87315", "value": "eae5e1fab890c288494833ed40febdcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf9a877-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425967, "uuid": "f83f7f33-48f9-4218-865f-6ca037635dc1", "comment": "Malware payload (RedLineStealer)", "value": "144a1e6d75a36f19d59fc796fc2f164a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425967, "uuid": "99daf532-37d9-4423-aa95-535fd260fb29", "comment": "Malware payload (RedLineStealer)", "value": "6bd1d608a30c9fd397668eba0bd7cbcfcbb8604887c144cbd7851a5567a7eac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425967, "uuid": "fac7b6f2-bd69-457d-8b17-efc726a9f67f", "comment": "Malware payload (RedLineStealer)", "value": "00997d020000d4c88ca544c7fb6c7ded88323793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425967, "uuid": "6fb6c211-549d-4762-963e-10a6550abae8", "comment": "Malware payload (RedLineStealer)", "value": "6a6a8ebdefb9b6c3c66d4de64beb6c093193bb3998f28f8b029e7ad3871cb53e87a5258649192c0edf5facdfe6e0e3b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425967, "uuid": "a5131d96-6b67-43ef-9689-942720448c8e", "value": "T1A964E1D179F0C831C2A22A318875D6D84E7BF851EB62A5CB737437AE6FB26C15631312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425967, "uuid": "ee1a9964-94a8-4954-afeb-a2704b986720", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425967, "uuid": "4cde4e31-2826-432c-8ac7-9c98ec6df787", "value": "6144:rh7P1k2GvVby6yqfOcTzCTbOddzkC1vNKuv73k6vQ8DWb7ITsq0:rRP1k2GpBdzqbOrpvNKYbnK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425967, "uuid": "b8370bdc-abf3-4d1c-a2ab-70d8078d5c59", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425967, "uuid": "f6f1fa3e-0087-45f9-a250-3ff51c1d4a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425967, "uuid": "6b7b8bf0-3f37-4fd9-b3f9-e2936a94ae2c", "value": "144a1e6d75a36f19d59fc796fc2f164a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb2352f-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386802, "uuid": "3ee3795b-5e6f-4482-b5ce-600c305f08c4", "comment": "Malware payload (Mirai)", "value": "eaf1d7239369ad9743f5d8735a570c6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386802, "uuid": "b0013268-2ef7-47b9-8ef3-4188b3adfd7e", "comment": "Malware payload (Mirai)", "value": "6c41a2660f5b091e00502369449293f7d681a6fed0a86a27ca28b05ae83fb987", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386802, "uuid": "2ff80b18-d791-47af-b76b-e829b70fb252", "comment": "Malware payload (Mirai)", "value": "d06e5c46426f95aa42442ed484b58139541417ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386802, "uuid": "51eac1a3-4bdd-43f9-8b2a-d9f4a0e0a132", "comment": "Malware payload (Mirai)", "value": "304772d5263dcaba5f48db529d488084c9c87f7ef51c2d8f3c4c58bdd58b4012dd052da05770aad134f1b1d0bab0b7b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386802, "uuid": "d56495e2-4b0c-4bb2-86ab-936dbe3cd49a", "value": "T15FF34905E6408B17C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386802, "uuid": "56565928-a60b-412a-8853-c9af79cfea40", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBIYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/KYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386802, "uuid": "9ee14be0-f8b6-4f65-bdc8-a5fb1c4db8a0", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386802, "uuid": "fbabb339-a3e5-44aa-8852-9fbf17538cbf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386802, "uuid": "7432c582-a703-4bbb-bde6-af8a2828412c", "value": "eaf1d7239369ad9743f5d8735a570c6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f2143e-5c09-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639395701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395701, "uuid": "b46f3e73-2381-4fb9-908a-7b50e440343d", "comment": "Malware payload", "value": "50011cd35d6c14def67c6a28c7e0554b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395701, "uuid": "2a303a5a-cc4b-4858-8ee7-0b10991e6729", "comment": "Malware payload", "value": "6ca3aa73fbd3db3dd5b0f42e3a20dcb881b36920e1bbc16f4ef1c5f84498a1d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395701, "uuid": "97faf055-cddd-4ba0-a7e2-3649b54be695", "comment": "Malware payload", "value": "f31db572d811db56a47ac3490e317f463a58165c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395701, "uuid": "b44a5848-0612-471b-8330-8045ce152086", "comment": "Malware payload", "value": "920145098c08c3ea3cf97bc57eb8f306fc3995d1553988276f7f4d5b68203e9e49fac54314981778f030a7b6e2662684", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395701, "uuid": "868515a6-df3c-4d77-862d-688baa26babf", "value": "T170D0A7BE89DE5DE023D624C4098A768A40494337D1503B9CA2CE009301542B08EF23F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395701, "uuid": "ece5666b-8fbf-4979-8f8a-30339f36aa3a", "value": "6:dSZCliNStVb+kPvmnVthcnka7EkBfekqe2GnA5:sCaStJ+k2VthcnkqNBm08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395701, "uuid": "cf40a4f8-7805-4e13-a751-4b43a5be113d", "value": 228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395701, "uuid": "e2a5fd29-e435-4f01-bd12-33f0358d32f1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395701, "uuid": "6fd21aa2-2403-4b15-b2ac-20aeaa718e0e", "value": "Spec-560998920.csv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fcb54b-5c13-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639399738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399738, "uuid": "32ff3989-c939-44ef-b246-e10c8acbdb9f", "comment": "Malware payload (ArkeiStealer)", "value": "b27fe69bb086d3d1ec655302268b0bce", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399738, "uuid": "57abfc7c-57c4-4f8c-adaf-d490107d5cab", "comment": "Malware payload (ArkeiStealer)", "value": "6d7553b09093dc8ff76acdb351b4cef88aebaa05ee58c1ecab5339d03c68a10a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399738, "uuid": "c8065b5b-1d36-46ff-a061-b977ff6033d9", "comment": "Malware payload (ArkeiStealer)", "value": "4440629906728e7f10ec786883bdf244f65dcaf3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399738, "uuid": "1a13be4f-7f2f-4e8d-9b99-c29355708545", "comment": "Malware payload (ArkeiStealer)", "value": "d7e8dd188264cced3a762a424dfd470ac0305e06bfa262ae7d088a0a67eb90dcf41b392845ae1fb955f689e94b8f6431", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399738, "uuid": "2e4039ed-1032-4607-8ff8-ac92685f1290", "value": "T121F633AD56CC2AD0C4C28EF584FC66970A1CFB812D4FE288A314CE3B7A556CB649F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399738, "uuid": "0467a961-ef6c-41e4-ab9d-cf5044750993", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399738, "uuid": "3d8eef1d-c350-4921-ba9c-e49475873792", "value": "393216:Jhb+IRxr4PNmR4Eki6Lp6mgj8FAriXmwVbl3xUuyax/nnArM:Jhblwzl6mgIOu2sbnUFQn8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639399738, "uuid": "f035af61-6156-4454-b218-03a3ecf02396", "value": 16435014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639399738, "uuid": "06551183-4edf-47eb-8e4c-6a074819d6b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399738, "uuid": "f07be05d-29bf-46f2-8ab9-94fe93fa126c", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcd63b6-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639395050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395050, "uuid": "00061428-d164-4f45-8a36-c1cbf3b2b525", "comment": "Malware payload (Formbook)", "value": "b195fe17360092c3b7d580fde43fabae", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395050, "uuid": "a1a64e13-69cf-4bb7-aca6-1f52727b938c", "comment": "Malware payload (Formbook)", "value": "7070da9e9a144ee3e01f13ba44186975038b20b72f946fa202f2e10612378cc6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395050, "uuid": "0a476162-6490-4918-a72f-de2dc6cfba85", "comment": "Malware payload (Formbook)", "value": "95bb85bbb86bb343ff1e6246cebb1bb511e21392", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395050, "uuid": "1128d9e2-3366-43f6-bb15-5a2fb545ffdc", "comment": "Malware payload (Formbook)", "value": "11893b25a72e81a7f8cf4ad84f07b8f66be3b33d56025942a795437b3ba7a1940d1033fed6f4eeb3bc32e7bf7c94eef8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395050, "uuid": "4b84661e-0d4d-46c7-b6da-99b5390c6f80", "value": "T110A42315A996196DB384C58F7D1E2661073FE9B33978FA73F16D0FD900A2CF1DA81620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395050, "uuid": "bc897cee-fceb-412b-b5ca-967d2e758b47", "value": "12288:CVLqqyaPig8vXsBZCxAlxKxZvgtosDHtab:CMqyat4sj0A41gto6NY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395050, "uuid": "b5c38a41-c814-433c-bbb6-7f74653765c4", "value": 458415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395050, "uuid": "ee2149c5-7963-4df0-922e-ea63ccc83f39", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395050, "uuid": "d4693b5e-ce12-485b-947f-57267f79a4ac", "value": "IRQ2107799_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b791e2e7-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407760, "uuid": "d2ee773b-15f7-4e5a-b168-9122005232fd", "comment": "Malware payload (SnakeKeylogger)", "value": "b1e3e256818de7296779b68d197918d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407760, "uuid": "8d08dff1-baae-4926-b1bc-d11e8ec44a48", "comment": "Malware payload (SnakeKeylogger)", "value": "709e955453f4533001812914951f93d9889faf75bbf63bb44d73353019559831", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407760, "uuid": "5b667927-3835-4ee9-8922-6001f7994555", "comment": "Malware payload (SnakeKeylogger)", "value": "0aacb42b195b36dba83acb8a55817f47277ef5f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407760, "uuid": "903ee7d0-3ccb-4e7e-bdb8-ca91f7d662ff", "comment": "Malware payload (SnakeKeylogger)", "value": "953d093b6b9d99f3c6fb4b440811b757dfb130271d36075188ea0a82f17e37970261c072d5618a664db5511d91c12dc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407760, "uuid": "734738a6-62ec-4077-a237-adbf0744b8de", "value": "T13D45331231F49F27E5E8E3F92060B8C55B765904B615E37D4ECF20CA2A72316EB61AC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407760, "uuid": "8e6be1a1-7b90-48c7-a6d9-29596f7e3f0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407760, "uuid": "45b49dcf-be64-4331-be78-746e49d2a430", "value": "24576:cgPkPIG4WDPibeQGucE1tR0XTAM+TotNOB/LVayJ0QEb34nkoK:VcPX4WmbhGKpMKoWpTJ0D3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407760, "uuid": "9b7a1b2a-33d7-4b60-b54e-5fc25aae0183", "value": 1226752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407760, "uuid": "7040979b-45cf-4353-8d8a-faf226c64041", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407760, "uuid": "2a14b489-f135-4e9d-a8f8-4d8e82d813d5", "value": "Halkbank_Ekstre_20211101_073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bf5240-5c4f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639425905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425905, "uuid": "86e55d86-cd6b-45bd-80e8-43b7b451451f", "comment": "Malware payload", "value": "99b0b0817c504aac8eb69b46dfa6c307", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425905, "uuid": "fac8feac-77a7-4cfe-8c39-696fe4715e06", "comment": "Malware payload", "value": "70afb5e05f6645b5d3974350cd322acbb30630bb169c277b39b65a0cdc7087d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425905, "uuid": "367fb502-64cd-473e-8001-6875c573421e", "comment": "Malware payload", "value": "4eb0fa1f90eb618fdc433344fc871dd4efee2340", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425905, "uuid": "8b9de0ff-e07e-4bcb-9013-ba0f49c5f0bf", "comment": "Malware payload", "value": "710be55cd0f15acddb90f496de0f126ac965c213c8d2839eb5f38d92f80bb7d1fc5dbbd9af9e42af7694732d46d4dd4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425905, "uuid": "39296783-479a-4401-ab24-411f400254aa", "value": "T10A55336762BCBF4ADB2D4BB03962971013BA388E3102F79C1DDA30E915217D14A65BDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425905, "uuid": "2a2d33bc-758f-49f9-a75c-46e1a73f1382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425905, "uuid": "2744b2ec-f5f3-4b53-beb4-c867bb8b7b87", "value": "24576:gVSqnOUOu8slXDCyxr/J5Oc+Fq2LQSDzUE+/L7GZIZ9XXY8U3A1ThJfThloqWjhA:iOuHXDC0rB3gq6Do7GG3nhR19hloq6dM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425905, "uuid": "b0db7c94-55b4-417b-9c55-4b1b126cc103", "value": 1325056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425905, "uuid": "1253ac6c-b0cb-434a-8932-3d4f7c425601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425905, "uuid": "d0748fa8-6c4a-4cd4-9c12-f73d7197409b", "value": "99b0b0817c504aac8eb69b46dfa6c307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b04f7e-5c33-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639413719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413719, "uuid": "266c0164-177a-4d12-a45f-d9ad9feb7a8a", "comment": "Malware payload (Formbook)", "value": "7cba2a6fb71317ba50994daf77fb4237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413719, "uuid": "376d9fe8-7cd0-41ba-9251-5b5a4735dd72", "comment": "Malware payload (Formbook)", "value": "715e8885c06569189466a8c034e43370b745238756cda09f017c2c2fae52e84d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413719, "uuid": "9973b2c0-9ffa-4780-b87b-d030fb3fc7fc", "comment": "Malware payload (Formbook)", "value": "1b69d27dfe2e4d34ed7d0db16638bcb87ca296b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413719, "uuid": "245f13a7-1679-47f9-bc22-c3c71a762a8a", "comment": "Malware payload (Formbook)", "value": "c7395f9c9c91df39665f22ef1300e076da6e3569634c9373b294473a40be211fb36bd9d721dbef155e663a394db5198b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413719, "uuid": "b2980f25-8b69-4fb2-974c-8e2391daffcd", "value": "T1A0552347F6582B16D47C53FE2650466403B2550D6A33F1AE0DDAE8C72BD87428B2EBE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413719, "uuid": "8f51ca20-eac1-4d1b-b775-506a253e27e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413719, "uuid": "944dab82-c890-4d4d-8114-0e1c74abc7da", "value": "24576:ZfPMWFbggbqyG/xWiXOFqCzfojAF7A6VNlpKlWxtKSuzpKjLU:p7ggbq7/PvCd8IxESudKjLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413719, "uuid": "24d091df-8112-4215-8488-4dae79d5bda0", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413719, "uuid": "f2ec1513-8b7d-4a01-b348-e0dc8d634393", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413719, "uuid": "55f59ccd-7206-466d-93f6-7d2c3c3396ed", "value": "SOFTWARE LTD PO-09890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c65680f-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408385, "uuid": "41ad8c71-be4b-4f4a-a271-1ce696ffb2f7", "comment": "Malware payload (Formbook)", "value": "5a849b95bc49d7270d57a5c29ecfae27", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408385, "uuid": "749cdf94-5eeb-416c-a62f-0cb47befec91", "comment": "Malware payload (Formbook)", "value": "727a46dce366fce2396dd5dcda624956e315b63adb2a2766cae937d92ca31192", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408385, "uuid": "ba0650c8-9415-4e7d-8ecf-f1ab0226a2bd", "comment": "Malware payload (Formbook)", "value": "40a5ac30d999792000310ca01df495bd978fc527", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408385, "uuid": "f426cd59-1561-42de-8077-537975ad53ac", "comment": "Malware payload (Formbook)", "value": "04f0652ced34b6b3bdefd1668b887c5b3df39cc2caf7efb0d401c8a40060424ec6b88cc18705287a21a09ee1dec90a83", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408385, "uuid": "8f06c8c0-2ffc-4e89-8755-b69799c3adb1", "value": "T16F64122878C05956F4FD05BA5BD8CA06D203ECA4421F99E02BE7F34C1FB771679AA4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408385, "uuid": "58666ab9-9b34-4b7b-be13-9685b6ef131c", "value": "6144:qRFs11cVWdLQBLTHauB1YP2xgWXMJ/ZmPQdSlHZWvk+I5hQyE:6FhVMLuLT6uB1YogWY/ZmSSl5b+I5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408385, "uuid": "f19342c9-c7a8-4631-8f26-e43eb0419c6d", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408385, "uuid": "6deee73f-1c2f-4ab6-8779-85df4d264b0e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408385, "uuid": "67200142-bd8a-4a13-8350-0d6b8fcf40a1", "value": "Project_Proposal_FileNo.28-6846.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce6db33-5c5f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639432733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432733, "uuid": "7d135ec2-5389-4fcf-af6a-ed7363e773c3", "comment": "Malware payload", "value": "758bc57891b455a9777ffabf2317cdb5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432733, "uuid": "5295f9b4-0aeb-438b-9ebe-c3bf403508fb", "comment": "Malware payload", "value": "72d6c00c9f2fd5868669c7fc70042bf0f1c2a0892d1b8423ec8541ddfb44650f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432733, "uuid": "f008b908-2a55-403d-980e-7880354a3699", "comment": "Malware payload", "value": "ffc3f4f7b5129bd201ac4d2ee25074fae3d3da7e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432733, "uuid": "0ede91fa-1d7e-40f4-8bb6-36b97bef43ac", "comment": "Malware payload", "value": "684e6e9e3c1ffeb7ba2b3510dc58fd6b2ba2f05f34e53bc0e9ee233549d935881e0131fe26a93a9ac8a3232d063746c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432733, "uuid": "abf7bb32-2a45-4e9c-9e49-4a45b8c380b7", "value": "T15C64386595C3003FD991E1F1E98A5182D3EB2D0C799ADFE6E91E083EBC5016593BEE0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432733, "uuid": "fb98edb2-2923-4a8d-a50b-69e7c688f00f", "value": "11168e553d7328dce5786fbbf9b0b14c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432733, "uuid": "6cee6eb3-76db-46c0-92ef-f3194747256d", "value": "6144:miTVctYV+wZaxVTnCfuj1trHRcWGzsQDk3KPlinS++YPH1m:mi6tYVVaLRJtrxcb7cAinv+YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432733, "uuid": "d92b5c4c-2dc8-4a92-a788-3a7b784d7ad8", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432733, "uuid": "962fd2a1-5e1b-49ca-80f0-da9cb7180a02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432733, "uuid": "0e36704b-cb97-44d2-bc42-50e1b0f072d0", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.11836.7659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d230e03e-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639414247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414247, "uuid": "12946987-b611-4a72-b7ec-18f26ab96d7a", "comment": "Malware payload (Mirai)", "value": "31f76dd1cdf1b48eff5b127c26672b8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414247, "uuid": "75de5d3a-2308-4b10-ab2f-557cfb423115", "comment": "Malware payload (Mirai)", "value": "734aefdbf69b0789cf1a82f9b68cda04c1afa1e7e185f9e58ca8e875a162d201", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414247, "uuid": "0c187c42-5765-4943-a74d-4e2a09709da5", "comment": "Malware payload (Mirai)", "value": "979443baa3bf4e22a949c024fd259357fa96edc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414247, "uuid": "1fe28ab0-3af4-437e-a4b6-de1516057b56", "comment": "Malware payload (Mirai)", "value": "288b84d43034b6dc31aeedd358bef951a5b966c584973e8286590f650063fe77ac45789a23ae91d9baeed135205e4b3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414247, "uuid": "49a5d088-ce76-41d2-8bda-7145f52e0fdf", "value": "T1555412EB88BB99CEFE5B4FF5355B0D0E0EF6E0D5E5C52C94916A00802BB8346A514B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414247, "uuid": "9bfa8862-c0d1-4bb4-bdd4-fdaa6df0f8d0", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414247, "uuid": "26aec5f4-ac65-45d3-baf4-1758652b790a", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414247, "uuid": "142355dc-54a1-44da-bbb2-21281892d1f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414247, "uuid": "aef0b119-576a-434c-8082-42cb9754fc00", "value": "31f76dd1cdf1b48eff5b127c26672b8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eca6b64-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426053, "uuid": "efa3c8dd-e94a-430f-ab62-42bfb5f0dedf", "comment": "Malware payload (RedLineStealer)", "value": "0a1f9f125075fff2b1945ad80c2c2c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426053, "uuid": "fc827244-5512-4ce0-85d4-82ff83d79788", "comment": "Malware payload (RedLineStealer)", "value": "73d1f16df6a7e9d8078de288aa9d67001360ac8e9f79da4db1ecd44b33d8df13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426053, "uuid": "961032cd-3791-4b8c-bfff-8a690f1db65b", "comment": "Malware payload (RedLineStealer)", "value": "2302512eaf879497c95b6d66286b3a344c374d0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426053, "uuid": "0dcc8166-bf96-4bb5-a775-1d6f6fa414af", "comment": "Malware payload (RedLineStealer)", "value": "7c8ac29eb9db2de640d962b991cb220f1a90026ae30cdc483a2ea82cfafd8042586cc48d474641e81a167d31c2f2e4d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426053, "uuid": "19bf6f50-7105-4589-9f44-5e0094189677", "value": "T10464E0C176E0C831C7A2F9318874DFE54E7ABD51D960508B7B782BBEAFB26C05920716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426053, "uuid": "f5bd849d-3832-4907-b977-5f2287fe376f", "value": "16daddd238d0a16baac8dce0ea4061f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426053, "uuid": "3d02c59d-65af-47c1-8479-b8f15b543ca7", "value": "6144:A6mrNYHZuWRpJ1oOamtk3FGmOXZrvr/Sp9emlAaI02+b7ITsqcji:xmrNquWR9oL38m+ZrO6m+Wl7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426053, "uuid": "814187c3-e0f5-4367-a05a-a3beef485398", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426053, "uuid": "70e57ced-7501-4230-8abc-16faa692eea0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426053, "uuid": "f645e0dc-5e1a-42a2-b706-da6c1870b1af", "value": "0a1f9f125075fff2b1945ad80c2c2c20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1133ea6c-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639395025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395025, "uuid": "161b7011-98d5-4d67-bb44-d0118689ca60", "comment": "Malware payload (RemcosRAT)", "value": "7fc01a583bb5bccac8ae0a794172efb1", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395025, "uuid": "d3c11d9c-5e4c-448d-b1af-f450f5b9a402", "comment": "Malware payload (RemcosRAT)", "value": "7479137c2a7f1d979e138531c225fd51d368048a77ee3dabf945ca9f5e8c25b9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395025, "uuid": "b2859b94-cf7f-4171-9c0a-6c480b1e18d5", "comment": "Malware payload (RemcosRAT)", "value": "036979fdd9d6f38f8f97a387b515862be573ff52", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395025, "uuid": "f651acd6-301d-4b1b-82a2-8db226c4840b", "comment": "Malware payload (RemcosRAT)", "value": "0ebb0f201a0c5da4a1d7dea3b7ef1142e627156fba27f5089d68cf5b629c1e5a10452df3828401c508a1115637f1b5cf", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395025, "uuid": "16a646f5-6e16-44f6-8551-fd60bcd53de8", "value": "T156059E23E1F09877D1B32A38DC5B966498F9BF002A34A4467BF83D484F356B17A35297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395025, "uuid": "dcce881b-c43b-4305-899a-522542267fd8", "value": "12288:l3+1u3fSageKokouFWsr1wYs60jHD0dhc1squpMQ:l3+iboodOLf0f0dmmNpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395025, "uuid": "37909a0b-a577-4262-b398-657b5295d459", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395025, "uuid": "a88f707c-2ba0-4765-9a3a-7500f61ed546", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395025, "uuid": "3644a068-d1ff-4e38-befd-fc717a37eb5c", "value": "EP40111671A20211113,PDF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300ba1f5-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639395077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395077, "uuid": "3440a53d-6ffb-4f01-88a9-432c8ed4de2c", "comment": "Malware payload (SnakeKeylogger)", "value": "5f92229d869d578dc445982b9d55423d", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395077, "uuid": "b755978d-8164-450a-ba9a-b22e5a5827eb", "comment": "Malware payload (SnakeKeylogger)", "value": "74869e9f170bccbca09bf6e3b570485e9c6ee6582a887703d2dfce84c98c41f4", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395077, "uuid": "7439065a-e465-458f-8c9e-a005689e444a", "comment": "Malware payload (SnakeKeylogger)", "value": "61fe42db0ba1633483f5830f02243c97952cb9c6", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395077, "uuid": "9c02761d-1770-49f7-9c04-aee0cb5036be", "comment": "Malware payload (SnakeKeylogger)", "value": "604775b3b2094c76bab9b856dc5217fc97514ff4bf8694188ae56fb29d1afae918b3e36e00b2636ee201620f5cbbabbe", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395077, "uuid": "3d8ee8c2-9c65-40ca-b638-b83fa1ac79ec", "value": "T110552363B2841A1DECBEDBF469541550037B6C19A021E3A97D9E74CA3BB33505B08FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395077, "uuid": "e95437a3-6adb-44d3-b8b1-b28175c45796", "value": "24576:i5wBqBrgu0OTYqxNE6amW1CcFvyNZdkHmO47CxBzhALw+fHyt/t7KEY2jNR:bqGEYi1cJK/kH2CxZMwiREY2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395077, "uuid": "3ede9ead-80dd-42f7-aaa0-49f71dc3916c", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395077, "uuid": "51e37acf-7de0-4912-879c-5eaaff3dad8a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395077, "uuid": "9cb3fe61-ca59-4469-a25a-ce1c7a6f6ff5", "value": "MARKETING NEWS,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e5a797-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639408002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408002, "uuid": "49c42403-5c5b-4054-b8b9-d50d50aa72c6", "comment": "Malware payload (DCRat)", "value": "344bb82e7fa43e87feff8d318024e9d3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408002, "uuid": "01fb66f6-fd43-438e-abb9-4244ed9437ac", "comment": "Malware payload (DCRat)", "value": "74c1fd1767e0c079173ec1de07717bd82ef7ced39b52c0a4673c5869ba34bbf9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408002, "uuid": "2430a47d-97d8-44ad-8210-150c562ab656", "comment": "Malware payload (DCRat)", "value": "2722b1c7a6c2f961ea2e0c2b22709150f387d1ff", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408002, "uuid": "58370ded-0a7c-44f5-b5da-1c74bd8e0307", "comment": "Malware payload (DCRat)", "value": "9cbbceab93d8167c0ebc4f31c98e69fcfebdba6bf0bb5ba75c60e3f5cd0758370e4bde2f35c0d96a91b19a83704d701e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408002, "uuid": "18ed5d9f-e041-428d-b917-f471df6bbb0f", "value": "T16054732C7B815A72FE5ED133AD110A29BB670B436A80A9F25FDF15CA874F0776D44C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408002, "uuid": "0bc3f6a9-4896-4f62-972b-edf480039f0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408002, "uuid": "fbc72b94-10ec-4394-a1b4-8f870bcaec58", "value": "3072:qPnCQ/iIP31WZpZC+o6hWq2t9Ql11iv8rV7AQCWpGSSB/q9ly6e+voF2qh7Iz31w:q9NWQNTt+lvqNZqyP+Q7c31bgklYsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408002, "uuid": "3eecf4c6-4cf0-45c1-9b3b-c96a0b11f79b", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408002, "uuid": "c01254be-4fab-495e-8cd0-e23b9cd6275a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408002, "uuid": "bca2aa84-17ff-4fe6-8608-68417115a87d", "value": "344bb82e7fa43e87feff8d318024e9d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc845bf-5c3c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639417380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417380, "uuid": "b7b4c1df-7199-464d-bd79-63cc1d859abd", "comment": "Malware payload (Dridex)", "value": "ef005c5da8910c60fceaaa3a5b62e470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417380, "uuid": "3709d3bd-d73a-4b65-ad19-ddb7858d4ab7", "comment": "Malware payload (Dridex)", "value": "765b54b871cee0938ec705329d96c028d64fdd3234182060333415613b7eb7f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417380, "uuid": "f1ac8195-5774-467a-8880-0400ebafef34", "comment": "Malware payload (Dridex)", "value": "1c365b59b7907ef4eb2ec447743b5a92310689a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417380, "uuid": "5ed1f0d4-4408-40b2-8a72-782c71ce2103", "comment": "Malware payload (Dridex)", "value": "1e37dc701011d0a53287311b5bab53dd435ae0a39a80ab56489c91d69bb1ddd76d0e44305be5243168965dcd896f1287", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417380, "uuid": "6160c415-c9c3-48ca-98b1-f853b7f68c50", "value": "T156B4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417380, "uuid": "42eed8e2-fce1-4a90-b9d9-b424568f0456", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417380, "uuid": "a45495d7-6878-44f2-b076-748fb2b1d021", "value": "6144:cKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:c9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639417380, "uuid": "3ea0b0ab-ef7e-4f56-9a8c-0b9b482bf5f1", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639417380, "uuid": "d3d70daf-1521-4981-b817-5d7f30201272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417380, "uuid": "094a1b4f-172f-4d82-82e1-3f85b66f5b7a", "value": "ef005c5da8910c60fceaaa3a5b62e470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fce9db-5c02-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639392745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639392745, "uuid": "27f38786-7b34-4d5f-ba10-a15eb9d30739", "comment": "Malware payload (Formbook)", "value": "31b7c219064528b8522e92b635c1e2c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639392745, "uuid": "3bb87c64-b7ad-4f38-b7c4-fab3fd111704", "comment": "Malware payload (Formbook)", "value": "76c7643ea5dd9635312c2bbd3323bf6c7adf38fb9a9fffa660feb1f6f75e02a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639392745, "uuid": "01039ab4-917b-4614-a27c-95fbfd84b512", "comment": "Malware payload (Formbook)", "value": "1e44ef2ac230e14f7448eeb0b9f11bfb99dab458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639392745, "uuid": "9edc73f3-db14-4dfe-9570-58ead2afe0ce", "comment": "Malware payload (Formbook)", "value": "a9da2dd7505b84a9f0216d49ae8ca90375ae3707d8a0af457d5b2f44482afdf4633864b5e4eda6543f19733b8f910561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639392745, "uuid": "8b3384ed-aa20-4158-8216-b2acd5aec7c9", "value": "T184A42387AC92CA67D097137A2773A6E2F5F93B8C21438F130F900F25D9AB616765D183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639392745, "uuid": "f1449b57-20cc-49f5-bd13-b97ad031a534", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639392745, "uuid": "e430875f-4444-4994-bea3-aa80a6a29a28", "value": "12288:MSxN/gNDhYH9qJ0exbmyja9AvTYMhoOdwETdjx8pZLXRLSV:NgNCIK6m1AvRhPwidqfLXJSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639392745, "uuid": "536aea6b-900d-40fc-aa98-607956950cb5", "value": 473616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639392745, "uuid": "a6141efe-78ea-43be-be0d-eabd7679e13b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639392745, "uuid": "683e7eba-c922-4a11-8492-7a66b25556d6", "value": "Neue Ordnung_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7075ebb8-5bf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639387884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387884, "uuid": "b20d8cfd-f906-46d5-b208-aba0533e8ae5", "comment": "Malware payload (Formbook)", "value": "455769c893c56ea88021417a63a0f9ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387884, "uuid": "7ffba176-2e36-40a9-801e-03d76909cd1a", "comment": "Malware payload (Formbook)", "value": "77901588d513788e7bba467897bd688367197dfe4bdace3bf762ff1de24db3a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387884, "uuid": "48504586-91d2-408a-8c75-82aacfcfbc3e", "comment": "Malware payload (Formbook)", "value": "0f0bcec8e151f30db07620da3573e6202bf6bb08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387884, "uuid": "57228500-3fcf-4d4b-88b6-774be327ebf2", "comment": "Malware payload (Formbook)", "value": "9ead602f7a0fc73672865aed467c52c05fcf733ff31acf63130927dc2a9815aef3699f6879678e4ce5f7a2a12abe7b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387884, "uuid": "8421a773-3ea1-4371-badc-1936400b5d77", "value": "T1B7D401A2D190028BDC5603B5EC37AC3861A7FEEA65F0AACE6A9D7534D7337D20112457", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387884, "uuid": "5a46f677-71c7-4e6f-ad5b-dcecd75044fe", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387884, "uuid": "b902baa2-5ade-46e5-a1ca-56454419f650", "value": "12288:/5QkJecOuNPel0EI+TCV8se7DEs5CSt20MXmMU4pJym:zQcOuhex+A7DEEvt20M2f2Im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639387884, "uuid": "36d5b99b-15fb-4177-b176-57f9d69c0165", "value": 607282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639387884, "uuid": "4803f6a0-228b-4b75-a4d2-e988f06040b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387884, "uuid": "ba828c18-0a2b-48ea-bdcf-a38ac20e57ac", "value": "ScanPMT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70be452c-5c3f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639418808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418808, "uuid": "af003a36-60ae-4476-bb4b-befc24b86f46", "comment": "Malware payload (Dridex)", "value": "7f1860dddf16328a520c92afc91bdb9b", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418808, "uuid": "4c38cb4c-d9a1-4a14-a7bf-f1ce0146ba01", "comment": "Malware payload (Dridex)", "value": "7797c21f3ff516efe2b7b8bb00dbe9aceec4ac9b3a742763b3745b2608d5ded3", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418808, "uuid": "7b05975c-79c0-4408-92d9-e04690dd4779", "comment": "Malware payload (Dridex)", "value": "deb5381de152882abe02d5b02475587ae6841350", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418808, "uuid": "d0f82520-953f-49c9-a2f4-4d91ed202549", "comment": "Malware payload (Dridex)", "value": "7d0c298f815dbee11019f3f26c89316f6c6f9964e76d80d173a9b78e4d54062dbc6374265ad9e3dd3cdc0f9babb0777c", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418808, "uuid": "8c7e7738-0d49-467f-be4c-0db1bde954be", "value": "T15B5412B2DFA0F7DAE01D9A7C5E40C1AC17177D05B2E0B145228C8D297BAD7B543CAB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418808, "uuid": "79e3e557-1cbf-484b-a319-24f1ceb3de49", "value": "6144:g6kwSlps46wgcXs5E6/EJGpGTu5U2Fl9q0meAd9:2jpf6wgc85hMk8Tu22Fl9dRE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639418808, "uuid": "c1472f29-509d-4f9b-998b-1c4e425cf1ef", "value": 298180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639418808, "uuid": "18068167-228c-4fd8-84c8-e0dd892ad415", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418808, "uuid": "4d5e8ac1-d220-4197-ae9e-7dffa14b6fef", "value": "Insurance Renewal.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93daa181-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408130, "uuid": "5e0e22c5-aa53-4529-b59e-722fba915a91", "comment": "Malware payload (AgentTesla)", "value": "3fdc115e5cedd8d01782f93dd802448e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408130, "uuid": "1130dc74-e240-4b77-a9b8-760cba858a0a", "comment": "Malware payload (AgentTesla)", "value": "7865cede754acdf8eefe2ed6aaad96bef243d66f61877b35a09652ff3369b59d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408130, "uuid": "e23ed477-ca91-48e4-b296-61c88f01ae6b", "comment": "Malware payload (AgentTesla)", "value": "a6be1944877a8ff40dc3aaa44d0fdaaf6d7956f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408130, "uuid": "3080795b-f29d-4dc1-8056-753d7d21e9f3", "comment": "Malware payload (AgentTesla)", "value": "0c2efd3037c7a86d59ce6655eb5952600c04f9267dc525cb41ee80f291aee3e7e75a5224d4a74a73e4cd8f855c3dae0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408130, "uuid": "792e105c-78cf-4acf-8d35-7b11f32c33b8", "value": "T18C825FBCC45702988F8667B86B1B6F85018C766DFB849933327C973A67E1D3A811397C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408130, "uuid": "22ec3136-f5b2-417a-b006-ff302279c9cc", "value": "384:Zsv6kBBZK9llGuaNYKcKmIMM6EtzGS/aGbeiD1CVo03Chjs:KLB0EvmIhfaiKcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408130, "uuid": "5903e9b6-4f91-418f-bcb1-cf0b5129e9dd", "value": 18664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408130, "uuid": "4db80701-a6f7-42c5-85c2-ce5e852e5e8c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408130, "uuid": "d88912ef-4b8a-483e-94b5-8f1f3f447ea1", "value": "PO 212RC048.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e6210b-5bb2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639358202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639358202, "uuid": "1751d097-650e-49c5-a312-043a9f64c7e1", "comment": "Malware payload", "value": "18067ab8c54bbc89d0518c6d654f1e69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639358202, "uuid": "ba88039e-4ced-44cc-bf7b-70af0a1f1c72", "comment": "Malware payload", "value": "7965bb31c5616e88dd3a8f723180ab93bf2cc847894378318fbc23cc476812c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639358202, "uuid": "8964fb56-8384-4b75-8d14-62f743fc866e", "comment": "Malware payload", "value": "15914ef324700660d4ce1a88e7a2e48ed36fee06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639358202, "uuid": "9a26da45-dedb-4443-93e6-a28e91a0daad", "comment": "Malware payload", "value": "b80f3505ccf59fc045387d98a278880a4293d08c038fdc0667c65cb2c00041c19368e2e22a43dfa19cabb83da4f38fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639358202, "uuid": "6265ad9b-343c-4840-9802-b55eca1d419f", "value": "T136B4AD1E35D796DCF87AC3B53B70719403B5BDF2E503E29EF894344B5863A807A22662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639358202, "uuid": "babab80f-df7e-442f-9d81-3af7ee890941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639358202, "uuid": "0d1771ee-5692-4a6a-81e9-8ef39a720476", "value": "6144:cMgveuz0TcM8pXy+/cYzmWFRSLJtFfbRJ9YhtebkTl1rWOO5eDGHOQTsSXMbowuC:cMgveu6rnIvrWF1HzIgd2hjIKSHdB+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639358202, "uuid": "0657a70a-d34a-4bfd-b205-e7f4636ce9c5", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639358202, "uuid": "712a119d-c86a-4056-891f-0b5b0872fc26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639358202, "uuid": "8036a6b7-a788-49e0-afd5-5b52ec4d84a2", "value": "TT SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ca8c9c-5bcc-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639369233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369233, "uuid": "e2172836-e227-484a-8ad6-f28dec4beea1", "comment": "Malware payload (AgentTesla)", "value": "db3d23a983d7d17584972235d67774b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369233, "uuid": "011cb242-3269-4660-928a-7e40c48f3138", "comment": "Malware payload (AgentTesla)", "value": "79860ed46e70c1d93d04ac7564266080018fbbe67de64ff30a2c6670d53e1d30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369233, "uuid": "30eeb266-655b-4a48-ab8e-d0fcccef927d", "comment": "Malware payload (AgentTesla)", "value": "d5024e6a8359161f9ce9b71f8d46fdf02479c8a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369233, "uuid": "b23677a3-aead-490a-9b9c-6af8e2e89967", "comment": "Malware payload (AgentTesla)", "value": "f2c1599422e3a7636f61b993351b529212f61627898a40f93d2a71bad4e9c05c0fccf07f35cd19db0da8293dc493adf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369233, "uuid": "3e78c63c-5d52-4a3d-bc37-bce155a8bb64", "value": "T1A055121A33A49D24E16E0BB990B0C130C7757D01A922D32F69D67DAF3EB37909A06B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369233, "uuid": "4cdbba4f-5821-4b8a-825c-8183de80bfdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369233, "uuid": "3094504c-ebd9-4ef5-b759-f6e9b02d680e", "value": "24576:3lcd7yjf/DfXorQB+XlNEuISlgPrPHoKVijD7kfjd18bqm7jKZgXOHtEga:1G7SzkU+b2SAiwXbYKqOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639369233, "uuid": "44659848-94e0-4e61-9bde-fe436e8913c4", "value": 1384448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639369233, "uuid": "4540d334-4131-4bff-a68e-ff6514860caf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369233, "uuid": "fab7b11a-f6d6-4e85-bb0f-6d987be41d5a", "value": "6ppilh1ymL6stBb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df924a31-5c13-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400096, "uuid": "74fbfe9a-ef4c-4a7c-a4ac-b39060bae4ed", "comment": "Malware payload (Mirai)", "value": "7c05e4fdea30d0a5451133e0d7d0353e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400096, "uuid": "da070adc-9db3-4cc8-92d4-e1a82463501f", "comment": "Malware payload (Mirai)", "value": "799979955885c316ee904ee915eeb70d85d041ecb41c72da0a4d95ec748fe52c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400096, "uuid": "6be23631-07cc-4f76-ba28-20fc446dfef0", "comment": "Malware payload (Mirai)", "value": "05f851f2a11e9196fa3d955bc53cf5b505b586b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400096, "uuid": "16bc8cfb-1b4b-485c-91be-bbd8ce4794de", "comment": "Malware payload (Mirai)", "value": "31ccd362122d49efa391097c2fca6ca0b8caac1208984d639dd2034c055ecb03260ade6131182476af666b45aa3ef3b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400096, "uuid": "648cafef-731b-4cd5-8d20-d9729fc700a6", "value": "T13093B0F0D494ACE5C254023692F6DE3E0763AA0065175EF5AB058BDB6447AECB10E3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400096, "uuid": "2e290194-01f3-4709-9c1b-904c29a21a89", "value": "1536:j/LPHzydhkwtwaXicAYQ8ii125dO5hALI+FBJH3XBj8bCnZY:jTPTShkzaXiqQ8xBALImH3Rj8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400096, "uuid": "1e3aaa77-4811-403c-b6bb-0a80774f4147", "value": 95284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400096, "uuid": "d5c2e5d9-64c9-460d-8a76-8e8b297d7c84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400096, "uuid": "c05ebcb1-6b90-45b0-8277-e0d8d505a665", "value": "7c05e4fdea30d0a5451133e0d7d0353e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d90dcc-5c3c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639417374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417374, "uuid": "5f7ae0d5-0399-406f-b5c8-f9a07636ac63", "comment": "Malware payload (Dridex)", "value": "2f7ff91c2bff52dc9bc878f46d059b91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417374, "uuid": "16bb50ef-9ce2-4021-b4bf-8b5d19741de0", "comment": "Malware payload (Dridex)", "value": "7a26d1b438379d5d2aab546f7753bd4df2593680755e8595bfa11dce1ccc1c12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417374, "uuid": "3830ca5f-e88f-4fa9-95a8-108b2dfb61d0", "comment": "Malware payload (Dridex)", "value": "a82d824ff512fcdc7098521e5d6be568ad44bdcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417374, "uuid": "87fe0043-0b3b-4c44-9ccd-e54b922832cd", "comment": "Malware payload (Dridex)", "value": "aeda52bc51363e4749919e43fc3104e7eaf5f295d68c56f53a736636da511a928eb609c49ade0f72e86476371537b8dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417374, "uuid": "cd1be97c-315a-40b4-b6be-47f0e1e4c8a6", "value": "T1B3B4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417374, "uuid": "097efbfe-23c0-4da5-bafe-56efd337b7e9", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417374, "uuid": "392fb2a7-cae0-41b1-a16f-46577c91ae03", "value": "6144:YKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:Y9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639417374, "uuid": "c6070668-5c7f-40c9-ba60-85ed3962e85d", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639417374, "uuid": "37d403c8-4730-42e3-9182-5a0e78cbce60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417374, "uuid": "97a5b11e-f30e-423e-aa62-a8fa8bfb3fc8", "value": "2f7ff91c2bff52dc9bc878f46d059b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f57c908-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639414054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414054, "uuid": "64551cc9-ecec-4fd3-8a44-817018f409ce", "comment": "Malware payload (njrat)", "value": "88ba48c37441bf5712c186aedb414b5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414054, "uuid": "40f54715-f690-4330-a7a6-5f2de8013d54", "comment": "Malware payload (njrat)", "value": "7a87678a50025c2b729792a19265a6187413fb7d3f9e394d31645603ff7e9ab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414054, "uuid": "4f665576-9ac5-4a11-927f-e01196bba63b", "comment": "Malware payload (njrat)", "value": "b2a33dbf82d7a59659f11926e0ed341f0eed3346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414054, "uuid": "b54d2e62-fc28-432c-998e-f622e7feee26", "comment": "Malware payload (njrat)", "value": "562272baf76c4152ee90752409a3f9d4df7f94f684b814e0a4ca156ba2d76aa47dd191636b2bf848a0b96dc0f49fa7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414054, "uuid": "7d79fa85-7053-447c-b256-8619e2f05f2b", "value": "T14213E74CB794A174D5FF8BF1A4D2B2890B719017AC06A30F99F154ED8BB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414054, "uuid": "db50ae95-c46e-47e2-ad6a-507a97a42a13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414054, "uuid": "5f1187b4-05a2-49df-b844-85cf391e53f3", "value": "384:FZyrxBS0lwZmoy7utsMu6MNx+DEa3S9D9O5UE5QzwBlpJNakkjh/TzF7pWnq/grW:PwFGol7As7cD9vQO+nl+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414054, "uuid": "2cfc220c-dd04-44d1-9095-03df4013bf6a", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414054, "uuid": "1ed41c07-6251-4d13-bdc4-fce4c94306b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414054, "uuid": "63da5940-a556-4ec6-bc1f-79938818910d", "value": "88ba48c37441bf5712c186aedb414b5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1da1c7a-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639426299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426299, "uuid": "66c7763e-28d0-4763-8cdc-2722f8f8405f", "comment": "Malware payload", "value": "06454daea9f315b5096c3e2a7df4e911", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426299, "uuid": "4b128024-4509-4ca6-ac9f-75933e1177aa", "comment": "Malware payload", "value": "7b499b9228bbfa5ab9cdacfbcec34d63d0ded4710ca778dae42a18f9e1535964", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426299, "uuid": "56372735-315d-4317-8fb0-cf8c8965ba81", "comment": "Malware payload", "value": "c6ebef66980d1ebc896aad1867fa4eb8b26ae631", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426299, "uuid": "ca80e6e1-663b-4481-ad13-7a4695626471", "comment": "Malware payload", "value": "0819af3d3cc28604cdce95c0f06a409770b43e8f606cd1eba99942bdcb7d445891c07c5bf22ab21c821b6c467e5a2b63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426299, "uuid": "d1088cc7-a1fc-4d2f-b9da-62456e5995dc", "value": "T1E44533127654338ED56997F410FA67109BF46425A410FA286CDB73DFAFA23E09A03BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426299, "uuid": "da6c8fd4-eee4-4c4e-a4c4-c298464c60c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426299, "uuid": "e06f816c-bab6-4689-b3db-099b20acd095", "value": "24576:7sgpUZGkdJfi8Eld51RWI3vXpoQOHz7Lf03AZzKZ+ktaFWc:ZprkQcI/Xy3T83AAltaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426299, "uuid": "592c4487-05f4-4074-804f-3fb4ea1bb36f", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426299, "uuid": "7624d96c-9efb-414f-900e-9593812fde14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426299, "uuid": "692d9335-2871-4edc-b325-a401e304c510", "value": "06454daea9f315b5096c3e2a7df4e911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc81e68-5c47-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639422345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422345, "uuid": "57e6013e-c44f-4535-b5cd-d464233b35e4", "comment": "Malware payload (AgentTesla)", "value": "703afc79e3d68d8e94d2d97c05ae440e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422345, "uuid": "bd741d2a-7f84-4970-829a-5d2ec68a42f3", "comment": "Malware payload (AgentTesla)", "value": "7cbcdc14663f12dc12772b88b3c580455ecd9d846bbf09aefc7c6dd91ba0182c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422345, "uuid": "bc950b23-083f-4fcc-af47-6f9f4d9289c8", "comment": "Malware payload (AgentTesla)", "value": "1c4e949bd5474c12e04b504596b5f7ded6c9c91c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422345, "uuid": "1fa9d3d8-bbd2-45b7-a951-d84115bb3276", "comment": "Malware payload (AgentTesla)", "value": "5f2cbca0369180679cf55d0cdc45b273f23708a9c1731c2c402d4f349f67ec0ce5e32c8432ecb66f41aa6611d3d6bf20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422345, "uuid": "e802aca0-8230-47c8-91b4-d0bc0be08a9f", "value": "T1E7F49D5F34C286CCFD7AD2F53726918413A5ECFAD506E24DEE84324B5DE3B912922722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422345, "uuid": "3ac051b5-a5b9-4e38-9b34-822b4c8f31c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422345, "uuid": "66f2a3f3-a76c-4592-8e53-ed4a093cf335", "value": "12288:TR7Hu+x4nIENkNtofCV0jPyznDZz6QxOyWbpyDv6nnjqKoe:5ulnI7z+bG9OZbIr6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639422345, "uuid": "5111e945-dcb7-4da6-8628-f0b1effe3701", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639422345, "uuid": "33da888b-656b-4808-ba30-9122d9726e15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422345, "uuid": "bcb8f310-5b04-483e-bfef-1040fe36378c", "value": "703afc79e3d68d8e94d2d97c05ae440e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc3f288-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639407821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407821, "uuid": "1b4f7f06-fb09-4b77-8f43-217a34d9ae9f", "comment": "Malware payload (Gafgyt)", "value": "60d36f632f8ad5b2b39fb2fa69bffdb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407821, "uuid": "cde9008f-0dcd-40ea-98ae-bb45c47e2f7e", "comment": "Malware payload (Gafgyt)", "value": "7cdb3d76523b187eef3ed714806e01525fbc60b2fcf9ae4ec342dcc84740ac06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407821, "uuid": "d1f96eb3-09ce-40d7-b608-23a295d798e7", "comment": "Malware payload (Gafgyt)", "value": "fadb9b2bdac8fbba672497fca4827630e0423dd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407821, "uuid": "43d14422-e410-465e-acd6-0553efa4684a", "comment": "Malware payload (Gafgyt)", "value": "b99525cd5b7ecfc95546e65d0634ef475a4efac2b47da5a92319102b78ae4342dcbbc34a08af5676a8f50fe3c58e7d76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407821, "uuid": "16eafc90-3844-4264-870e-ab9fb55c8fbf", "value": "T158D3C65AAB619EBBD81FCE37069A4501248DE64682D93FBFB2B0C51CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407821, "uuid": "aa87ded6-d2ed-4179-a11e-5f37252762b7", "value": "1536:o2beTpNb9DERkLMurNpZ3efJp68E1wYqwvd00PUmkVmSFxBC7vXZX:o2cNJLlrvJF1LvdlPUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407821, "uuid": "82464aea-017c-41c3-8fe8-ebdb4c5eb80e", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407821, "uuid": "5e368696-ec3d-4441-9fd4-8c6e85dbfff8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407821, "uuid": "029e0ad0-8c1d-4c92-9b7d-e9ebee9f3e5e", "value": "60d36f632f8ad5b2b39fb2fa69bffdb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72b6279-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407732, "uuid": "e561b874-28db-4805-a554-ebeba120450f", "comment": "Malware payload (SnakeKeylogger)", "value": "2bc5b3f83403824d0c7b3ba33921bbb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407732, "uuid": "e427f2a4-1891-411d-a4a8-85fa10f68d96", "comment": "Malware payload (SnakeKeylogger)", "value": "7cdf8cf50de0ee1acece28ddc1d24f7c2144fa0154c577a60cef97bcb3e82578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407732, "uuid": "bcebdbfe-f9da-4bf9-83cb-d7a52bbf1d95", "comment": "Malware payload (SnakeKeylogger)", "value": "d7033411ad1d70bccdd525fb347b8015dd477269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407732, "uuid": "9a22cbf3-2244-4955-8836-c07975405906", "comment": "Malware payload (SnakeKeylogger)", "value": "19e5b4618521eee55602605f134e48251017dcbd237655dea4f2a3ac7aeb9436494c22bc0af4847094e534921cc91fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407732, "uuid": "c02938b6-4bfc-481e-89f9-189d67b981f5", "value": "T115552356BAF8C926E2EC27BA8DB7570C537C68017921EA097CCD63DB16297E10601DCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407732, "uuid": "35c96413-5ab9-4a57-a628-19013573dd81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407732, "uuid": "bd514913-d084-44ac-aad8-cd166c819bfd", "value": "24576:SdbtoFk8DTL0mNjJuhq5NyNfekHwz+bcDBKim57Gq2PCqKVYRyzYz:YtO/0egq5NIyaw0D5Sq2PCkRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407732, "uuid": "f5a68382-4572-4d73-9d22-045968b01b8e", "value": 1312768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407732, "uuid": "bacb8fe1-630d-49fe-beaf-e2f87ab4f8fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407732, "uuid": "92be09d7-ca0f-476d-9201-9e4c27bb406b", "value": "2bc5b3f83403824d0c7b3ba33921bbb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8da3910-5c33-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639413882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413882, "uuid": "11077251-d9fe-49b0-9987-f711f4a4ddc5", "comment": "Malware payload (ArkeiStealer)", "value": "7a3318b006a9b11fb4f4abf122846d87", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413882, "uuid": "da108260-2938-4858-96fd-6d0b8c1bfeb6", "comment": "Malware payload (ArkeiStealer)", "value": "7ce3451137b2c930c7c10d1ffbbd189fabe56944ef95da13c890b59811340fd2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413882, "uuid": "6b6cba9d-4d20-427e-963e-4e6c6156ea15", "comment": "Malware payload (ArkeiStealer)", "value": "e454107d4a6e9ff328f481718c975da91f9123f6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413882, "uuid": "f731a7a3-4e7f-4647-98f1-2bca1c22b301", "comment": "Malware payload (ArkeiStealer)", "value": "b8ed0e100d40e8bae6b4498a0051ef87b79ce3d12765561184859d17cfaae1aca3bd3dc61d5ab257ef986c7bfaa4a6bf", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413882, "uuid": "b617b5de-b775-449c-b449-5cee4aed4123", "value": "T1F224AED175E1C871C5AE393094B0CBE55E7BBC61EAB0504B73782BAE2F622C02A35356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413882, "uuid": "7551765c-5da0-4203-a723-a41b236f731f", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413882, "uuid": "96717bcf-c276-4b35-b28c-66962cef8e3f", "value": "3072:kSPsEIDdx1YBDdACr9kbsYJCi67P9L5WophsZVggjcGkNIVqIcA2Phy232:Kd3sBW/jb7ITsqXAAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413882, "uuid": "861b4859-b106-4626-99ec-be2cdf7028f7", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413882, "uuid": "7c9f7923-5964-404e-a454-601813a14300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413882, "uuid": "6e82b019-a106-4e3f-92ae-5a462c72758b", "value": "7a3318b006a9b11fb4f4abf122846d87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e785e301-5c52-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639427168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427168, "uuid": "8d476e75-7587-476d-bf5b-b1dfa865991b", "comment": "Malware payload", "value": "33be62a5d91321fab9044f43779cf749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427168, "uuid": "bcc8637d-b987-4ba8-b784-3fd71da54c00", "comment": "Malware payload", "value": "7fed2d349ddfd80eef576f8d27b45797fd95cf397bdafce8d970af6a55982b25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427168, "uuid": "aa1daa80-0ea9-46de-b684-7f6d2ee312f4", "comment": "Malware payload", "value": "aa370a41ba30063f32585c48db0003544b0ce776", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427168, "uuid": "7bd1fdf0-70ea-47d9-8e70-be30a40bcf66", "comment": "Malware payload", "value": "dc5404d778f8ed7e8264501c5525966033b1d8d16013c0a1cffe398161207790f1f1c3a750ebe060608fffbb86a2a6a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427168, "uuid": "2503abde-3943-4381-9cd0-2b3e1f0b2b62", "value": "T13555122D67A48815E16F17B894B1C2308374BE167427C32F99E93DEB7D737A09A05393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427168, "uuid": "1899b110-8e58-4dd7-8ff3-c76ed5a5b9b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427168, "uuid": "17711e14-2b48-44e8-a226-dd0340a3eea6", "value": "24576:0XOHtEgag1TGNjZ3Fjwr23VHsbamlhkd+qq86FvTHs3+W2NL3A+sGG:oOygag1KNjpFjMsmb2dHuvTMoLwZGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427168, "uuid": "ccbb336b-d394-41ab-b88b-6cf10b84bd6e", "value": 1388032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427168, "uuid": "ad0c971b-ad21-4ff3-bf42-3f62dc554460", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427168, "uuid": "4c99c55e-c4d5-4f1c-8702-60cba1d5262a", "value": "33be62a5d91321fab9044f43779cf749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2c3cf8-5be6-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639380548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380548, "uuid": "40aee8ce-6e33-4c88-a17c-d0253ebf12c5", "comment": "Malware payload (AgentTesla)", "value": "a0352bbb98d7bfa01fc152f669049006", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380548, "uuid": "4edc9e0e-acf2-4499-89c7-d97393d5080b", "comment": "Malware payload (AgentTesla)", "value": "8023c6656d120bf6fad643cca71398c01f7a2bb5e0692c72ea4c6e82b0eab5a4", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380548, "uuid": "fd15b803-4e1a-4f33-af05-ab749806c6e0", "comment": "Malware payload (AgentTesla)", "value": "749a68cc2f0a6a03e728a59fd036b5ba09db50b1", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380548, "uuid": "726a2ff0-121a-4481-8012-acce3d8122c1", "comment": "Malware payload (AgentTesla)", "value": "3042b2c17040a39bbcb19d8ccd96e275787a2df88b278f6d8d2c7a59c2a6a63c29d0fd00f65df034a2280d6ff5e24134", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380548, "uuid": "4627cb31-1fc9-44b4-bd2b-f5019cc6025e", "value": "T14134223931D365120F7E45EFBE8C967951584906FA1EF3C03EB08F661A32DA8160CDD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380548, "uuid": "9188972a-59a6-4a62-b71a-5ee8dd2333bd", "value": "6144:G9o6TSSbmuh2qCcRxQzyafdwczswYwwwo/K:G9o6TTmo2WxQzySwczswYwww8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639380548, "uuid": "d0ad5cab-7f58-4dfd-a20f-07e84cfe9bca", "value": 241028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639380548, "uuid": "152420ba-892c-40e0-b67d-49a76b2a56a8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380548, "uuid": "3b7f3e81-0d93-41a8-9de3-6db196727cb6", "value": "Payment Slip.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b48cb6a-5c09-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639395445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395445, "uuid": "08c09d0d-9c02-41eb-99e4-cd0209fdb463", "comment": "Malware payload (AgentTesla)", "value": "238d57ea2af8fadb8dcddc0fdc073a34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395445, "uuid": "e0ca8970-36be-4f3c-98bf-30674c9a9447", "comment": "Malware payload (AgentTesla)", "value": "81a33aa7dfb886d9e6e95324bbd9c544c0aa9c4f54b592b7ee6748d12a17e27d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395445, "uuid": "ca03a021-9ab9-4da2-8bf8-e1a84b4cbebc", "comment": "Malware payload (AgentTesla)", "value": "63c36aae2a1f404e91cf65d170c963dcd409690a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395445, "uuid": "8bd8c9b6-e8a5-4616-b00b-07b970a2096c", "comment": "Malware payload (AgentTesla)", "value": "1e67482a0a3dc3e55418117524f904f2a80d38da4c2662e347a31dc286418a4a337674108d203ba6691c238d673a705d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395445, "uuid": "5ea44c6d-dd4a-491f-9f0d-8717da31a829", "value": "T16CE40292F1C1C09ECD941671AC3ADDA811A77D9CFE71A94F36A2B75E3673193021EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395445, "uuid": "85218677-8263-4983-986d-8ea93f74eaf3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395445, "uuid": "ea30260f-1a4d-49ff-9a8b-1690da097e83", "value": "12288:McQoTTw2sE5u1kRgcz55AzprkoGw7RwAc5Qj14m14LJQclk8ySNg:aovZ5u1cz55A1h+Y4WYJ9lkMNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395445, "uuid": "fdb528d9-808d-4e0a-907f-0c7e9bc89edc", "value": 689364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395445, "uuid": "f92e29f5-490a-4776-bf47-7d2fba329996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395445, "uuid": "3808150a-9582-45fd-99c8-0a40015db12b", "value": "238d57ea2af8fadb8dcddc0fdc073a34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60741482-5c47-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639422217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422217, "uuid": "dd6723b5-26e1-4196-ba79-ad623c4c2269", "comment": "Malware payload (AgentTesla)", "value": "f715f8abd8d947fd2c47768e54f8f7a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422217, "uuid": "d783508b-2165-4e81-bd8c-d96b3959dd2e", "comment": "Malware payload (AgentTesla)", "value": "8203143a2bdc8f90c8880e186463919451187e59de48e1e89007f4cb60fe9d8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422217, "uuid": "8628c31f-8376-441f-aeb2-23fd740b82ef", "comment": "Malware payload (AgentTesla)", "value": "06b6c59b83192e0609f01b28109cb1e7756f4191", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422217, "uuid": "f09ddcae-dc4e-4d1d-a816-6a019c39604a", "comment": "Malware payload (AgentTesla)", "value": "814708221ac7abcd16125c4b0120b361bd0e94b8bab7018097c1c0dc8a1660925990c6ff6e76183f7afcf13aebd73835", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422217, "uuid": "99f395ee-e41b-4b9c-a2f4-3a874d1df51e", "value": "T17C45129D365531EEC86BC4B2DEA82CA4EB01757B971F9203A42715ADEE0C897CF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422217, "uuid": "ad1f408d-3dfa-433e-89d1-b3ac519b1987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422217, "uuid": "f5878fad-b499-4eea-9e92-b04fc689a5ee", "value": "24576:55RiMKRpRReZP7Muru+5d8Zvl5dU1xicR4HFNGK1+E35rH:FineZxq7vZU3cHjVYEprH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639422217, "uuid": "b2c25cb2-8004-44c8-8995-c4d58d866241", "value": 1181184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639422217, "uuid": "6e141139-61d2-49cf-bb8e-7dd369d8002c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422217, "uuid": "25d10df4-e6e4-4b3f-82a2-048923805aa9", "value": "f715f8abd8d947fd2c47768e54f8f7a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334246fc-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426006, "uuid": "f27f8026-ef0b-4e61-a541-1d0fc396a04e", "comment": "Malware payload (RedLineStealer)", "value": "801c6563f30884293bde826b00dd62c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426006, "uuid": "02a3f6d5-c0fc-4f5a-bc36-f8921b3a4c8a", "comment": "Malware payload (RedLineStealer)", "value": "828d04eee1c34fd8fbcb15106b1089c0baecedd429f51de8ec419cc23bac5000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426006, "uuid": "4540ccd5-abb4-4bba-9e92-b598f900cc13", "comment": "Malware payload (RedLineStealer)", "value": "029102d30559b8c610f8e6374bb65866a6960232", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426006, "uuid": "45a86355-0d9e-4078-87af-4ae29eb5f8d8", "comment": "Malware payload (RedLineStealer)", "value": "1cafd0461ea4f13f24ce8aa9781607e743b3b14bab726580ec1a535815a479ab3c8f3276734baee6a90ea792d8b4e851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426006, "uuid": "f02bc7e6-922f-4dba-b1ff-e0a742de65df", "value": "T18864D0C176E0EC71C5A27A30587086A88E3FB951DE704D4B77B93BAF6F722C16621712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426006, "uuid": "3d75ac1c-6c02-4496-8d16-987e5a4f0887", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426006, "uuid": "3887a255-3dcc-4319-8478-0684aa9064ea", "value": "6144:5h7l0bGpLFs2dkFiH4XAm8e0zjYygPaxNqnb7ITsqxsa:5R+bGvTy6zkRms78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426006, "uuid": "b65390a2-0ad3-4ee3-8e52-65356dc874bd", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426006, "uuid": "9cff0b4d-3243-4ab4-b4eb-12ed14edca0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426006, "uuid": "75e20703-bac0-448c-9715-1ddfe53cf4b8", "value": "801c6563f30884293bde826b00dd62c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a386c2-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426029, "uuid": "98a8236e-998c-471d-b1f4-7bc40d774a2c", "comment": "Malware payload (RedLineStealer)", "value": "fc250d0d1d3ceb895fe0ba7c70122720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426029, "uuid": "b83a2562-d51b-4d18-9a66-d37f48d50498", "comment": "Malware payload (RedLineStealer)", "value": "832270049dc593489a5aa9b79328f89f6b0b8b8ac467243330cd82779f51d174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426029, "uuid": "e4a088c7-ede1-4753-a2d2-7458045163ed", "comment": "Malware payload (RedLineStealer)", "value": "a1b18456ac8b422012d1ce1598a5a1d2b24a5402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426029, "uuid": "53c7f864-572f-40bc-abdb-055f2c713f0f", "comment": "Malware payload (RedLineStealer)", "value": "7b18ad19aee22a566a430fa6e98c6f4bcef506a90f27178b4abcfb4a9ea190a8c50c0523933b0b8284f242e5e7f8834b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426029, "uuid": "299a1ab8-47bd-49a7-9c10-864dc90aea9a", "value": "T1AF64E0C275A0C83CE5E32D318830CBA45E7BB992E920914A777437AE6F712D15762FD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426029, "uuid": "b299c183-3a5e-4018-8856-be787876593b", "value": "da86082cd27b859e55ff9843cf87f36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426029, "uuid": "cf4b03b9-f725-4ff7-9478-15b38ad87080", "value": "6144:nWJnyUC9GWu7MVgFb3ELhvXzH9pqb7ITsqxwya:nonVC9GrFUhLdg7Iwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426029, "uuid": "229fe0d1-f720-48e5-9a80-5e2128f75046", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426029, "uuid": "4ea8af40-2107-47f5-a29d-52ad9e0715fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426029, "uuid": "61ba8271-8faf-4dba-a5e7-7cf89292beea", "value": "fc250d0d1d3ceb895fe0ba7c70122720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ba8afd-5bcc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639369476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369476, "uuid": "212c3cd0-853b-49ec-b478-b47b5e52cf5a", "comment": "Malware payload (Formbook)", "value": "3903301e617641ad7609ca7e09b4bb80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369476, "uuid": "dc61d304-2ab1-4b88-bd9d-5e0986792407", "comment": "Malware payload (Formbook)", "value": "83f231a4e196b10089d16db819c71bfc5cc543fb55ea5ea63aee2d1285ff3dc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369476, "uuid": "54d7cceb-88e9-43fd-b3b6-baee2c50d321", "comment": "Malware payload (Formbook)", "value": "2544df38e978f6aaf53ca5ccbb4078befa745351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369476, "uuid": "ecb2b2ac-27e6-47dd-8099-9517f1fe4a01", "comment": "Malware payload (Formbook)", "value": "563e19a25f3a9bcd5caf3b6d2ca833628132a261e222b2a681ab74b9430d4869e374881e382373bf84aa20545aa07296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369476, "uuid": "ffc05e66-c8e7-43f7-ad6f-2c10742d5408", "value": "T15F55120937A49910E56E07B491B1C230CB32BD05B526D32E6AD63EDF7F33BA0DA05667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369476, "uuid": "a28070a3-db07-4c43-a128-111867bef011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369476, "uuid": "22197792-ffaf-45cc-9649-1916f9827aad", "value": "24576:B7YXNa2kita4HBIb6kFgaGvVNfZM58gN8GdvwPJORyyIwU6XOHtEga:hQa2kit4GksxMOPuvwIKX2Oyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639369476, "uuid": "70511138-919d-4396-b846-cfbe06436f09", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639369476, "uuid": "ee2e7f7f-e491-48fa-b33a-08983d21390d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369476, "uuid": "390ef3b2-062b-45ce-9e69-ab62f2b57ea9", "value": "t9w7eLEE781llAk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cc8ecd-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355810, "uuid": "34438c20-622e-42b6-8fcf-90fecaddab64", "comment": "Malware payload (RedLineStealer)", "value": "9a03a64d07c1d26a149ea7bcfa86c272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355810, "uuid": "f2a4517d-b9cb-4a79-be72-2a55eb339aac", "comment": "Malware payload (RedLineStealer)", "value": "8556ced6ff3186ddbcb3f4612ff96a6f088871907810f243bc370907cf86bce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355810, "uuid": "7b07a831-ab89-4348-82dd-062092d181ac", "comment": "Malware payload (RedLineStealer)", "value": "6ce35f10663de66c9a11c4916137d9c0dded9361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355810, "uuid": "3f4b0ec7-2919-4db8-8bf7-7175e869c2da", "comment": "Malware payload (RedLineStealer)", "value": "b6023a781d82e285a2666948722808a6cb9a8c327d6637373e50297400078d177486fe4b48c6114313d213fc907efb92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355810, "uuid": "70d20a56-b7fd-491d-ab42-234503d20ed0", "value": "T17EB4F63839FA5019F273EF759AE874A69A6FF6333707A15E205103864B13A81DED123D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355810, "uuid": "debe9328-0b11-4f6f-a28a-62a0feba4d2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355810, "uuid": "7c791b09-80e4-4eb3-a013-1e5b8244234d", "value": "12288:FEsl05fHlJf2SH+S3ohYedMkyFkwH4sWAHBTsOa773KSGJZ2Kt:63fHlJWS3QHaxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355810, "uuid": "287a1874-a817-4e3e-ad20-7061c983bfcd", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355810, "uuid": "4f78166b-580a-486b-9c74-8e271a4df778", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355810, "uuid": "a615353b-766b-440b-9bd3-680fb2de7419", "value": "SecuriteInfo.com.Trojan.Siggen16.711.14003.22729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf14245-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425994, "uuid": "d1dbe75c-2f64-4d72-aa3b-c19843a992cd", "comment": "Malware payload (RedLineStealer)", "value": "3fd3b8dfddcce87489e9ce81db6c9dcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425994, "uuid": "06d57538-bdec-4958-88af-f62035ede8a3", "comment": "Malware payload (RedLineStealer)", "value": "863a58338a3548549cdcaf7a47f94ddd0048604b18fae474f6f54b3394520700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425994, "uuid": "e7532f02-e0b2-42a8-9d4b-825415909486", "comment": "Malware payload (RedLineStealer)", "value": "bde976035702f3a46ccb5ab772883bf0f17fac81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425994, "uuid": "2f4aa8c8-1448-4bc4-847c-1e1ed813587c", "comment": "Malware payload (RedLineStealer)", "value": "408400603aba24938a0a401ca65f2323f5b300f88ee05bb93102192930a1dbd09c124a461d8e0bc92707c100ec60222e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425994, "uuid": "76c4f92b-cfb1-4c90-9ea5-dfca29d76f7d", "value": "T16264E0C275A0D872C7A2BD3098318AE55D7FB971D960828A77743BAF6F723D05A21313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425994, "uuid": "f033261e-5905-4d97-9d89-b4bb0ed7010a", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425994, "uuid": "c2328663-fa66-4f42-9157-e297c9584c75", "value": "6144:Ih7LEp/PMOTUfaEn+qj9t9XyTBCSb7ITsqoIwnJw0:IRa/vTFEn+qj9XKB97gwnJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425994, "uuid": "d4dac2da-55a0-4248-abbd-fdd0d430f138", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425994, "uuid": "77757c5b-2580-40dc-9742-045201584656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425994, "uuid": "037b2bb3-47d1-4c98-9d95-737a59a370c4", "value": "3fd3b8dfddcce87489e9ce81db6c9dcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d278f574-5c52-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639427132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427132, "uuid": "6069d075-1fff-470c-b125-c20f028fc9c7", "comment": "Malware payload", "value": "e519d1b7e85c0b88c8838643a26f1687", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427132, "uuid": "d18bdf92-5bd4-402c-93bf-d7b5b1974a1e", "comment": "Malware payload", "value": "8733c16273b105edefcf2b239ff79a20c527f961096f0dad6adf1823bdbc081b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427132, "uuid": "b6715be3-3fbd-408d-9ed7-b3cf9eaa833d", "comment": "Malware payload", "value": "ea124c7620654369c678934af5e502cf7a988d09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427132, "uuid": "65e1322b-4ace-42bc-9b4a-16ed29659020", "comment": "Malware payload", "value": "f1b9226933124f775289393759996975480efdae973f8b3c5b267822eb9e2c1933b9b550945d1a9d2b8c9b1e529044a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427132, "uuid": "212e4cf3-3949-4323-9e00-c4c1d18b47c8", "value": "T1BD55122833E88964E47F13B9A071D1348735BD116926C32EAAD07CEF7E73B91890579B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427132, "uuid": "cef32d5b-fada-4b58-a2b3-a70ef370897c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427132, "uuid": "126aa18e-5a37-4611-8127-7c4b6e675a9d", "value": "24576:CFnHndxLn4NkT++PCEtJvWCjqiHynkmSRRuYbqo9wTDobXOHtEga:CFHdxD4aavEmhEMTSRRXbl2wDOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427132, "uuid": "9058b4fb-08dd-4a1e-a184-b580e77e790a", "value": 1319424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427132, "uuid": "c5228e90-395d-4eff-b483-bd96ed03dd28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427132, "uuid": "371795c9-c61e-42ea-b465-1efa53363e6d", "value": "e519d1b7e85c0b88c8838643a26f1687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce3d3f7-5baa-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639355048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355048, "uuid": "36a1f3ac-2082-4338-9e5b-39b0787868fa", "comment": "Malware payload (AveMariaRAT)", "value": "ca4bb8b29836623c5630d39d031be38e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355048, "uuid": "60601c97-13a0-4f8c-9041-f39139a6d020", "comment": "Malware payload (AveMariaRAT)", "value": "885e1d1c1908b6ea364f1754eb8417fec89270c9ef9c9d45222f0fb6bcea5605", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355048, "uuid": "c0746140-a460-4cc1-8ed2-e10f3262e423", "comment": "Malware payload (AveMariaRAT)", "value": "cd5ed82a0814cb949b7de921bc5ed8f2a10e0d04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355048, "uuid": "e4d109b4-9c36-4c39-aaec-809580884317", "comment": "Malware payload (AveMariaRAT)", "value": "a9ca1d023a859c01362de7330423bd796c087b5519151e38c88d7f392be1223498fc8ea137604596a9367c30470e0003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355048, "uuid": "4622ecc2-93b3-40ba-ac77-17fa4a631f0a", "value": "T1E32502D8354572DFC827CEBABD641D60AA20A477430FE247A0D316ADAA4E5E7CF105E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355048, "uuid": "fce9cd01-77e3-44d9-8f15-355e81e24625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355048, "uuid": "b37b9b4c-deee-4160-bd93-c63830a54cd1", "value": "24576:2/0UWvFuEWg+zw9OFJyvqKDfp7JPHwr2TUftYoQ6cLQnsb/hyDVeb:OKvFTWCkEDbZAjy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355048, "uuid": "bdd31f40-1ea2-4ec1-b996-98e630341e86", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355048, "uuid": "75008a61-bad5-4f16-b376-eda4e701d438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355048, "uuid": "75dc7f6e-eeca-49b6-aa87-a341d7f7a147", "value": "ca4bb8b29836623c5630d39d031be38e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f13a388-5c33-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639413490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413490, "uuid": "c9ccf33e-b15b-443e-9018-c853068b1141", "comment": "Malware payload (IcedID)", "value": "31615c775ca68f32de435376143e9766", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413490, "uuid": "a3eb34ec-0088-459a-bf41-c9884dd7fff9", "comment": "Malware payload (IcedID)", "value": "888a513f46406d40bafc145ad62738cf80c053a2b30c8dd93545803b6f6ccc86", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413490, "uuid": "202af4f2-ac6b-40e2-955d-e72fdddbd916", "comment": "Malware payload (IcedID)", "value": "c4e0a6025240b7c88ccae3dd1b8f24fac0806b63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413490, "uuid": "1c04923c-4282-4998-a66a-7bed2c120e3d", "comment": "Malware payload (IcedID)", "value": "00040544296ea59468e0a1ff02359158b73bba500259e446be03955c1f5f2c1781c1fa728e58ceca2cb8c859dc92d46a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413490, "uuid": "8dc1be56-4d46-4937-85be-87a939814921", "value": "T169050A1539DC5BE5F1EB9430C7FBFAAB7646756053B088C24B9A068CCE4D2202D9B35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413490, "uuid": "bf865f4d-72fe-4397-b6eb-59e1cc47d68e", "value": "377cf497eb2c9f4aee87c6a1c036022e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413490, "uuid": "ea4d1e13-c60b-469a-b9b7-fd1b9327e51d", "value": "12288:J4d0Phoban95BA+T97F2ispmXuk93rNlq7wKgyVt85X2zdevBroRf:qdkhomA+BfNlqHV/bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413490, "uuid": "e0207fcb-b128-467c-bc24-3b772c405108", "value": 817797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413490, "uuid": "7581a796-2c31-4a07-90bb-8b181fba302e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413490, "uuid": "7a4a3904-7f0f-44cb-aea9-fa520a93b245", "value": "31615c775ca68f32de435376143e9766.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2111abe1-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639388180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388180, "uuid": "c879ec59-a12f-4ae5-a0d1-b8ca831035c8", "comment": "Malware payload (RedLineStealer)", "value": "6b39604751d5af6f9ed8f29c11fd0f1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388180, "uuid": "6f9a350a-2fc2-4dfe-af35-e581b74aeb07", "comment": "Malware payload (RedLineStealer)", "value": "88ad175597145beb031e6f39bb9e87b8105de1f837386e0cd7347c7f00983c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388180, "uuid": "bad4c3e5-8201-416d-a560-d9a30a3e7366", "comment": "Malware payload (RedLineStealer)", "value": "7441db78fcf417b5677804a829d70fef9dc30eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388180, "uuid": "0d31e713-845f-49b4-b70a-ebad61078f67", "comment": "Malware payload (RedLineStealer)", "value": "1b79f48c322db219ae8c8e76c2a2f58f2dde77fbeb48712babeba823d77808c716bf94924cfed7227e999354bf458943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388180, "uuid": "7b22b3b9-5be1-4573-a9d9-ec20a0538d80", "value": "T12E15B90BEEC6CA94ED62177545F3AB104B7464DD8FA703ECA374ADF04AD80E81F18A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388180, "uuid": "0d6503be-e42e-483b-bd11-6ffee6bd2f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388180, "uuid": "c68c48f0-a539-42f2-936a-ec41acea62cd", "value": "12288:tCfyG2C8LAC3m+FcDR1/UZv/yOZECqCijk:oyNc3ijni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388180, "uuid": "bcaed696-75c5-4a6c-93fe-e44e237c8c7c", "value": 948616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388180, "uuid": "1f5b88cb-52b3-4620-b899-1e982de9d6aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388180, "uuid": "33915896-e6f2-41da-a3c4-220cff7ca822", "value": "SecuriteInfo.com.Trojan.PWS.Steam.23474.467.18496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b2ccec-5c46-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1639421719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421719, "uuid": "4f345cc1-9bc3-4b0e-9fcb-c1085677ac16", "comment": "Malware payload (QuasarRAT)", "value": "da962dc69d5ca519b361a5b46fbd81ef", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421719, "uuid": "8561bbef-217b-4f00-a4ab-79a89b49b1a3", "comment": "Malware payload (QuasarRAT)", "value": "88dc01c78ae020f8b399070687a0510165f81d13c1aefca98334014a50c9e747", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421719, "uuid": "4c19951f-0a49-4bba-b242-b27373b3f559", "comment": "Malware payload (QuasarRAT)", "value": "a3abb17a5bdf0fdd8c0e8c24569a242c3f94c050", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421719, "uuid": "5b689731-6987-47ab-945e-cd44ced311b1", "comment": "Malware payload (QuasarRAT)", "value": "ff98d1f5821a99917e8334f5d2e0b3a12bd3f7f7e87dc076fd9806fdd3c3737bfd0b39b7f1d16f449f633f9e0d7f721e", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421719, "uuid": "e8520e09-31a6-47aa-aded-27b2c2de31b6", "value": "T15CF0050E616473EF886FF72FBC5300449D1DAC130384AC74D161458FC0604DD644AA74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421719, "uuid": "0b92879c-45d8-493d-9ab5-c5ee8588eae8", "value": "12:oVXeRnKAQ0GgUgfx8Yc0iyEiKxidbVHkuih63RvAeVw6LXcNIv:oVX6KW2Yc0Db2ugEZAeVNMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639421719, "uuid": "d05c4a2f-cc14-4b5e-85ab-070c1f962620", "value": 646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639421719, "uuid": "cb1062c3-6982-419b-957e-45809bb7c918", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421719, "uuid": "7b101580-0a98-4483-8d37-9fe82bf66138", "value": "#00959.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14ac362-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639408689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408689, "uuid": "2cb24ab9-9bed-4def-9b90-547c16974a53", "comment": "Malware payload (Vjw0rm)", "value": "229390d80414c9c8835fdc3dfc13eace", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408689, "uuid": "0a02fa85-7646-4e0f-9515-ad90f9e7a76f", "comment": "Malware payload (Vjw0rm)", "value": "8a3f7f39e76c44f944c4d8d41c2e8ff1b151b01c94a1b6cfc4ea879ea80612ac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408689, "uuid": "40c0c225-55c2-4167-a07f-6dbc83711d13", "comment": "Malware payload (Vjw0rm)", "value": "0e70b45372b8c83922cf9028d4e9ad5b0aa50275", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408689, "uuid": "4b78857e-2b11-4db9-b260-da9c223858b2", "comment": "Malware payload (Vjw0rm)", "value": "c71340133d9e006fa62f329c90e653223155b42062ab4faa2b2151fe8064b2fa4cedce68ddd8dbda4035e8fec730b6c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408689, "uuid": "cbc466f4-5e08-4929-ae2b-59622ad22883", "value": "T1ACD4AE60EBC06A799A845897D0BF170F12F65316F411A0CCE2D2F9273EFEE84561BE16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408689, "uuid": "6bfbbb2e-a8ca-4e66-965b-b25e14b2e87c", "value": "6144:OaLfslZvvb4tNj0ncIQFZ2DWUoxxOFOhXb6eq+A3VSU63QAoWfWOrbXXiknk5D/j:LR2fo35oWfhrbikUDH6g2qBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408689, "uuid": "ae41a41a-0fc2-4a45-8c19-bed8b148ce0e", "value": 609132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408689, "uuid": "a3213a13-5ec5-4cd8-bef9-eb4b6b77b435", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408689, "uuid": "918d5a4f-69bf-4aab-8f60-8bd438554a59", "value": "NR_PO281039317.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d41e91-5bfc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639389854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389854, "uuid": "8bd4b933-8dd8-447f-a43e-e2f2fef00fbc", "comment": "Malware payload (Formbook)", "value": "319e6afdb760d87c629413a47e8b7134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389854, "uuid": "9504651e-aaf7-4871-88e9-57f2806a63c8", "comment": "Malware payload (Formbook)", "value": "8adb63ce33efe621074541131f2afec80cd3cf7901aebf7f23d5ca8c105aca4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389854, "uuid": "eb860a5a-48f8-46bd-91fe-3a9c8c73796b", "comment": "Malware payload (Formbook)", "value": "61a8ebd00add1f2fb21df9e70b6593016113fe72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639389854, "uuid": "5f573ea0-b662-4794-87ba-0a85e3b96c99", "comment": "Malware payload (Formbook)", "value": "7f7c0aae3b9c22c7737f244b337ce0a6eab21f205ddac2a8cf98690f8beef1b4e929b0da0411f559f1459c643c6c214c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389854, "uuid": "65155089-476c-44ba-a787-bdd35158c603", "value": "T16445230772E98F92E0ACAFF53A621B1607F1816A65E2D7191CEE71C604FA7C14750BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389854, "uuid": "b4d76af9-277f-4e49-bdb9-23556cc9ab6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389854, "uuid": "c885c7f0-ff97-4b67-b9c1-a9a8c41c76df", "value": "24576:hufGii/kEch7bkQ+8oOAizSoPFrkeDH0de4qOv+3UTqW:6GTsJhc2oNilFrvYd5kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639389854, "uuid": "caa1ccd7-f010-4955-a08d-b5c3f33bf133", "value": 1235456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639389854, "uuid": "2b606591-e7d4-4210-ba53-df51a24b3049", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639389854, "uuid": "493dbca1-e30c-407a-9e1a-b2c6b1a4063d", "value": "Statement of Account-Invoices Overdue Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f48466-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639426117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426117, "uuid": "4c073ae4-a259-4843-9929-39a22bdf75e3", "comment": "Malware payload (NanoCore)", "value": "c82c58a16ea5d1ad2f14859b5a2e0fb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426117, "uuid": "c4b643e2-0739-408a-9ad5-f57ca4b60f71", "comment": "Malware payload (NanoCore)", "value": "8b95710749714e99690b1b32ace69521208b3bb6420765d56647a5fc073a3813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426117, "uuid": "245b7f90-af5c-4598-9c33-747a18ca2c0f", "comment": "Malware payload (NanoCore)", "value": "b3cf69bb34cb7084252c517873bfc7a645e99d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426117, "uuid": "143f2a5b-e0b2-4fd4-b5e2-edc0e4a992b7", "comment": "Malware payload (NanoCore)", "value": "d490cecf3f85ef5e2d7b560cee034dac244bb11984fecda4b07ba4f73256cc03df55ef21fc66672fd03918001a6ce066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426117, "uuid": "902cd07e-9055-4305-85d7-2d93e5ee0127", "value": "T14655331632BC2B16DA380BF821E2755507B731266246F79E9CC6A0D6313BF449BE1EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426117, "uuid": "2b43fc4f-2431-43b8-80b7-a4bc78c99ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426117, "uuid": "922b4b21-8abd-441b-92d7-511afeabd2d6", "value": "24576:KUFiWDvKqHuoxjU9PX9zsrdyswu8Mrru1i6pYQDEBAD4X2TomY:diXmxjU9PXNdvMrru1i6pXqKEsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426117, "uuid": "667713c2-a32d-48c4-bf93-0c644ace434d", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426117, "uuid": "fb9c756e-1539-435c-8f4a-3be14ba524b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426117, "uuid": "f0efba2a-fd8a-4605-9615-60823513b8f8", "value": "VOLGOIL LLC SOFT CORPORATE OFFER VESSEL TO TA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efedcc55-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407855, "uuid": "f44d440e-8307-4c78-ab93-08769c5745fb", "comment": "Malware payload (SnakeKeylogger)", "value": "8c33df999625097817c3dd391ce65b88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407855, "uuid": "a48df782-f443-4541-9320-391b3ffc0ef1", "comment": "Malware payload (SnakeKeylogger)", "value": "8ca45e16147d2658b2327070c5b5d695307a7498cb96a4493c22530a4bb9f4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407855, "uuid": "2d31794f-bfb6-41aa-8a99-7b3fb7537227", "comment": "Malware payload (SnakeKeylogger)", "value": "2170cfd5925fba4f3bd75ae19c261f252d58f383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407855, "uuid": "7364c6b9-4346-41aa-a625-6df270b190b1", "comment": "Malware payload (SnakeKeylogger)", "value": "05ae6d47932ae02dcd890cafbded4424af8ad4223f04cb47437da7c0e0e3ec119e8d764af7798bd6dc5dd429ce5f8727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407855, "uuid": "926b9e72-9f7b-4523-9cb6-8e18f10c938c", "value": "T15745125E23A0DA54F56F17BC94B5C234C336BD056822C31EAAC578EF7E32B809905B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407855, "uuid": "bf2db509-3630-4cc2-b092-2bb50074f71c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407855, "uuid": "a57b359d-b99b-42b6-a144-9f17fba3347d", "value": "24576:mBrZ8Uku9IW1dPp1/WA5qWrgArriX3mQIYEvRYfRaQ3DCeo/EXOHtEga:m8C9IudH5qzuriXWQIYEpqTCeoAOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407855, "uuid": "5e459682-2905-46e9-a8e5-6a7f3b6a7c56", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407855, "uuid": "bd547baf-23ba-4cb7-a3f5-35132568a7c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407855, "uuid": "9cec31fe-cd49-4699-bfdd-a3cd0b57efd2", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a03056b-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639408355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408355, "uuid": "dd281f08-35a8-42d2-9d81-e36c2650df35", "comment": "Malware payload (Loki)", "value": "ff91a9e66e5f865434620747d9ace691", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408355, "uuid": "bd4cd441-a810-4740-91ba-7a563dc7b6e5", "comment": "Malware payload (Loki)", "value": "8d1baaa99555a6100917756725e6f21efc321cd69ca7b4410f992e5e7076e36e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408355, "uuid": "1a3b24ff-9bc4-4573-869a-f81d24feb934", "comment": "Malware payload (Loki)", "value": "3354289921c7ce64d28e080243fb7873ac9dcbc6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408355, "uuid": "35fe3d69-f72e-4830-a463-eb9c095a977d", "comment": "Malware payload (Loki)", "value": "3696898d14c3ade2f4bb4ad2fb894403af25919464315c2d38d737a66ea904e94399a16e759002fc1d3d8fdd71d362b4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408355, "uuid": "d142b82c-183a-4caa-93ba-c07d28b0da5e", "value": "T1E26412473318C39EE4777A368D27641D0BE2ECEB52C49B97A945B6AF02337887E17604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408355, "uuid": "18516b3c-26dd-49d5-b96a-0d44a730a66f", "value": "6144:1oUy+WR9mZUGrDUQObKvk9afDwr/WushI0X4dT0:9y+WuUvQuKvJfEr/W5K00o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408355, "uuid": "42cf59ee-4326-41f8-a1a9-4e78c1864cbb", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408355, "uuid": "909bf32d-eef3-451a-95d5-44c7f55bdcbf", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408355, "uuid": "63ddc984-6ffc-471d-b603-e1b4efc69257", "value": "Inquiry SC-ORDERTWPO20211213.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c67d200-5c0b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639396440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396440, "uuid": "02cefb99-d058-42df-88a7-e529c8a381ec", "comment": "Malware payload (Formbook)", "value": "80129d6b2e2a86324bb0e434abed6003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396440, "uuid": "7f83cae5-a004-4525-aef5-a3fe149e5f2e", "comment": "Malware payload (Formbook)", "value": "8dad8694366562f6e92484ba1a56852b59a9f71578d0c995e0e2001303ecaba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396440, "uuid": "128b58d8-848a-4f71-88f5-bb4b0e83cd87", "comment": "Malware payload (Formbook)", "value": "5af183d8f2f0e8f43c0381abac5e455be76c8022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396440, "uuid": "586d65c6-5f04-4b28-b9a3-597bc332e2e0", "comment": "Malware payload (Formbook)", "value": "0432875f995c2ae43bff54f736e48bb6bde977a862714345c299e2ac7e6fc1ee0aeada6384f39875eeeef7faf07b70ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396440, "uuid": "49965484-6698-468e-b37d-28567d53cd9b", "value": "T1E625239631D81F7AE87287F898A54E0183FAF9253922E74C5CD170EB6E247C02B517CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396440, "uuid": "2de76980-bd1c-41f4-bfa5-298c277f1a4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396440, "uuid": "8e0fb0d8-35f1-4338-9584-2d90164b2776", "value": "24576:XA9H6lt8LJDCKcfoJPvVSjhC6OytNyeWbUragf57Q6A/Cxav:w9HwADCKbSjhqCNVWbUr5GD/Gav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639396440, "uuid": "5004ae74-40f0-4a12-8404-8ce447cb4186", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639396440, "uuid": "a760f99b-03c2-40c1-8a5a-a34b9ef25ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396440, "uuid": "2d267f14-4546-4dec-8629-db62915d18e9", "value": "c728Z4M1h95KvyG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53a8201-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407810, "uuid": "6490690d-9b72-4d62-98f9-5893af5a3b93", "comment": "Malware payload (SnakeKeylogger)", "value": "24618208f1d17d54a8b56eb9d0051b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407810, "uuid": "013f5268-dbcb-4b33-84ab-d1a466c986cf", "comment": "Malware payload (SnakeKeylogger)", "value": "8e5650cb707f359d2df6d0cfcede5a5f4417dc1126f8bf4026931147d39b4207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407810, "uuid": "7d918786-aa46-4a04-a9fc-05785606ec2e", "comment": "Malware payload (SnakeKeylogger)", "value": "09ef0304ccf3fbb63b83438a23aa964809d23d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407810, "uuid": "1447c513-30ae-461d-8d86-c1685a76c0a6", "comment": "Malware payload (SnakeKeylogger)", "value": "7f44436ffbb05cd0b85aa14e82d31f29006f18fca5fa5a53c0398c264e7fdeacfbf22cccc33dd71eba810ad928e88e82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407810, "uuid": "e763a24f-c6d9-418b-aa40-c3aa315df310", "value": "T16245330B33E44AA5C8788BF82EB129418BFA89197375F3D81D8B75DA56617F10B423C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407810, "uuid": "96e62743-6bbb-4f76-81f1-aa26af0bace1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407810, "uuid": "900aefe5-89b2-40be-b648-656307ce734c", "value": "24576:i/LJ+tl7lGYqJtfnjGwgojF9KVS/BwLgIamnDmD1Nry11S:cLWEtfawX5D/2LRnDKrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407810, "uuid": "4581bfce-68f4-4cf7-bb1e-222e73589671", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407810, "uuid": "33c69fbe-3844-4881-9410-b802ecd4bed3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407810, "uuid": "e09bec78-5b0d-43d6-8a99-abcce886b516", "value": "FYA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1020e221-5c13-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639399748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399748, "uuid": "43e74919-0c76-442c-af53-cd0549e8be4a", "comment": "Malware payload (Formbook)", "value": "6edf9a3cc051bb32e578921534acf555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399748, "uuid": "98b4e561-3f79-45bc-8385-c6d969b437f5", "comment": "Malware payload (Formbook)", "value": "8efabdad8127584d800c6d7a5a088030a09c95d5d8066e8baf87636b65676a86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399748, "uuid": "b40533ba-c1fe-411f-9f90-749cf3a32969", "comment": "Malware payload (Formbook)", "value": "e7b9bdf06e5188a65414ab378f1c9eea90979b48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399748, "uuid": "9ebf97d3-5cd4-40df-8c4b-b56bbd2d8540", "comment": "Malware payload (Formbook)", "value": "93460067bed8a81b8907d59732d6441bfac8b7b796f9be52afc23f990c7ac07d8c86435eca10f69a5a2ec24a8949bd2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399748, "uuid": "29809d10-3099-46b8-93bd-f6c20ca52ce1", "value": "T17755121963E48D40E66F17B990B0C1308B36BD41A927C32EA9D53DDF7E73B809A41B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399748, "uuid": "73fc6152-2edd-4499-a86e-502f283987c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399748, "uuid": "d5ee7cce-981a-45df-9f7c-f83c18db7aa3", "value": "24576:magjp+aFZnqcWb+Ir30V7QsqXioeDY2+tVxETgXhXOHtEga:wrDWbtr30V8s6zbGgpOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639399748, "uuid": "2fbc95dc-2179-4616-915b-8d9e38d566cc", "value": 1307648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639399748, "uuid": "c13bda44-fade-4a09-8629-2561737d37fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399748, "uuid": "65b088e7-33df-4ac8-a186-2833be71851b", "value": "purchase_order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68c8018-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639408188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408188, "uuid": "3ccbb7a7-e91e-4ed2-ae3b-52f62b72ba7c", "comment": "Malware payload (Gafgyt)", "value": "b02a73a74195cfbd03acdbc7eddbb191", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408188, "uuid": "74864895-8420-4500-8fb4-96e7ede5c084", "comment": "Malware payload (Gafgyt)", "value": "8f921474fae4b5477f1519b3290ceef9fbdd755f632760d29d8ce23c1f91d757", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408188, "uuid": "0590c41c-f1af-43ac-9d95-1192c8b795cf", "comment": "Malware payload (Gafgyt)", "value": "eb929dc46eb5139ef85be048e5897fa55ac5b594", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408188, "uuid": "bd3842d3-df66-45de-acc8-a84d226d1baa", "comment": "Malware payload (Gafgyt)", "value": "db73f4181d4ab2b7658bc4494ae58a03ad51b55690613bb8f65bee1759d3364a6b9f87d010354c658f0f4523ff0b79a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408188, "uuid": "0ba0f706-6f2e-47a6-b6a4-086b7a5ccd21", "value": "T1B7933A0799A59F77C0C7EAB919EB59300326A8520B2F1F5961386BF4438F9CC740FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408188, "uuid": "d61e3d63-03e6-4cc6-81e4-dd748194b478", "value": "1536:fI7+hcIM9naHAAGtKhmA+J/FosGvJtKqCEDQtmW49VquLeefkcX:YNIMZoAAG0hS/FoHKqvYm79VquqefkcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408188, "uuid": "62687454-80a4-400e-8bb1-d57eb53c64a6", "value": 94356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408188, "uuid": "1e35f37e-85c2-4972-8fce-1a777f24829d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408188, "uuid": "786f6c42-373a-4985-87f1-91e49dd79c73", "value": "b02a73a74195cfbd03acdbc7eddbb191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b421a81e-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408613, "uuid": "490e9104-fe2f-4f9e-b24a-f9f4bba59742", "comment": "Malware payload (AgentTesla)", "value": "d2961c699efcd66e3a083b700cb9383b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408613, "uuid": "9f822d1b-8ab2-4143-ba52-76eca04bf470", "comment": "Malware payload (AgentTesla)", "value": "8f9e070d3a2dd63b8cf5687f16ef70c5858d3d3ea9c018234e7ed92dddea3373", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408613, "uuid": "bb23ebad-4f9c-4dc1-996f-b8845979b560", "comment": "Malware payload (AgentTesla)", "value": "2cf078a0cf6494dbeee1dc750a28b23df7943344", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408613, "uuid": "779af657-90d4-401a-b260-fc6ee576e5a4", "comment": "Malware payload (AgentTesla)", "value": "e192943a3bcf38b4b3092df68b7e0e0f42a7a5f5db1dd68b1b41a9990a31ebba630a8b655e92b7c5e672fef84390353d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408613, "uuid": "dd7cfdea-c235-41a2-a82d-74efc7052cb9", "value": "T10A55231373A8DA26C4BC75FBDC96556207B8B927A623FA8D2EC975D420917F248007CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408613, "uuid": "854284c8-cd10-464d-b455-434218717c0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408613, "uuid": "3ec68092-d353-4f8a-add5-f56cbba9f094", "value": "24576:z/Hz77ZFKQIonsP3pRxj1rnvUKvEyCYqLrVXJ6lyElea+:z/T7P/VWj1rnFXkrV56cGea+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408613, "uuid": "601944d1-adfd-4869-8b27-a939f0a66186", "value": 1364992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408613, "uuid": "4214704f-d83d-4c01-8f5b-a0a2df86c250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408613, "uuid": "a8c00db0-70ad-4f63-9ce3-078c87bb7918", "value": "Attached CO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3053966b-5c19-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639402379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402379, "uuid": "b8e14798-7917-4b14-9f06-7c976940bbee", "comment": "Malware payload", "value": "71b63d2c839c765f1f110dc898e79d67", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402379, "uuid": "192c2e5f-961d-41a6-a1d2-d06e25a6b4fa", "comment": "Malware payload", "value": "8fb42bb9061ccbb30c664e41b1be5787be5901b4df2c0dc1839499309f2d9d93", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402379, "uuid": "b1bac446-644a-4000-8b69-409ddd20bd9e", "comment": "Malware payload", "value": "95f08250ac90aabb4c94811d75e34cedabdcaf62", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402379, "uuid": "f3c37439-be31-41d2-b361-7c067990510d", "comment": "Malware payload", "value": "6ae46d0e23b72de920c91e226c20abc60761a57ea65ac980954e4441a60e007c4ce277138bb3a4caf1ecc1863e54e7a3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402379, "uuid": "fa99f5a4-322f-4e1d-9efa-affa52286bc5", "value": "T195A50188EF85AD1FCDF794320BA7462611620E8BDA82D713786C721C5FB77940EA5EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402379, "uuid": "52cf8e04-e498-4086-aa9d-3476fe935d74", "value": "49152:eZdja2OsPJku4CpTuLg4tUgiztvWF2jTG:eZdj1vJkQ4Xe9TG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639402379, "uuid": "f79da785-f52b-4628-bacb-2753e9a8177f", "value": 2104948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639402379, "uuid": "8f58cee9-4570-49f5-9e40-b2ea379e4f52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402379, "uuid": "3dbc08b1-b169-4ff7-96ce-29dd1e27b701", "value": "SecureTalk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c9d93c-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408292, "uuid": "d0752683-7fd7-460c-b4a8-f28fa8a3ea97", "comment": "Malware payload (Formbook)", "value": "80ab39f8a0cf0368111cecd1da40b581", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408292, "uuid": "4bd5a17c-0d01-4d8b-93b8-ba0783d96482", "comment": "Malware payload (Formbook)", "value": "909d6c6dfb1adfc9efe2d1e2b7f4d8e4726b44e2f3e6f3c598ed51d38c2d440f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408292, "uuid": "713b9e76-0e7e-4141-a49e-b4108109d826", "comment": "Malware payload (Formbook)", "value": "eb2639328497583102e2a0cdd03c8e36d6ae5786", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408292, "uuid": "8d80bf7a-b5e3-4280-877f-b95d3c01f864", "comment": "Malware payload (Formbook)", "value": "1a7bc7972d53da007eab532f3db0477865829a61a1b548f25efb65c65ea1f0524fb6a86e606d387405bdda689a86abd4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408292, "uuid": "20f1c582-ff14-4adf-88b9-217c6b0a4d18", "value": "T1356412FA76E55217E96620B49E939037C8DBEEC04B54C60F2C1E7F1606B8FC20B46667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408292, "uuid": "e58086b0-a1dd-4c4a-a26d-f9c521172f31", "value": "6144:TWOH2MvFvBp0saw4Tqnx4wXquRkNULeAfIW+AyXPFUpBj:ThWgFInw42nxhqeLeA8X9U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408292, "uuid": "1afdbbc5-d404-4792-b575-f8c4ff3d290e", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408292, "uuid": "efb0d0f9-50e8-4796-8620-91c495657112", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408292, "uuid": "8ffd6907-47b9-4ccd-808a-150ce3c4a159", "value": "Part 1.2.1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c332b914-5bc7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639367407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367407, "uuid": "06b99c3d-ba31-450e-ae97-e796a05719fb", "comment": "Malware payload (Mirai)", "value": "85c4ac80f49d352174233dec44a1a84e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367407, "uuid": "9f8c91b9-3f20-462e-afeb-1c11227712a0", "comment": "Malware payload (Mirai)", "value": "91464ad80b8ef39599b0dcc227a38728d2195da47f6e18b455701433ebd1fc7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367407, "uuid": "efa5d8c4-cf06-40f2-b52e-9928b0d82e08", "comment": "Malware payload (Mirai)", "value": "2347fa4fc5e430e6e3d6aea66f1b042ab49139b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639367407, "uuid": "d2b6becf-6daa-4e1d-9be3-b157707e382d", "comment": "Malware payload (Mirai)", "value": "32e62c9c2616bf7255a2969fcb78bcc2b934eaf0b67e9ff0b4dafc803546a54842af1853315ab562a7d76412efe9a5df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367407, "uuid": "7cbae5de-ba09-4b1a-a9db-045313f7c6a2", "value": "T16AA2E1A19586D676C736443AFEBF45C731A797FCA0F6737602108A387CD442421F21CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367407, "uuid": "24676fe7-cf26-404e-b57a-9fc295cb87b3", "value": "384:cAD5qbWJj+woWlb7mNCSr3Rj7iMFra6PMthdq1fdav4BhymdGUop5h0:vD5KOTog7mNxr3Rj7iM9CvAevOs3Uozi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639367407, "uuid": "d02d81e1-2d64-448f-b89e-c4cd3e69c1a5", "value": 22460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639367407, "uuid": "7b10bc22-99b8-4297-a9d2-44f426a60428", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639367407, "uuid": "ecb50ea8-4bd9-44fe-9a22-324146a6c955", "value": "b3astmode.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca26228-5c53-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639427525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427525, "uuid": "bf7ed59b-ba5a-4b21-a18c-0c20ddaf8d8c", "comment": "Malware payload (RedLineStealer)", "value": "a7c9abbeb67e1507f9c1497361433dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427525, "uuid": "c80ea43d-3e45-473c-bdb6-17bf3f8dd64f", "comment": "Malware payload (RedLineStealer)", "value": "927fa23b30efaa97cc211f5baf40096534d5106b78869a448dcd96266139eac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427525, "uuid": "9de2c2d9-a23e-4c8f-b2bf-7961d59612fb", "comment": "Malware payload (RedLineStealer)", "value": "1783b593ca7b6172b1d6f3631390957819a9288b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427525, "uuid": "5da5dfbf-ee74-4d9b-a081-b464ea2baf8b", "comment": "Malware payload (RedLineStealer)", "value": "230c43586e23fb2f1a73229089c094bcf3f6735173a879dcdcc03375c0831c780c5d97cc0c5d0eaaf6f4cd3294ad5101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427525, "uuid": "0daf7abb-3881-48e6-b0d5-48ceeb3b0e1f", "value": "T1B874D0C1B6E0C831D2A23A315875CBE44F7BB952E924855B77783B9E6FF12C04A36316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427525, "uuid": "100de470-228a-401d-9687-96f2c6d661cd", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427525, "uuid": "0f570079-953b-413a-9bac-f1f8348c9384", "value": "6144:YNVCpGt46aZeAGEfbZlhRfoXR2i1r1tb7ITsqD:mkpGsBGOHvfoBZf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427525, "uuid": "4cd06a4e-03bc-4c1f-b20f-72edb0cc7188", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427525, "uuid": "cc137939-6740-47dc-b132-3688a481daf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427525, "uuid": "8518f563-ddbf-4f8c-a814-3206c6257311", "value": "a7c9abbeb67e1507f9c1497361433dab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa81f0c0-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386827, "uuid": "df1d61e7-c311-4a2f-b9af-891f54bbc9cd", "comment": "Malware payload (Mirai)", "value": "06c29296def00117bf3a40960300a517", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386827, "uuid": "17330fc9-c4d9-4835-8697-3aa635bcec73", "comment": "Malware payload (Mirai)", "value": "929b7d6e2d9b11f6f52f973bc7cd5fbd5c93ec61d39330a895c4f4c64bcd1c14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386827, "uuid": "bd9c7162-8249-488e-b672-7e7074bfa936", "comment": "Malware payload (Mirai)", "value": "7d327ef929d47bbfcd0ecfc618c38a967135e78d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386827, "uuid": "0c8b62fe-c22e-432c-811a-2f5fbb16665b", "comment": "Malware payload (Mirai)", "value": "30901ef207229834ede9a4a10cbc8c449aa7d8187967c5042d7581cb5662a544e2c07c6361c6f0894c3411533783616c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386827, "uuid": "5f994523-b7da-4489-b49c-b4be1cd7dece", "value": "T1FEC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386827, "uuid": "88d239e7-1d5f-4680-9b5c-299ae318d1c8", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBe1EdWfRZrmW+IFj:Ted0W0MZQH5d6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386827, "uuid": "3b553d48-8707-4afe-a00b-6a946a716e27", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386827, "uuid": "1e12bffb-4fb0-45d4-9ecb-37a5ecc26dd6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386827, "uuid": "6f84fe30-c2f5-444b-b611-3b344fc8f12c", "value": "06c29296def00117bf3a40960300a517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233efa30-5c15-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400639, "uuid": "aeec15be-4a28-403d-a4d9-e45147597550", "comment": "Malware payload (Mirai)", "value": "7ec0bd5b4ed55c587636a5e7299c2b7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400639, "uuid": "6627f46c-087b-4c93-9fd0-85fc136a19fc", "comment": "Malware payload (Mirai)", "value": "92aad1e9b651beef2da4a85bde227dbb8fc2c4c7b8b5415b660b79df0815158a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400639, "uuid": "96eb1434-f548-4d16-9091-314100a49aef", "comment": "Malware payload (Mirai)", "value": "2811011900aa4dc4124d3939259bd3b6d452d422", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400639, "uuid": "14f75ebe-fe05-45f8-b1a2-b8600e904133", "comment": "Malware payload (Mirai)", "value": "f3bce04e54e1573afe2c940ac263ea64e6798ff1f462ba9582dfca2fb9d7a6f3e42299b4229061a879fea32fb0e7b108", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400639, "uuid": "d6c14ad5-5186-42a8-b380-2c24bf68c400", "value": "T11913F1B9EB819490D8E05D76DD3E0282A1F859D5D2BEF910633C21DC318811FE7EDB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400639, "uuid": "e62255f9-7313-44c3-a1b9-d5c0fdd2b694", "value": "768:Y0KKPA0/9UBX7WmlJ9ft+bM/zuq8Kj9SMm4jFb0iy0Zl0BYiqfq3UIxN:Y9H0/mRSy37/zulePPrCY47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400639, "uuid": "68be6877-9d8e-4eb6-ac70-c84c4f82f7f0", "value": 41920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400639, "uuid": "9407e218-7cd9-428d-9e9d-078fa4779938", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400639, "uuid": "dfbdfc6c-d7ff-427b-89ef-6c6ac1b4eedc", "value": "7ec0bd5b4ed55c587636a5e7299c2b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55bb03e-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639426305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426305, "uuid": "f9c742aa-6ca9-4804-a71c-7e139cc554d7", "comment": "Malware payload", "value": "c2d01e4033ecd0f1918f3a0a9a208bf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426305, "uuid": "6689e435-6efd-4b9a-b7dd-c914b7d692df", "comment": "Malware payload", "value": "933a2e4716b395f6fa6aed9ae203901742b7993fdb29d5b2f56a3c82f80fc095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426305, "uuid": "75e196cc-ab61-4a4d-973a-5e41700242dc", "comment": "Malware payload", "value": "a67ca453d68d616805a6b78cb8c189d0590539e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426305, "uuid": "34a912ba-0f4b-451f-9da8-cde6e6915c80", "comment": "Malware payload", "value": "bdc76680645fe7b849b159d0e740c49c2a786932a273fde8af9a500840e307838ac44cd58b6faca829bc3a330120f136", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426305, "uuid": "07bb21c9-8300-43fd-b36d-cc12b6d493b4", "value": "T135B52305761776DFC692957DF8EC2D35D1B0E059B11BFB032E034C2C6A4EB42AADB292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426305, "uuid": "71a33441-1246-4b9b-a92b-08a4a768a9e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426305, "uuid": "353e0ca8-b1c7-43b7-9691-895f2a38ea4f", "value": "49152:89VNIDV1BvC8zD+wG1PJF7CU72EqDtZpIsPmzZOQX3dpsDpPccWb9QBMC:89HIJtn3G1PJMAMeOQXNEeSBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426305, "uuid": "977aa32a-0c4e-4b0d-9a15-73a2313836fb", "value": 2298880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426305, "uuid": "d9f85973-154e-4453-9068-64813941cf8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426305, "uuid": "6a0db939-7caa-4438-bfc1-792f2472061e", "value": "c2d01e4033ecd0f1918f3a0a9a208bf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6236264-5c18-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639402255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402255, "uuid": "4dc9bf77-d088-40aa-af12-18cb695f3dda", "comment": "Malware payload (AgentTesla)", "value": "631e8346c6a9e32fae6a720102d59bc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402255, "uuid": "88111668-c7c0-4eba-ae5f-163849337067", "comment": "Malware payload (AgentTesla)", "value": "935b9cc8f7db0ad2fa9ed5cda30e0651792763a460843dcd0698943a6af6a6a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402255, "uuid": "19162e5b-fc32-4974-9bc8-410381027783", "comment": "Malware payload (AgentTesla)", "value": "3f335b24b62e19d1ba6f8a9aa763a9b1e9acdd05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402255, "uuid": "961a09cd-4ea4-4b32-8766-8b9527e7c597", "comment": "Malware payload (AgentTesla)", "value": "12279114c3a259a58cc62f9e2bae0b076a879093a08ee45b6c26b2b52887af85d94d8a8b04925e6fc1d297accfb19931", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402255, "uuid": "7fde58bb-d02c-4829-b2be-7d47b975a3ea", "value": "T1CF353395BA86C347C9943BFE191596300676D04BD1E4D3483D2E04DA69B3BDCE3A0EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402255, "uuid": "104e6e9e-aa17-4908-b41d-6bb25ef7cd59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402255, "uuid": "95874d68-49ac-4b4c-9d7c-befcad4ad920", "value": "24576:W2ESXEYAIzIDs/vMxQVwJc0sW2lA48NrtTunFRR5TfCuU:lrXeIzIm8QVw60aO485JunTBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639402255, "uuid": "543c33b0-3b41-4a72-bcbd-42e151afdbe4", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639402255, "uuid": "03ec38c8-869d-4f20-911b-b7c816e66337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402255, "uuid": "ccdfa332-5617-4b83-9636-6f1238a2d4ee", "value": "BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3e3f29-5c09-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639395452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395452, "uuid": "b1400778-170d-4b91-a293-bfe564dda36d", "comment": "Malware payload (Formbook)", "value": "6e0e0f8d1ce80470f7bc00d6e7b9256f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395452, "uuid": "c02da033-e126-4650-bb42-085719a812fe", "comment": "Malware payload (Formbook)", "value": "947e0314a5c24952596b1a6f8455e10c642ad0d3dc88a57bcef1ecbdf69d418b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395452, "uuid": "b2e9d813-976f-478f-a76e-d59270f40984", "comment": "Malware payload (Formbook)", "value": "a7ec1fb10f750ab48aaf225140425cf2be554b29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395452, "uuid": "4ea535d5-8886-4262-8f22-3ebdffb25a06", "comment": "Malware payload (Formbook)", "value": "a428a98923489a5eb729cb4f17b15a5c6b0de0c60c43ecfaaba85dd9abef7bd0e1bf12d4c5da69cb19581bd5269e261d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395452, "uuid": "1bb8affe-4763-4c05-8642-f399511f3dc6", "value": "T15E552342A0349A56C873D7F06630FD625BB1E46AD630EB1C5D8A14FF29A9FC15B18BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395452, "uuid": "d2c37caf-0113-40e8-a190-08f2fe2d90bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395452, "uuid": "e5ffb409-982c-4fc8-bc08-f3487b3341cd", "value": "24576:nTnF67kM9Rcdrlhmdqj5W7dGHvx51iv6cZtbUsiOyjkVk4SyQ4MrgkLv:TF67VRcdvmdqj5GwHvx5Uv6KUsvSkGSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395452, "uuid": "c9757cb0-dcc7-4bb5-a813-738ef64c460b", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395452, "uuid": "40dd6a70-54cf-426a-9ddc-1fa69d88b3cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395452, "uuid": "ddf0bc97-5d08-4dd0-810b-ead8d01460ad", "value": "6e0e0f8d1ce80470f7bc00d6e7b9256f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3e76ba-5c5e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639432138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432138, "uuid": "c205497c-eea3-44d7-a050-78aed69cf016", "comment": "Malware payload", "value": "6c71189c5a7288a11777939182a68580", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432138, "uuid": "237c3b14-c602-4e05-86b3-73fe04ea10e9", "comment": "Malware payload", "value": "94ba0bcb6b19c2d7cec1891c5b5c52d60d7de643321429991605b86e26f8b032", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432138, "uuid": "f5c558f3-0eeb-4d2c-a5fa-bcc5aaf0f1d0", "comment": "Malware payload", "value": "686cbd09f3c3bff6e5cab8c1eef99d102d0e4cfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432138, "uuid": "1be67700-f4eb-4264-a0a2-e3b78e9894ab", "comment": "Malware payload", "value": "efd21686c582c9030f59eb6f36fe25dc9af074a6707b31fa3635f1a028d91d2569f6ff8a201e042a4dd28fc75e695a25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432138, "uuid": "73826f98-2f87-4074-a360-078c10d46d7a", "value": "T1F755126823A49959F16F077A90B1C230D335BE04A827C31F6AD56DAF3E737D09904BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432138, "uuid": "775dd4c9-e1d0-47eb-bcb3-e511b05eda7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432138, "uuid": "bb889c8e-3012-45a3-b33a-bb51ef145b85", "value": "24576:3Tdq6fA1dn/t2xrQ67+B6ON1sMI/qcs5GoInL8VwltyBo9PFycbaCziXOHtEgaq:xqp//gxrL46ODsMI/qrrIL8IUBonymPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432138, "uuid": "ee7f9076-1396-4fde-beba-2c35e38700d1", "value": 1387520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432138, "uuid": "41d9015a-f2c0-4b1a-9b4a-c3976f860797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432138, "uuid": "0d4355f6-5e22-4cbe-a926-48f8e66d6fdd", "value": "6c71189c5a7288a11777939182a68580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91707330-5c56-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639428741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428741, "uuid": "92d50c1e-4f0d-4168-8c6e-27cc53808676", "comment": "Malware payload", "value": "78156e0c20d7f4ef87a65941582cd58c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428741, "uuid": "abcddc96-3abf-49fa-aeae-602fa61a6ae3", "comment": "Malware payload", "value": "95404a80ecd07709c670845366a5c7f1bc54e465f6b0091abba0a00b98f4ddd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428741, "uuid": "24e62675-b2d3-4cc9-8fa1-fe4a12dfdf69", "comment": "Malware payload", "value": "c96ef8b145b80c8de699cf92d522b4610ddfeaa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639428741, "uuid": "48c716c6-405a-4e2d-8203-e8035a218bc4", "comment": "Malware payload", "value": "50867e22a188516cb15081409ad8144220fa15ebfcce1202cf3746bdef4344d200d3b1b7f933fabeced8204ca0c7e3d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428741, "uuid": "0170af5f-8c4a-433f-9779-6b37f5795fca", "value": "T1AEF4AE2935C396DDF87ECB702FA6A2A003F16DF9D5D3D29DE498300B4A33391791616A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428741, "uuid": "e3301d7a-9a79-44b7-81a0-a5193fc9ea0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428741, "uuid": "6ea698e1-fb88-4512-8559-0429e03422b4", "value": "12288:0fKfe+bMnIXeUQxdQA7tJ6sRVip1QXGu4Rz7FurnK3cdQVYJUEKl75jQWmc:5ejnIXenPzGuTDV2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639428741, "uuid": "eb5e326f-37cd-4861-b620-fb7028e704fe", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639428741, "uuid": "9537f203-cefe-4b32-8c61-e9b6deb105ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639428741, "uuid": "a0a3a60d-f213-4408-aae0-c2e0aa519830", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2113cc-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639426107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426107, "uuid": "7c63b849-2898-4c8e-92aa-fa7c093b4daa", "comment": "Malware payload (Loki)", "value": "fc3d18a6fbbe2695664d62c277749d3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426107, "uuid": "2a3730de-6d58-4441-a728-e49a20f8a698", "comment": "Malware payload (Loki)", "value": "9560586b82bbe83c67e04450d4402db7b27b30a80a302f82f85b5d9a30b93daf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426107, "uuid": "45803470-f405-47bc-8723-5f7d447f8313", "comment": "Malware payload (Loki)", "value": "66496a1909a9e39b8e4e90d06e3f1c924052280a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426107, "uuid": "54c72e60-c47d-4ba5-9d25-50d98cfc1dcc", "comment": "Malware payload (Loki)", "value": "1bf79870f341bfb6e2f736feca7c7d22c2ac3d25028991a8af1a470fe54e6dc792a9f1fbc878c723ef96ff6d117c8869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426107, "uuid": "0c988fde-8647-402a-89b9-bbfa407a4a1d", "value": "T1EF45124A73E88D14E17E07B99070C2308735BD156926C31EAAC93DEF7DB3B609A06797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426107, "uuid": "fd40dc80-fabf-4ee9-b76b-a7da027e795d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426107, "uuid": "3ac2912c-a438-4a1c-8ee2-4bd2f19aef41", "value": "24576:5MXOHtEgaoxDUmlf8VLjw5VrsA9NETvgiSm/BnN8HO05wMnQgusyd:OOygaSDTlf89jEVHIgkN8P5XQ9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426107, "uuid": "178fb4a5-168c-4cca-8ab3-a8cf701ff7af", "value": 1239552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426107, "uuid": "7c5fa8c6-ff86-4f3e-aa27-2ca5df161c42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426107, "uuid": "a76b78f9-c16a-4058-bac3-89c56e46d13e", "value": "HY89000876555.SCR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afda7f6-5c61-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433455, "uuid": "11c70246-2c7e-41bc-b1fc-edaa9c926c85", "comment": "Malware payload", "value": "be02f053e95e37abbb6aff4e48907623", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433455, "uuid": "62671b0a-1ddb-4ac1-8e57-77b4ef575c53", "comment": "Malware payload", "value": "95b9f44d2995990a868fb29d2bf9db3563e5d9ffcadc59732d6a9d67a54f1e4b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433455, "uuid": "5facd960-4bbe-4f6d-be62-73f4d7a0830e", "comment": "Malware payload", "value": "c19cf937f1ee81f06410c74fcfe0782f7609c80e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433455, "uuid": "6875acd1-7499-46d0-8158-789cbf1da97d", "comment": "Malware payload", "value": "7ac3f6ffc9a1ec4d3f6a83bdb8966503b5b5d699d7fb458b50af42494e7de9fba8fc31e8190bb10b87f8e2e4d56e7399", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433455, "uuid": "e259609a-1779-4d80-8d04-a4bcc53e43f0", "value": "T1F1A4235876A5AC0BC36C18386B1DA8D67E07629EF400F61A529DB13D012B4DE47CBEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433455, "uuid": "e962840c-fb6a-4d95-98ff-2e0233449d25", "value": "12288:JbZao+zcm0lTvLeK60sI+B/VONLb15i3amcYVspp3waIrWOOt5XaV:JBTvLeKoIK/VeLb3i3a8Vk9Bt5XaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433455, "uuid": "3eae7967-2bed-48b2-9f32-cc088b88b756", "value": 491603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433455, "uuid": "c3b2c753-fcf4-41b6-969a-66d9ce67b1d0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433455, "uuid": "ed3e0649-113f-4eb7-8a71-0723664f6bbf", "value": "2465144019-12132021.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b5176d-5bfd-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639390631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639390631, "uuid": "4ba857e5-2958-413b-8695-78e4eeda1128", "comment": "Malware payload (AgentTesla)", "value": "c32e2464d5412daf4fd7e5856a861563", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639390631, "uuid": "71742702-e633-477f-b5e0-553c05e9b284", "comment": "Malware payload (AgentTesla)", "value": "967ed55b20380de581bc96507f5506b631c1e33439943c092aafcca0f7242aef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639390631, "uuid": "e1ffa9e9-26bc-4e25-abf4-0520d91a2877", "comment": "Malware payload (AgentTesla)", "value": "a7328e9c8706b9f9770fc592183867da2feccb8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639390631, "uuid": "4be84d19-d063-4fc8-92de-46d8b0f1c85e", "comment": "Malware payload (AgentTesla)", "value": "290f7ed1e90b62ffe949f2f8bae35ff22da8a1fd355bf64605d02cd9614ab4206bcef1cfcee66e97780e7b0c0b4f2f7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639390631, "uuid": "6164e0aa-e235-4e18-811e-a50a8bf32d7e", "value": "T1005533D13229C369DA2997FCA478375637B5D5242808E36C8C9E60DD76A67E08C23FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639390631, "uuid": "51fa973b-073c-4cb9-9aac-78ab982901a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639390631, "uuid": "26d275fb-5301-49e9-be06-fe5244196013", "value": "24576:5ZoX7gFpj/+5pSJLmscL0ZPeAyrnGK3mnlE351pjJkQ7GmlNX93Go/aLF:KgP7IpSJLmu0NmnOHT7GmlV93Go/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639390631, "uuid": "988febbf-cf6a-475f-ba40-c5325d67bffc", "value": 1370112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639390631, "uuid": "698344c9-7bfd-469a-b019-f27c90639d04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639390631, "uuid": "e89ecf0a-cf4c-476d-bc8a-c2ee4037d4d2", "value": "PROFORMA INVOICES 0073524252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a811335-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425992, "uuid": "c0d5fedb-2686-4ac7-990c-7edf458fe7b4", "comment": "Malware payload (RedLineStealer)", "value": "3dde2c7722dcf07af2a1cfff0301c651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425992, "uuid": "37d3844f-2c8c-4859-b580-949c17082ae0", "comment": "Malware payload (RedLineStealer)", "value": "98fd01e9c8f0ab6022d90216d27b362991bfb34eba21194ef72ea18a6457253d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425992, "uuid": "3e3d3f80-00dc-4b0c-a2fc-67cde5f77f15", "comment": "Malware payload (RedLineStealer)", "value": "76e4ea8bd7535b37144f26a9e156e9222ec065f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425992, "uuid": "c78289bf-8f38-40eb-b58e-fbc0634b65a7", "comment": "Malware payload (RedLineStealer)", "value": "7b803cb52851c69d0ed6e9637d2db7acee7b835c5098f1523137fab90aba8329b7a413b7ee50a622fa46f9d993ac1adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425992, "uuid": "51f20906-4def-463a-ab0d-906be61788e5", "value": "T14564E1C175A0F972C1E23D31983D97A04E3FBD51EA24B18A763C27BE5FB62C05A21752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425992, "uuid": "245b5fb5-7bb4-4ebf-ad23-c08db25f9fd1", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425992, "uuid": "44075f3c-bd5f-4949-9a97-e87e86e7e27b", "value": "6144:Ge7ca3r2rR+Rs6p6Ay1ayqYdZ0qiCghHE7trGb7ITsq0:GWpr2T8yqOTc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425992, "uuid": "cf59ed50-bb02-49dd-bf34-663fb268b652", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425992, "uuid": "3870fdcb-a373-4ca1-8a6b-233f653ae107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425992, "uuid": "f97cfe9f-aa88-467e-a09f-15732af76c9c", "value": "3dde2c7722dcf07af2a1cfff0301c651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18710c95-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639395038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395038, "uuid": "625f95c1-9217-4405-b4c6-efc48b3f2dff", "comment": "Malware payload (AgentTesla)", "value": "41f181d2950833b23f2f13c4dca70fd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395038, "uuid": "dd0131eb-c5d6-44bc-a549-58eb5044ae91", "comment": "Malware payload (AgentTesla)", "value": "99341643e9223786c8ddfd16053d091bf79cfa317b30bd6186f6282641b23d56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395038, "uuid": "4b564ef4-b2a6-4497-8f9f-de599ec7cebd", "comment": "Malware payload (AgentTesla)", "value": "80b5cbb030f071a258e082b97c343682a3ee2fb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395038, "uuid": "cf66d48b-310d-444b-a2d3-5e4d366e4a9e", "comment": "Malware payload (AgentTesla)", "value": "a8bfee4fed4cd70e45030f0dac9a96e4b3c5b720ad44a2fc819b78c3e29f0af15d54cce679975f8dedd869589c8454cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395038, "uuid": "b9559976-a5c4-4df3-9865-55a190869c15", "value": "T1D655335E60FB65ED3AA4B3021033E5F4B76E2ADD67A4B9D76E9912B0EE4C7060703409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395038, "uuid": "713080fb-fd8a-4b91-b788-2887dc23c926", "value": "24576:HLFAuvn3IM6AU394VEekUWDCVJABFDkF++gxuXVOqlrZJEgqsjlYecy8EDUO3hAZ:HJlvYdd3OXkUWDuJ8Dm+Rqlr/qsjuhyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395038, "uuid": "38893ab2-13bb-411e-843c-a9c16275885e", "value": 1283406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395038, "uuid": "093f8c38-5690-44a0-b018-26e89ee3df32", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395038, "uuid": "199e099e-8a44-409f-a351-68339d33efa7", "value": "GEN-511BMinutesOfMeeting_Sales_13122021.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b58d0f0-5bf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639386050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386050, "uuid": "9298b010-819a-4e5f-9e61-0c3aead4fad6", "comment": "Malware payload (Formbook)", "value": "eb62d3d13ff0e6dc6e3daa1b2513676c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386050, "uuid": "8d9f8cf6-1fce-4e49-825e-7aa0474d8c85", "comment": "Malware payload (Formbook)", "value": "993e2502c86bc87766ee853a75c89ffe6a635383c685b1aea785364b7c101b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386050, "uuid": "a67c6276-3315-4021-a2db-035e49cb15f1", "comment": "Malware payload (Formbook)", "value": "98a8345372e8b6ff98826c35f55fe594384eb235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386050, "uuid": "9ca0bd04-c4a6-4f25-ab84-3de1989ddce7", "comment": "Malware payload (Formbook)", "value": "fc7c66d5aea0c5e27e4935a34037f9d05943bfb0fe7c73a6e8f6b11eafb74423272313b02c7e3ff8ebd1cd131f9429c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386050, "uuid": "aa9deae2-e8ba-4326-9b8a-7975a0f4fe58", "value": "T1FA1523082695CB3BF6B642B749B9947007FB50179A98FD48388461CB06D7F9F2670E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386050, "uuid": "44b86ade-4b9d-46b4-a999-dce4807b23d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386050, "uuid": "faeda532-0b87-4447-881e-decf679a8d25", "value": "24576:gMbx+BQcd3/Yt56WT2vR6XeXTxi9uvuEg:pl+htW5RQVF/uEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386050, "uuid": "fc0acaad-da1e-4fb7-930f-a6c948564285", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386050, "uuid": "c90d44cc-85b0-4336-8d65-8c968a78ca60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386050, "uuid": "3025e2bc-743f-4c3f-b9cf-821513f8390f", "value": "RequestLetter 11DEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce6c60b-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639408064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408064, "uuid": "b2cf3db1-2de9-4ec5-9730-1e8f5ed552da", "comment": "Malware payload (AsyncRAT)", "value": "b4e2d6263b8f05ad465849939e817cca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408064, "uuid": "1e01d94e-468d-4290-ae34-7ba0701e736f", "comment": "Malware payload (AsyncRAT)", "value": "996309acc8b965eee4a922fa4b367f985800bd9cf761f501bc6fd7f9a691e6eb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408064, "uuid": "06dce71a-3bd4-4a17-81cb-2126202bf637", "comment": "Malware payload (AsyncRAT)", "value": "8fd5b23c7d3d283ba4f100f4f615c616e5ad4aed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408064, "uuid": "f014e0e8-5725-44c5-aba7-e7c87362bd24", "comment": "Malware payload (AsyncRAT)", "value": "cd59c3bfa9676f580b29bf37033c5349559540c2b6788a7514a763a11a95fe53d286a896720dd501ecb2b0a3832e8256", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408064, "uuid": "0b095da9-be01-403e-8d01-c22da5b706db", "value": "T12735120639B0D427D26A4772C5ABD1508FBCF4037DB2E27B289263ED7D79BD98903186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408064, "uuid": "c65bd026-83dc-42a0-8980-1c030ba298d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408064, "uuid": "e4f6c22e-8d42-4d78-88c9-126f8cfeeca2", "value": "24576:0IKjy/SYCp2aa0IoX7RzeaLOurV+86gbrHRfMTLmS1:SjASeIpjLOu8CHx2LmS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408064, "uuid": "8c1aaaaa-215b-438c-b1f8-d3418113104f", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408064, "uuid": "21749140-ccf5-4fef-ac68-7f2e60611bf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408064, "uuid": "b0564926-aea7-44d9-9f64-3f2a1aa38694", "value": "Check.cmd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a6de41-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426009, "uuid": "c250ab1b-f45f-46fc-8383-4341c03139b6", "comment": "Malware payload (RedLineStealer)", "value": "9162a655774c42e579358f6c22c1923a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426009, "uuid": "7e566084-628f-4170-b14f-2ccce79887a5", "comment": "Malware payload (RedLineStealer)", "value": "9a1fba459148f61d93a942fc9e9a2c2799752f0b5f8b197e9779cdf2d6443a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426009, "uuid": "96367cc4-c98e-4f6c-a896-7e60a0c23759", "comment": "Malware payload (RedLineStealer)", "value": "1ee063df995301eb2d46ffa81f3b044f627de161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426009, "uuid": "388924b5-670c-46e5-a75f-8e8c01af8147", "comment": "Malware payload (RedLineStealer)", "value": "a1bdf5bf23c263f172faccf45fb025a61ba8724c1674a163ffc38e890ecc5229d431a5d7176f51d26981fccc17b5202e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426009, "uuid": "366aedd1-c366-47f4-93ca-f08ba3eaa829", "value": "T1DC64E0C172A0D571F6E22D708821CBA58E7BBD51EA60814B77742B6F2F736D09722732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426009, "uuid": "efefd620-c80a-466d-9cad-c9a054fa0c32", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426009, "uuid": "77be3fa9-c31f-4c85-97c2-dcfcf6936c95", "value": "6144:zh7jXF91l6miMgnpciaQhzPD6B+hanWoNwb7ITsqB:zRjVjl6m2HaQhf68oTQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426009, "uuid": "583b50b6-957b-4edb-8361-5c4b5854c1f4", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426009, "uuid": "c1e4b2b7-82ae-47da-8e8b-b8b4ab100a50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426009, "uuid": "4df298f3-399d-46dd-a43c-120e8369aa27", "value": "9162a655774c42e579358f6c22c1923a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d1d63f-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639414007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414007, "uuid": "0b9c9c83-cea4-4af3-923e-8434993fba26", "comment": "Malware payload (Loki)", "value": "621b376a4e0d046017af78ac8d1238bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414007, "uuid": "a81a5f42-cbbb-4790-8e01-39e40961a79c", "comment": "Malware payload (Loki)", "value": "9a9c1c42e84b616ce14a11d4fe279afe825668f5fde4786f11bc9d6122d0df58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414007, "uuid": "cde69f28-a52a-4392-b7f5-adf8633746c6", "comment": "Malware payload (Loki)", "value": "3fadbd25f09010004272d2fbab5c1a3db9ecd7cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414007, "uuid": "95fe907c-ae34-4d99-9c22-4d8ac15d6a74", "comment": "Malware payload (Loki)", "value": "7c4ec485429993fc8f9cf9433fb9c3f01fbb82d7262e780da6bec40afc53b9306a99e81188e0e1231a32c54665cea55d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414007, "uuid": "2802a62b-6923-4222-9224-c17d79bd62b3", "value": "T11DA4236521C2FBB7DFE187396EB2DB68F7FEC29B1059834B536B0F0CA922442E455042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414007, "uuid": "88d97f11-e59f-4102-8dec-dd10ae76c375", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414007, "uuid": "03360e9f-0682-4fea-9771-0ed892721905", "value": "12288:p1E1BqsVAuuCSYm4KDa2+J63PNnzCvfagwNTHsk:p1EHqsVAEdK0AFzCHTW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414007, "uuid": "e51a2987-397a-4178-b27d-7c3e9bf8d6ea", "value": 462853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414007, "uuid": "0f528d79-1b78-4b2f-b384-eb6192813a8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414007, "uuid": "39e9d7b1-f642-4287-a382-ce21d6f4b632", "value": "621b376a4e0d046017af78ac8d1238bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ad7dff-5bab-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355070, "uuid": "fb107976-d626-4e1a-9cbd-3961c54afefb", "comment": "Malware payload (RedLineStealer)", "value": "ef1e95ad77fae81f4218704ae93fec55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355070, "uuid": "c7f30759-7cf9-49d5-ab40-5b9d61605f06", "comment": "Malware payload (RedLineStealer)", "value": "9b2b323c641ac1dd26cce76bc6660f4b801c70b6618ffc13fe7cc32c2cfb9abb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355070, "uuid": "333c5280-b167-458c-9e61-2128d048bcb2", "comment": "Malware payload (RedLineStealer)", "value": "01f341dcffee2f95b5df3bd902fa3f435ab7ab74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355070, "uuid": "93bed603-ac5c-40bf-82a8-6a3a4fc17627", "comment": "Malware payload (RedLineStealer)", "value": "6d6239918824f1fa6a6c3d08b8f5d3d440cd0d74653ec8fc5950445d82661b9ec093123e6a56cf5778d478b6da59609f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355070, "uuid": "8cc0515e-766f-42aa-9981-e3fd7aa6da6e", "value": "T12D05F1D0AA09D109C8087838FDC381F1A96DDC9CF45976E3B1947F2BF97B5412EE9126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355070, "uuid": "c4f72ba4-9a90-4a1f-b7ce-055ace5a0442", "value": "b1e6f3ccb7d793cacabf59b6a40972d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355070, "uuid": "e7a73f0b-d587-4859-92c7-0362567bfd58", "value": "12288:OU8FQCAvI7LPFBBkbqdY7Kax4d6U/fFChYvc2LBOvr7hqE8mj0Rf6va7L:9CbkedeKaGHLsvr7V8ms6va7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355070, "uuid": "97c7ae82-dad1-4153-8ef3-412bce4e322f", "value": 806792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355070, "uuid": "d383255a-b01a-496a-ad76-b04fa1a99c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355070, "uuid": "2b84d430-2a33-4e8c-b09d-01c28228b3c9", "value": "ef1e95ad77fae81f4218704ae93fec55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befcd62e-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639355803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355803, "uuid": "9f71951b-71f1-4620-baef-0d875be68069", "comment": "Malware payload", "value": "4f9be3acf39b3d184e9c7266625e4192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355803, "uuid": "6f1845da-61e0-4447-8691-3535b375edea", "comment": "Malware payload", "value": "9b71f867b94e8a44139424b2d3a9ad47436d6062cfbd7dd4f020eb11c1fcf30a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355803, "uuid": "11905618-b15e-4a0f-8591-808a97ad2703", "comment": "Malware payload", "value": "4abc8d777f1e06eb374f14547a7475d1b24d472f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355803, "uuid": "3b14bec8-86bd-44fc-ac1f-78820116315a", "comment": "Malware payload", "value": "2e049a20341777a747c01c40d7f3daeb2acccce0583d482c76b5fe7c52e2fbca124232efd8ea009ca95baae9afad9c9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355803, "uuid": "b86f7696-d08d-4dfa-8a7a-5a8409d197a7", "value": "T1B6062320376A61B0CCBCF2F695A160064E769DAB74238C3D21E6B79597F23856C3DF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355803, "uuid": "86f4cc91-b42e-4344-a0cb-d1e41a394648", "value": "49152:TjZKyQTlexyf2t3JdmwduhiwMis0I5bTVqBRIRjeQJT00hQmCTjsWO7yEJKlacmd:ZK5E4ut50rRI+BRZQ500YTjsWKcr+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355803, "uuid": "9d058014-0e07-48dd-a17b-215c8fb3af87", "value": 3785216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355803, "uuid": "438b07ce-9fbd-471b-880f-62411f9cd668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355803, "uuid": "e63956ae-0748-4636-9571-c88f479bba53", "value": "SecuriteInfo.com.Trojan.Heur.031132C3.30279.23165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd70c15-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639386752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386752, "uuid": "e44b4fe7-83ca-43a8-bb8a-1389c4f3143d", "comment": "Malware payload", "value": "28677b9655cf49ed3bfbcacf24905ced", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386752, "uuid": "0ce084c3-e719-4cff-8155-acced9e4f586", "comment": "Malware payload", "value": "9c1190de31efac42912b2914df3099a124469b94587377c957e80778aa618465", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386752, "uuid": "d0c34aec-5f92-48d8-8419-9f7191a5a548", "comment": "Malware payload", "value": "aa5685c1278d7dfd2bc0ed2c06e1429bed94328b", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386752, "uuid": "53dd9941-554e-4b6e-ae15-aa2d5e518010", "comment": "Malware payload", "value": "cfe7d79b507bf2d2045cdcae5b0dff8a1838003798831f85ae49cd804a4490b425cadb3f76773553b8e67d335445baa4", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386752, "uuid": "b4c77017-2895-4807-92a5-919ab7ef7b5a", "value": "T19CC49E57F6E7BA61E6AFC2BAC6B1C92D66B3349202B0C3CE774055892913391483D70F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386752, "uuid": "15adc19c-0685-46b6-b0d0-5cc1b8423cd8", "value": "de92ddb295132323885964c44ba1a4fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386752, "uuid": "c6e2f114-6009-4a71-b8eb-090b7bea5e0f", "value": "12288:9HzhL3/Z3+AZXkOCH8bzbBSreg48kHNlKVWf9:9Hzhz/ZOABkjcX1Q48ktsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386752, "uuid": "bdb30b9d-3398-47d1-884c-6e68e7564b68", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386752, "uuid": "5beea2ad-9267-4dcb-9586-74f4f103c3bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386752, "uuid": "1c6b08f4-fc2d-4dbe-b701-f0a9cea1afdd", "value": "DEQeobxl641.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235f1907-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407941, "uuid": "fdbd5b5a-baca-4237-8daf-103726c98ca6", "comment": "Malware payload (SnakeKeylogger)", "value": "d118878cea197a301b86653839cb9839", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407941, "uuid": "b39757a6-4126-4d55-b91c-c3e241234e02", "comment": "Malware payload (SnakeKeylogger)", "value": "9c4882250a3e4dc76a7690d61bb007e4356f9953f2b4ecedeb5e70c92409d6a9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407941, "uuid": "58a290b7-8ca1-482e-8f3c-dc280cd494e0", "comment": "Malware payload (SnakeKeylogger)", "value": "0e61cfedaac2dbb2186b78078d75151ad817256f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407941, "uuid": "1300e3f0-63fc-4846-a86b-9dbe195ad428", "comment": "Malware payload (SnakeKeylogger)", "value": "e9618b13621d2e6204cdcbb29aa0c2ea2a4559f0df0593e22007ae107121248b8f4f4f11c3a750e62b762390fc389feb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407941, "uuid": "3c6dca23-40fb-43cb-97e1-25b2f1d2adc7", "value": "T133A270BCD4570AE88F42ABB8272B5F40058D762EF79A94723638A73567D1D3E412393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407941, "uuid": "6cb2fda5-70c3-45f2-b451-0a12121bc6fd", "value": "384:Xaa7X6EDyGyYRlqIqWjAB/PVpDqAfqbAjamRhGkmZqagW7GeGHE1e:XayND/lqIqXK68AThGNDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407941, "uuid": "ca8e0fe5-eb73-469f-b648-335b0d1798e8", "value": 21418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407941, "uuid": "398b309e-b590-48d4-81c0-925a20b67ac7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407941, "uuid": "50c96a55-c024-4fb6-acbb-9a28f670498a", "value": "SWIFT-AWD-0801486XXB21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d1658d-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639425925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425925, "uuid": "cb116e15-ba00-4058-884b-5e5b7118b204", "comment": "Malware payload", "value": "69c6fd7ac76bdf023e08614c166bea1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425925, "uuid": "d3bd4d44-ab56-4c60-879b-2e862ea1ccac", "comment": "Malware payload", "value": "9c8deb77732ac5d561f5fdf9a6b34a079b7a3922e4c9e1306de5153dcea3a51f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425925, "uuid": "3fbfc439-0770-4386-ae13-8bc85fd74436", "comment": "Malware payload", "value": "092956e79a493359fcb86fe31f7e0b74466f61b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425925, "uuid": "fb2940b5-67e7-4c6f-8165-7475eeccc275", "comment": "Malware payload", "value": "618be73394513ac2b7531fb863a658e5d38f2c9ed57511953ec8e66f74736f3a2f136be081741ca8e1037ec0f4f82400", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425925, "uuid": "1d00ec9f-29cc-4118-b187-4b46a16261eb", "value": "T1515523107BE05719E5E847FD48322AE06BB52C09B2A2F7549CE9A4C77E78BD009D27C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425925, "uuid": "02bf8fb3-9005-411c-a9af-f0970bf0c5b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425925, "uuid": "1f474630-d149-456b-975a-16226eebada7", "value": "24576:ULYD3t+6YDWZyOq16pEsl0utqiZoyIBQiKhAD+S5L2iG6KH:KOA6QWqrdpB0RS5JG6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425925, "uuid": "7f5414e2-77a3-4689-9263-4bd71a534dc5", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425925, "uuid": "86c4f893-cc89-4274-8e0a-f19ff3759246", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425925, "uuid": "e730fc9a-f1ac-4fba-b793-494fff8d690f", "value": "69c6fd7ac76bdf023e08614c166bea1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b99ed3-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639415276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415276, "uuid": "622684bb-26f5-4aac-9011-71fb6f777e10", "comment": "Malware payload", "value": "d62087b11d6d46dd833063b4680202b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415276, "uuid": "c883ef60-fa54-420a-8941-5c6ebfaa7c7e", "comment": "Malware payload", "value": "9cabbbcb8c69ca1ad0b619b37d57d665af54ef0428532266a9fb2f9bffd285f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415276, "uuid": "8a1f1ebb-ab28-49dc-93eb-b84698a40bc6", "comment": "Malware payload", "value": "1472c6669ac659475e71d9f84bab19e70f25f362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415276, "uuid": "e7b8819d-dec3-43a0-ab95-5ed8fff53135", "comment": "Malware payload", "value": "445fb5ca28cb359f786ce87e8e1f42934a3441c976b8fed3e8c64383be3a7bae6df8ebe626855c8768568d0981f54038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415276, "uuid": "53df70e9-98bc-458e-8125-5e21a34ca965", "value": "T1C6635C153781D032C0A27471972E9BB29EBE68362269D6CBE7565F711F302D0BE3960E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415276, "uuid": "e1304139-37a2-49fa-9dc1-29e871c9b8bf", "value": "1536:iRZDxZb6ALZHqnBi5ea6tVfAbIyrqfb0EN:chxpvRUiAAvrQ0EN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415276, "uuid": "cfb8dfd1-73b4-44df-afa7-fde21e32cd06", "value": 70185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415276, "uuid": "f4276693-5a53-445c-98af-8526939ae12f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415276, "uuid": "8216e4f9-ff95-48aa-a0c9-dd7f2b22fa7a", "value": "d62087b11d6d46dd833063b4680202b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85392359-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639408535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408535, "uuid": "01f396a9-7cc4-4cf8-a8f7-65041c22d4fa", "comment": "Malware payload (AsyncRAT)", "value": "0de6026f30ac206e38afb5b016469b08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408535, "uuid": "052f4a08-4a69-46c6-b984-64ddefb77fbc", "comment": "Malware payload (AsyncRAT)", "value": "9cc01f1e20f42b91a7821c4b96679ab05834c9cbbe42e9b127f7ce0cb631e176", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408535, "uuid": "a9013178-3e0a-4e9c-895f-1e563977a4be", "comment": "Malware payload (AsyncRAT)", "value": "658b2017e6f13f3e7377d71a0669b720c245ef86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408535, "uuid": "f896440f-1938-4e1d-8bf5-3ac9255c73a4", "comment": "Malware payload (AsyncRAT)", "value": "7fc74f128955118045f3a985047db7417034dfeeec2141b5254d4dde2f152420e903f640c42aece04fc24b730afca015", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408535, "uuid": "63504caa-0108-43a8-b9ca-976b2904f199", "value": "T169232C003BE9C22BF1BE4F78A9F26145457AF2636603D5491CC452DB5B13FC68A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408535, "uuid": "3d807ba8-5132-48d0-8abc-e4812680750a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408535, "uuid": "28d4fb09-7b5f-41d0-8383-0accf58d9b5c", "value": "768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3iDoMvxqjwrXh/wJ3BDZSx:vuwCfTgp/2OKYDy3bCXSU8x5rx/8xdSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408535, "uuid": "b66cb3d2-97aa-41b1-9385-e852bfbf5482", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408535, "uuid": "ec92db12-d26f-40b5-ad63-6717ac9ad37c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408535, "uuid": "0769cd57-f217-4ef4-9fa3-71e1e76aac81", "value": "0de6026f30ac206e38afb5b016469b08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7f03a7-5bf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386401, "uuid": "7c37d3be-0366-4b6e-8e3a-fb5c0a102b9c", "comment": "Malware payload (Mirai)", "value": "3d56960c5559a4ac8b550b9a5024664a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386401, "uuid": "da7d4738-6196-418f-acc5-0a6808f9dec9", "comment": "Malware payload (Mirai)", "value": "9cda8d1c825220b71e0147bc16833d13a5c2fe98ac787dfd63e30e7f3bb12645", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386401, "uuid": "3f88d617-7faf-4833-b4cd-8abd862b38f7", "comment": "Malware payload (Mirai)", "value": "a172915bc9729ec23d4d4cec761dc6d90d15456e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386401, "uuid": "d3223f74-1075-4492-81cb-2dea85c8c3e5", "comment": "Malware payload (Mirai)", "value": "d0fb153d80cf089d3425bf49443a7b14940f9d947007db7cdb204b3cea62fe9a638b6931aa6c261007ba7e646397dcaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386401, "uuid": "e7acf21d-bed0-47d9-a09c-352b0ff23707", "value": "T173C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386401, "uuid": "7baee77d-7c98-4dcf-aa62-53eca5ed645f", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpO+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EQ+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386401, "uuid": "93b383b6-805c-4a48-98c6-8ea20c88807a", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386401, "uuid": "66a85120-097e-419f-b50b-f5f3f3e3349e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386401, "uuid": "da2a8b06-05c3-4bed-b69f-6e5daf4b660e", "value": "3d56960c5559a4ac8b550b9a5024664a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fa0160-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639386680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386680, "uuid": "d3b559ad-503d-43d6-8249-729dee95ea7b", "comment": "Malware payload", "value": "ff0886b5da7f961e2f041061eeb1ed92", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386680, "uuid": "63bca7a9-b153-4c95-9f7e-577c313ea791", "comment": "Malware payload", "value": "9cf256892fd468ebb1c711a46ccba76a2e24713b80a256c04c6a80cb0de76a6c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386680, "uuid": "6cee4fe7-8ce6-47fa-915c-d2489d3aa998", "comment": "Malware payload", "value": "6179c9a5982483e3a90280560be1f917a849ef46", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386680, "uuid": "554ab57d-4f9a-42b2-8b94-3704578f7b7e", "comment": "Malware payload", "value": "8f018c8ba4c614b139cc74f3af2f38fb3088340ef80a6eeead7631702b249144b60560b535d6278e4a78c6d4d7891f35", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386680, "uuid": "e4b15b85-5c55-4016-ba91-d9d72ccb673d", "value": "T1B884231A75F073F16C638A0DE330A566E6409642AD12A51377D23E3632F9F50A862FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386680, "uuid": "da917423-d634-44aa-8b78-8411f67e450c", "value": "6144:zBgVvxaA6Q+bPDOHBTwi5eDGjOQTs0XMbowwgyd2KinlxROK08w1zYAIXMLoOvwA:Wanzj6HB51jzcyd2BjIK058UwGlsZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386680, "uuid": "8a363a2a-ef6a-4bc5-8bfc-d3eae0cc0ab7", "value": 404697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386680, "uuid": "ff3fefd3-dc4c-4837-ba55-a53b391faf91", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386680, "uuid": "14652133-0439-42bd-95f7-ca5dc8af4349", "value": "STATEMENT OF ACCOUNT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd22dc3a-5c13-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400065, "uuid": "2c11d441-6989-45bf-9748-b2ba5dc851da", "comment": "Malware payload (Mirai)", "value": "3ce7259c8ba9c9c6165a58e364ebd677", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400065, "uuid": "3e442761-ecc2-4964-af9f-0ed581b322e9", "comment": "Malware payload (Mirai)", "value": "9e806e00fb919eedf561eb8e67e466e0dad33c9335b63852703d1d1d9b1e1907", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400065, "uuid": "0f6dedff-69b6-4908-9404-795952507a35", "comment": "Malware payload (Mirai)", "value": "36c3ff165cd91da372b2965ac841c60f4ac71ac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400065, "uuid": "4822127e-5a33-4a0f-9286-c91ce2413bfe", "comment": "Malware payload (Mirai)", "value": "961e392d81b5636ff465fc034092abc59a01f8c1abb60d2890dc5a153f9f8345efd3a8d0f1635e70ef5ade07d01beffe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400065, "uuid": "e993f968-9492-40ed-8f1c-7995ed866f86", "value": "T130E2F120568264F2D1A40E7971B54D03B7AFA2F8E2FD50566B084B6CEEC7848F47AED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400065, "uuid": "e1f7219e-783e-4bdb-af75-37636cc7a5be", "value": "768:zg5pnn0GVuyYFU7QOcLW5nBpePzlPe4K6piSsu2fvEKpwClgON3Uoc:VGSFCQD/zlPXK6MfMijlvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400065, "uuid": "3a018b03-440c-4ede-a4e2-3357e7568e18", "value": 33532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400065, "uuid": "f4b82476-035b-4873-a5fe-eba52674226f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400065, "uuid": "00a960ae-b1ed-4460-85ea-87144d54bfb8", "value": "3ce7259c8ba9c9c6165a58e364ebd677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726af460-5bdd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639376720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639376720, "uuid": "8afad54e-9331-44cc-998d-179733ef5c48", "comment": "Malware payload (Formbook)", "value": "4dfab4ab0edef660557d063a7b787f32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639376720, "uuid": "a5e54cbe-0522-434c-bd2e-fb5444a3b035", "comment": "Malware payload (Formbook)", "value": "9ea19e6389c42486050f45551c33bf9d8f0b2417fc53975d97aebe477d368274", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639376720, "uuid": "9a4ddfcd-3e18-44cd-b2c2-72a0b5f62db5", "comment": "Malware payload (Formbook)", "value": "c55904a356c64da5812c07cdbc886fb64d80b2bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639376720, "uuid": "74ede701-5dd3-45b5-9695-d785e465f3e8", "comment": "Malware payload (Formbook)", "value": "567da555dab1a3392c5c6a8e3cf44476209acde639bc8d63b8ce7498c021f27bf108fa19c253beb704f2d814e1d2d40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639376720, "uuid": "c545cc0b-0516-416d-af1a-765401c03a19", "value": "T10955121933988E55E26F0779A171C130C7347C14B82AD31E6AD97DEF7E23B809A09B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639376720, "uuid": "b5735c97-6b87-40fd-b567-e988a2eb1b79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639376720, "uuid": "e06dcb04-69c9-450c-a425-5e592038f8fa", "value": "24576:c7XzodEMQ/3Q7+GOP0p2jQSM8eqIpQ916Ry/UE8izXOHtEga:cbzec3QCGd4jQB8LvocUdibOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639376720, "uuid": "110f75c4-34d0-4d4b-b0fa-3064b9eac065", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639376720, "uuid": "c93c1106-b8da-4346-a749-6454f258cc10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639376720, "uuid": "6abde242-d7d0-4c7a-9f4f-180e12e8a38c", "value": "YBCNP6X9PSJDXqv.ex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5926c0ae-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639415333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415333, "uuid": "6f77f3ee-690d-4eae-94b8-3401f6d519f5", "comment": "Malware payload (ArkeiStealer)", "value": "84ab9432b7760a2675098f27fa8a309f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415333, "uuid": "67c9d4c5-eaf8-4f49-a0e9-f76a1014566c", "comment": "Malware payload (ArkeiStealer)", "value": "9f02bd2c75cbc7ead82a60f88f3e1f04ce9cc9d9ce715ec880f520b005fbfe25", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415333, "uuid": "645365d4-f03b-4072-909a-efb4535032ed", "comment": "Malware payload (ArkeiStealer)", "value": "628517f1e3703b8d1266cd5f5fe752e6887d2c8e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415333, "uuid": "59f13b56-028c-48ca-93e0-1530b28136f2", "comment": "Malware payload (ArkeiStealer)", "value": "0b2d1e63e34ce8c9d2449dd1ed7863ff50db1bfacff3142f92165fcff0a730e9a49eb5343ded60f8c5f140a1c4ef3ed4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415333, "uuid": "68752164-c9b8-4e3e-8c8d-8d4639cc3a8b", "value": "T1D024BEE575E1D472C5A77A3094A0DBE45D7BB863FA20814F33783BAE2F322C15A21356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415333, "uuid": "fab38947-b177-454f-bbb7-a42c6bc6e8d4", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415333, "uuid": "4154b120-6474-4cde-8b5a-a2bf75582864", "value": "3072:SZAxhVcXcKkYN8Q1TxJCFwlMqdQbE6+75GKWPhsZVggjcGkNIVqIw4uNKf732:SwcspOoFwlMqGbEozyb7ITsq/6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415333, "uuid": "11adccd2-84b7-402d-9030-c1e4d613a5ea", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415333, "uuid": "07612bad-cc11-4da5-b023-5930e1dbfa3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415333, "uuid": "f8da7ad0-7285-466e-a37e-2bd126bc1242", "value": "84ab9432b7760a2675098f27fa8a309f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ce5df3-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639415268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415268, "uuid": "9f2928d2-4052-434b-93da-954576cd8fe0", "comment": "Malware payload (AveMariaRAT)", "value": "f3b27d4480ba10b41c77860ab5a1064c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415268, "uuid": "f18db862-948a-4be9-b9a7-91f37d4575e2", "comment": "Malware payload (AveMariaRAT)", "value": "9f0b27da5535bce46e787bbf4cf338bc80d706f4d6c410fe68fb41adee88794c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415268, "uuid": "86511c7c-3ee1-4298-ad83-7f2a6b7c7e82", "comment": "Malware payload (AveMariaRAT)", "value": "bfe6dbb6b78a1712dd5f18d5d16566096b8dadd3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415268, "uuid": "92b7b1ea-03dd-48a6-b226-1856e2cad36a", "comment": "Malware payload (AveMariaRAT)", "value": "1d4b5fd983c6c0a54e9ba7131aa75ddda227808323911d9e46dac42bae21bae432254a21742dcab2c4b5d16e50a537b4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415268, "uuid": "b0d55d32-6271-4082-b9b9-88d730c5eaf8", "value": "T1AF451219339899E8E16F0BF9A470C2348335AE15A026C31E6ED53CDF7A73B909A057D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415268, "uuid": "eef89aaa-d846-4e6b-aeed-a62555b6ca64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415268, "uuid": "688d4f5a-46e9-4ed8-b4db-c09867094ac2", "value": "24576:5sice65URvbn3vtbjPwb9sCirmXOHtEgarsb/hyDVeb:D65U1bn3VbztCpOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415268, "uuid": "515bfcfc-36ce-4585-b9bc-517c24f810d8", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415268, "uuid": "b03d24ab-b51c-423b-8b1c-3c03c322c9a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415268, "uuid": "20895dbb-e8ab-4970-b006-53265a0ee60c", "value": "f3b27d4480ba10b41c77860ab5a1064c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425b8cbb-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426032, "uuid": "82320088-6ff2-470a-8ee5-af66f2812f01", "comment": "Malware payload (RedLineStealer)", "value": "a3ab85a074b12ec2a5832b5f71eb1573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426032, "uuid": "5f65f439-93e8-4f97-96be-9cbddaa85f15", "comment": "Malware payload (RedLineStealer)", "value": "9fd0adee9534f863f12b6a5b0c294e6aa980d2d62230b5dc7fd9848749948bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426032, "uuid": "29a2ffec-7d3c-4a3d-b1e0-548da320f14c", "comment": "Malware payload (RedLineStealer)", "value": "b0edd47b6045facc2e284d31e4e42f39a5e81d1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426032, "uuid": "b36e5a36-17a0-48a4-a1a8-b3707f89d103", "comment": "Malware payload (RedLineStealer)", "value": "af6e7c3451bd28d6f4c3787c15ac13c0178e2faf4659bea6ab618f9d09069e2ae7cc5b1c39ba89030c4df805b7311a85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426032, "uuid": "30e51bdb-a8f9-41c1-aa08-fd7a4092a3b1", "value": "T14E64E0C236A0D871F5936D329871AAA8CE3FB861D920815B77783B9E6F736C04735712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426032, "uuid": "b53dfea3-3e86-4d92-92e4-c725f926744a", "value": "da86082cd27b859e55ff9843cf87f36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426032, "uuid": "fc16497d-1ba7-4360-958d-620c3605bc14", "value": "6144:uhJZeoFQRw8RCQDlDoWi3zqLz67b7ITsqda:uDZeoCRpDFC0zE76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426032, "uuid": "be0d06ab-2f75-4b08-bfbf-74a0848668c8", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426032, "uuid": "a7dc6b8f-ad0a-405e-bfba-943ed1466708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426032, "uuid": "4955145a-cc3c-4b97-9d84-81fbf4006344", "value": "a3ab85a074b12ec2a5832b5f71eb1573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3baf3f7d-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426021, "uuid": "9b181725-d00e-4114-a3f3-5a6b0421dbec", "comment": "Malware payload (RedLineStealer)", "value": "7f43a3e654c48956c9c56b19498e209f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426021, "uuid": "eb04966b-885a-4080-b669-16e3240347b3", "comment": "Malware payload (RedLineStealer)", "value": "9fd6bac2985213cf4942aa9e022353b890ad06951ba342fcb279531ebfe376d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426021, "uuid": "1f4bc06f-c7a6-46f0-abd3-55c7e6005ec9", "comment": "Malware payload (RedLineStealer)", "value": "5ae2878130378b00c3cd30e639af636ff4217fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426021, "uuid": "2f507df1-c2e8-4f53-9b6f-4b23b516fa62", "comment": "Malware payload (RedLineStealer)", "value": "43e4604bf1fcb2ebcb4a9175e56587b911239c717ad10939671143d8e71f17a0740b02ebbb55f8361ced4e94b8b631a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426021, "uuid": "4a06e8f4-2855-4a97-ba0b-aa5fe3740502", "value": "T1C364D0C275A0DC31C7A229375464CAA98EBFBB1DD520814B77743BEF6F726C05A22712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426021, "uuid": "94ef4566-a13b-493a-b2e6-5d98ef92510d", "value": "da86082cd27b859e55ff9843cf87f36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426021, "uuid": "9747348b-d115-4854-b142-b72d22743a93", "value": "6144:dWJqiXf9z0o0hvRyF+pbOy9cBSwLYZZ6hcexitzrJA3ib7ITsqB+X:doqiPa9vRyonwLH+e81WS74+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426021, "uuid": "4ab62589-a2d3-4a77-850c-c3b1cff36355", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426021, "uuid": "9f2a9980-3fbf-4dd9-a527-3031f3b1452e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426021, "uuid": "a7752511-0a1c-4896-a6b4-e7eea3ba0496", "value": "7f43a3e654c48956c9c56b19498e209f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c754d468-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355817, "uuid": "8fe1fcb5-0bd3-4625-a82c-9a411c52ffd6", "comment": "Malware payload (RedLineStealer)", "value": "10baf9fbfce1981d12bc98444eea1102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355817, "uuid": "f4a526b9-1167-42ca-aeae-e3ad3f8cd85b", "comment": "Malware payload (RedLineStealer)", "value": "9fd8b2ebaa20932023939c2a2b6532fcfe37eab6a5cad5ac6c473c511a1ecc6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355817, "uuid": "1566473a-0b54-468a-9f28-748045946f51", "comment": "Malware payload (RedLineStealer)", "value": "c116c7204ca692564ea66411e5578c2b51144cfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355817, "uuid": "bc775459-dd77-4be2-bdfe-a2f2a778338c", "comment": "Malware payload (RedLineStealer)", "value": "704e88e09e0fc67b3e41065f27c496d63c98642bd329e2194665be09e3d3b42a70315c6b10e65c677a9bc021797b230d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355817, "uuid": "b1aa41bd-f9c5-4f2d-8eb0-64eca155e75e", "value": "T160B32B5037C8DA14D6FF4F7068B0512883F1F5576412EB4F6EC564EE2E62B80AA53AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355817, "uuid": "eb436175-fb37-4bd8-84b3-497ec2fc2c08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355817, "uuid": "4f427067-1fa5-422b-9bae-503fae51454b", "value": "3072:4WZ2nbK7CTHmLe9bDmbaHHHHeqo81X8oI:BgGaDmbaHHHHeqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355817, "uuid": "980d22b2-6987-4853-bf73-993ea84b6406", "value": 107752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355817, "uuid": "0beebeb6-0a60-4192-bc53-1e89130eab55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355817, "uuid": "c8d770cc-bb57-4379-9af1-bb857d3c1eeb", "value": "SecuriteInfo.com.Trojan.Siggen16.711.17756.21398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b0fdae-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386784, "uuid": "01c4383a-5cde-4e7a-bb25-e35a35c0868c", "comment": "Malware payload (Mirai)", "value": "933e273b6b9581350532df19278892e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386784, "uuid": "e0e74ccd-6657-47ed-bdf9-3167c6874870", "comment": "Malware payload (Mirai)", "value": "a001d8052479c4e452388deec732068b6062dd233828da23437a199c90505052", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386784, "uuid": "41d167ee-5313-472c-a414-dec89aa70d7a", "comment": "Malware payload (Mirai)", "value": "7c04dfb637554e652e85b6c256b29af3c49eb78e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386784, "uuid": "a917b830-77b2-4eb9-a18b-2c89111244e1", "comment": "Malware payload (Mirai)", "value": "348d77902566e9516fb69eddb00a17740f8dfb456621d098e9c9016a4d3b268f46c9de9ba9c63d2e2ed641c05cbd0e18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386784, "uuid": "ef0c7b3c-4102-4f7b-ab9f-aacace612583", "value": "T133C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386784, "uuid": "1f6f5e69-4966-426b-96d5-ed32d70912fe", "value": "3072:ekYPUfsgnsb0J2ag/VffkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0fkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386784, "uuid": "2dd6f87c-4c18-42a9-a461-eaa1db67f2f9", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386784, "uuid": "2df8b11a-2591-46ed-8b0b-8f6048db3ba4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386784, "uuid": "324f6c4f-1042-4e8a-827e-cf3e9a5e98a5", "value": "933e273b6b9581350532df19278892e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6e0544-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639425943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425943, "uuid": "b9a048e2-f0f0-4d52-96ee-e5a47defeed4", "comment": "Malware payload (njrat)", "value": "0467bac7001f9e7f4822e0e2d5d62538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425943, "uuid": "6207824b-ddc2-4eea-9960-631c3a5be4c0", "comment": "Malware payload (njrat)", "value": "a0711325b0dc664509858eaef58849afd30348593629f980d0e3b346257aadaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425943, "uuid": "dda2b375-6d1b-4c2a-b433-b61744def1d9", "comment": "Malware payload (njrat)", "value": "2ebca6bf927f9f3f2e5c073e08b8da5af77662b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425943, "uuid": "f11215fa-74ac-4257-85c9-0a3b1cdfc4e0", "comment": "Malware payload (njrat)", "value": "89fcf0eeee33da8eda09fbfc2fef835a4e083d526d3a24f79904c89836a1d4fa2f513b735580131715ab110e01e008ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425943, "uuid": "0e48a7b5-2682-4fd5-b5e3-eb9f6f5387d5", "value": "T11054CF367BACA902C2CD5779F0D356904AF1D904B453F3AF241D76EA6B073CA4E2225B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425943, "uuid": "ceb6b9a6-1592-4585-8ea9-e6e3ee9d3a0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425943, "uuid": "3d927fd5-6aac-42c8-9f5b-f460403a607a", "value": "6144:flIqVFZyINtza//qgyX8Z6SEKk17z0A5gT1+tzwCY7goNBGkseEH4ONdlvESZfXz:GwZyoanqghSZfXkMKPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425943, "uuid": "01a3b8f6-aab5-4ca4-b8eb-4cc00e56513b", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425943, "uuid": "08a990f1-6f98-4678-b992-c9fca66941be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425943, "uuid": "0494624a-9fb9-4dfc-97d4-6e5153bfaf20", "value": "0467bac7001f9e7f4822e0e2d5d62538.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0debd7c1-5c31-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639412629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412629, "uuid": "5dfed0e0-bec9-46c2-9468-ee8e6cfa9385", "comment": "Malware payload (Formbook)", "value": "e8474eb64789eee152d472b770d302d7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412629, "uuid": "0ba6ca38-bf2a-4f06-a158-fa1a32dc9f3e", "comment": "Malware payload (Formbook)", "value": "a0d6944b705fc3eda19d5a990ab7ec34d64b2d275366603c434b77fbd0526ba0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412629, "uuid": "fb809797-9aea-42f4-8019-d4e6f050d295", "comment": "Malware payload (Formbook)", "value": "c586a8c7d952e9ba7bec7576620b583fe0a00549", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412629, "uuid": "e99e4b1e-3c96-4dac-a62a-24d81b5f3dfe", "comment": "Malware payload (Formbook)", "value": "f2b1abbba9574af4192bedbc11b0c1475dc01cc6ca8b77230ede8f8dc047c4a5ac9149b9fc6491520194ee5804721b12", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412629, "uuid": "f644ac6a-d583-43d8-ae6e-149e70f0e348", "value": "T1BBA31255366B757FE28F8D38440A770FEB92054598067CA60EADB58F785C8E30303EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412629, "uuid": "2ad1db32-fa3a-4203-9f63-85c6e536e6b2", "value": "3072:ZrOKZu86S3Roy9uFwZlsaFPOHYonHBxqPZYBQbc:ZqYuS/IwZltFPgYonHBxqPZuQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639412629, "uuid": "73daddb7-c528-4501-8671-c27d50e2f197", "value": 105299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639412629, "uuid": "ec73208d-f226-4b1a-8cee-6d7dd085dcdd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412629, "uuid": "8e53411a-3f6d-430b-968e-155afd9abaaf", "value": "RFQ-PO 31336.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bc2582-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426058, "uuid": "fe449008-ef13-485e-9351-7403a89ff96e", "comment": "Malware payload (RedLineStealer)", "value": "f4c39bbd675fdf74e7b6ac686827b632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426058, "uuid": "0ef42fb2-461c-49a3-ba8c-015529d748c6", "comment": "Malware payload (RedLineStealer)", "value": "a0f0d628bf2af697ef7c60cc9f6942e8553fdf3fed9e3c0a04dec4ae5d8e77ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426058, "uuid": "8050b06a-06a9-4918-81b3-adbdc7a945a1", "comment": "Malware payload (RedLineStealer)", "value": "4856f3ed0226a5d71775cf412ce4bf6ee4fdc12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426058, "uuid": "61241439-f3a6-4ea5-bf2c-d099f516b4e1", "comment": "Malware payload (RedLineStealer)", "value": "2df22bd9c18dcab05a0e1bb049b97859b31417fb7bf6719d4a90161eb02363d48ad560aa827ac78a97c237905295af01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426058, "uuid": "9ec4f4e8-b720-44e0-b395-1b30bc33a48d", "value": "T15E64D0C276A1E431C6A22D3154208BD44E7BB951EA70916F777C2BAE6FF73D04A20F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426058, "uuid": "742690db-3f93-4563-8f97-a9e32129ef15", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426058, "uuid": "1667f477-b90d-4743-a707-a96a24e6831e", "value": "6144:t6I9/iXOMTi7mHcMPtZM+MVWUTYOb7ITsq3HZOJ:cI9aDW8rtZOVWUP7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426058, "uuid": "36a869be-eed7-4261-b701-e454260277d3", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426058, "uuid": "07f23b25-3f20-4444-b75b-5a85f8e4e007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426058, "uuid": "3d8ef704-8c8b-4b01-baf8-31a19fa0e311", "value": "f4c39bbd675fdf74e7b6ac686827b632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc980075-5c38-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639415983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415983, "uuid": "a6c28320-0e64-4a6c-8494-85e389fdf738", "comment": "Malware payload", "value": "5f7cdce5ac9dffb2263a20e49918f3ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415983, "uuid": "893d4762-c9a7-49b8-bbfe-e43a4ed6727c", "comment": "Malware payload", "value": "a1f4230ee4d6e08e363c9585e7afa1667da517637ba8fd9c972e33b2ce9f118b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415983, "uuid": "9b944882-2d2b-4110-a7d0-c0a05a2de820", "comment": "Malware payload", "value": "f77a5669075efa3f838a38f71697698549920e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415983, "uuid": "75f27495-fe96-47c7-978c-33cb038f974b", "comment": "Malware payload", "value": "bb2a88c53c171d360423cb22117ca12ed4cd9462becdb9657d08b2f95bc269c12f717ae07cc9e4168d7874f7b4c7b59b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415983, "uuid": "cdac5ce5-bf92-4518-a99a-311169d697d3", "value": "T1B4137B3228D0C432C1626CB1A424A7F29F7D5D22216AA5CF5B552EB15F707E0E73D2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415983, "uuid": "353e1c56-668a-47a0-810d-b8e0a4d6942c", "value": "768:fmsmQfwt2bBY2bqv1rvA2S0ctopGsi7ISYbdiWAsIurLf:Zpxm5YwpGsi7IS1WZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415983, "uuid": "8ee98e02-c099-4333-b764-ffa77c8acd94", "value": 44121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415983, "uuid": "a6c8fd4b-157b-44e6-882d-c0a1855967f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415983, "uuid": "70ab4715-8bca-45f6-8bb8-39ecb277481f", "value": "5f7cdce5ac9dffb2263a20e49918f3ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dde1b15-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408120, "uuid": "2dbb66fa-f279-4394-b8d2-a10055d72662", "comment": "Malware payload (Formbook)", "value": "3ac74ddc5fa4c646f8e9ec5a2f22242e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408120, "uuid": "d82be822-042f-4da5-a992-6cf869227c76", "comment": "Malware payload (Formbook)", "value": "a239cb6d61bd98b5f6aa26b365db3e97b20f0736ce8d0eff2265fc8e0557d7f6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408120, "uuid": "7a06d881-e73b-48e1-a963-8872eafd75a2", "comment": "Malware payload (Formbook)", "value": "059debdb7afc25ac5a982866837bb31964dc1cac", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408120, "uuid": "cce2d771-f7d6-46b4-a678-e03c0f50a0f2", "comment": "Malware payload (Formbook)", "value": "52de5b7a5d7b76a56caf388e3e45292988aa6fc08e00b80fbd03635271a430706fd9b19223da9d9c77667a1f23ffff19", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408120, "uuid": "d389f6da-39ee-4618-8efa-76ba6cf7c083", "value": "T1F77282ACC06706A84F8A6BB9272BEE4511CC7A7DF745A533723C573517E1E7A800683D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408120, "uuid": "21695119-0207-4914-815a-46ba21a0f0a8", "value": "192:coVddmJTFCprjaMRfo/Ji4XS/5RTHMMna1dWMo3bX9tELeThJFYS:coVddFVfKXuUmaLWtXkLeThJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408120, "uuid": "55d771cf-ee54-45d4-a48c-b36cee020c03", "value": 17070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408120, "uuid": "0bd05588-f7a6-4de0-8324-b9753ef60636", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408120, "uuid": "084c7eb2-6a14-46fd-ba4c-5f52dcfb298c", "value": "4356764.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6812928-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386793, "uuid": "3248dc95-534a-4276-ac43-e6049422b7ab", "comment": "Malware payload (Mirai)", "value": "4ddddee40abe649414be2f6dd9bc07b8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386793, "uuid": "a6cdaf32-b3a1-4b26-91d3-be968d2aeff0", "comment": "Malware payload (Mirai)", "value": "a250c003003f63e283096b9b835ac3ccf00de0bab38f33a9a3f0f489ffde450d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386793, "uuid": "f8cefba0-9d82-4783-b101-5566fae641b1", "comment": "Malware payload (Mirai)", "value": "1e049fc97ee309c1f55558dbba03587a6a9a705c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386793, "uuid": "d338eedc-7921-4c45-bec8-c1a0d9b372ff", "comment": "Malware payload (Mirai)", "value": "85c1bc6d76777a28cf567de9e58fa2ef11bb9938f9d6b535a8a4283c1b3cb7166fa257f8c07418b70095038134ecc8a1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386793, "uuid": "73f7c3b5-85d4-49e7-aee0-8a779f5c922d", "value": "T1ED935D27B552C67BC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386793, "uuid": "513f90a3-a645-4bad-8b8e-4843ea51a62e", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3uyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKeifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386793, "uuid": "80794ad0-d5eb-4b76-8eab-7e7699013f55", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386793, "uuid": "ea8e9070-f54e-4f40-afde-32c4d3f0a504", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386793, "uuid": "caceb992-2070-4b69-85a8-9fbfed11db47", "value": "4ddddee40abe649414be2f6dd9bc07b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1274b906-5bce-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639370117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639370117, "uuid": "a4a0511d-1ae7-4f9a-bf76-33066e6bb5b1", "comment": "Malware payload (RedLineStealer)", "value": "a2ac23fdb07e08a0a24e076a6e441b16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639370117, "uuid": "547f5e60-1d75-45ab-a2c4-858ec4e4e038", "comment": "Malware payload (RedLineStealer)", "value": "a2828152f3c0680f7ebd899f380245a240c8677d00f0c9b89a611499d55b3c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639370117, "uuid": "8f5df162-e0ee-4542-bbff-09446e06967c", "comment": "Malware payload (RedLineStealer)", "value": "262b821dbd748392bf06aba343fad7d6463f98b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639370117, "uuid": "044079cf-e79d-49e9-a19b-5acfb6d951eb", "comment": "Malware payload (RedLineStealer)", "value": "1b6c6801abd6db6831a2b4d7cec87665ed8a49cc84d5f174fd7457e275e885f9e7ebecaca9ac226c71fe3dd494b0cdf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639370117, "uuid": "eb178809-330f-439e-a320-17638125d13b", "value": "T121F63376E818DB85C453C97B3A6A3FC58DADC3690F170B05DF89C74CD6802AADD86E84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639370117, "uuid": "bfb59259-8896-4ee1-9386-593962bcc601", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639370117, "uuid": "c5b2708e-14de-48fa-b735-eca7562f30c1", "value": "393216:JMHv7V8YHbyqGZP7+4LBTcfGL6awfW34bXCMLQ1Kp0Tk:JMqqYR9TDL6aJAXCMs1c0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639370117, "uuid": "a4067942-0015-42cd-9971-7a316da3df5b", "value": 15808116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639370117, "uuid": "b1442ead-74cc-44bb-9691-6aca8ed86ec7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639370117, "uuid": "6da8e7e6-cdff-42cc-9d0c-7b73673a78e7", "value": "a2ac23fdb07e08a0a24e076a6e441b16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9308a061-5c33-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639413712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413712, "uuid": "c6e764a7-be5d-4fd5-9d59-471dc1718fea", "comment": "Malware payload (AgentTesla)", "value": "69fcd720b352db3a2cf260f089ff8195", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413712, "uuid": "e1f9ac56-5d58-4536-b031-facadc235c33", "comment": "Malware payload (AgentTesla)", "value": "a2ef97240f57b0eff4b09fa6554b44f4e43241a350dd770bb637005771e47639", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413712, "uuid": "10473408-3857-4137-97a5-88c8fefc16cb", "comment": "Malware payload (AgentTesla)", "value": "3b8336cc803183b3327ad65fb194829a3a0310bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413712, "uuid": "11f2674a-a516-4f68-ab05-a793da6c9cc1", "comment": "Malware payload (AgentTesla)", "value": "8de8a9c9569c3befdbabb03b4ac7d51a06b2c360b35ddc1f1cabee23b61ec56451ecb3f712e90a75471f8a1bef3c6bf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413712, "uuid": "0950b18b-3b8f-4f99-b8e4-2d81726dfd2d", "value": "T11E552329BDE45F01E97D0FF662A1064213B8A428FD10F2756DDEE9C5222BBD04E126DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413712, "uuid": "cacf1676-7a73-409f-9355-709215ab9084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413712, "uuid": "701d5d81-98f4-4b3c-a1c4-0fce6af03184", "value": "24576:pyS47TPvgh5PrYc0TwOQChr4lHnCAGNGsFRbV4A9AihbmYjnazIrX:0F/OjYc0BQCh46NGYBFmiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413712, "uuid": "8421021c-560c-43e4-ba49-7d5bd7a51fe3", "value": 1301504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413712, "uuid": "513f5df0-aea5-45a8-84a2-b2e160559669", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413712, "uuid": "0b9b8404-5f3e-4a2d-8a02-be80e406892b", "value": "AWB3049207643_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9a35bc-5c19-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639402344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402344, "uuid": "83cb43a1-639c-416c-bd2c-cfc8b4c1d105", "comment": "Malware payload (Loki)", "value": "d70e3e0328d31ab36f69a0701fa272c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402344, "uuid": "0d223183-7811-4afb-8e45-d1eb2ade7b35", "comment": "Malware payload (Loki)", "value": "a31f684d824d11912e26af0f8fa49717e8f7ce5c5607949dcc43ac57248cbcaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402344, "uuid": "d4c5edd1-ff13-47db-8ad5-912601a8d4cf", "comment": "Malware payload (Loki)", "value": "4240852fef7de3e30eeed75fbae76febc626f1e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402344, "uuid": "1d7f43e7-09e5-45c6-a4fc-83a6b0c8d0d1", "comment": "Malware payload (Loki)", "value": "cb0d8a7eb4973c726e9d74dbab1ded960c148b8729779288f9aa5a5d09f411e15b2112e454ece546153b41e3e6d86e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402344, "uuid": "c152623c-109d-4b11-805e-ed007bdb7ab1", "value": "T1ACD402C2B281C19ADDE907B19C3ED9D801E37D59BD70B90F76A6739D2A731A3024DA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402344, "uuid": "3539fb3f-4b04-49d1-a5c8-f596c9ee6f5f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402344, "uuid": "dfa1ea27-ef46-463e-b301-26362735448c", "value": "12288:McDZ9YgWY1gEL8lOYKK6jZup8i8y39soOdwUTdjx8mZLXU9U:lAgsE4enIai8y39sPwSdq+LXU9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639402344, "uuid": "b7516a4f-8f46-4034-b0f0-12853d6e4ddd", "value": 634502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639402344, "uuid": "0fbb23d6-4526-4f9b-b770-780dcb68f0fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402344, "uuid": "54a81af8-0b3a-48c6-971a-99bab68638bd", "value": "cks.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bee91f-5c32-11ec-96a4-42010a9c0029", "comment": "Malware payload (BillGates)", "timestamp": 1639413310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413310, "uuid": "e66a64f6-c930-4aeb-9f2b-8673c0a7a77a", "comment": "Malware payload (BillGates)", "value": "c8ba8bcfd8f068a19b89f112e80a9e56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Elknot", "colour": "#86EEEA", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413310, "uuid": "6092f054-7742-4df8-b832-797381e79cc9", "comment": "Malware payload (BillGates)", "value": "a4b278170b0cb798ec930938b5bd45bbf12370a1ccb31a2bee6b2c406d881df6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Elknot", "colour": "#86EEEA", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413310, "uuid": "b0582c6d-0730-40f8-8846-5afc016b3d3d", "comment": "Malware payload (BillGates)", "value": "8654b19a3fd4e3e571cc84c0c3990669c04e3558", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Elknot", "colour": "#86EEEA", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413310, "uuid": "c5e32297-7e43-4a4a-ab50-a08c32f85e13", "comment": "Malware payload (BillGates)", "value": "211ceaac94728fd1f8b614aa15ea3894a5afdeea8845c01a55f0e0b12b012e64ec95c28fa06c7346a7bb41f1c29a0a12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Elknot", "colour": "#86EEEA", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413310, "uuid": "5110bea8-91d0-46b7-91dd-9cb139cde197", "value": "T1FA456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413310, "uuid": "880f5c17-b0df-43cf-8a88-8d85da7500f0", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4O2y1q2rJp0:745vRVJKGtSA0VWeotu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413310, "uuid": "103d119e-4db6-4e81-b79e-3f581004f47e", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413310, "uuid": "7d516cd0-1bce-49c9-8fd8-a72275699329", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413310, "uuid": "b5f8b2e3-01d6-4b38-accd-66f93023c3ce", "value": "c8ba8bcfd8f068a19b89f112e80a9e56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1ce36e-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426130, "uuid": "07508869-eef1-476d-8cd9-8cd16e880192", "comment": "Malware payload (RedLineStealer)", "value": "1f564d5ad83aa6bfeb24929723213b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426130, "uuid": "99ae7319-0e72-49fb-b4ed-f21a26370f4b", "comment": "Malware payload (RedLineStealer)", "value": "a5722ef79a5d1b6307b9f79e9d77a85d8421be629123fc999750678bcce31a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426130, "uuid": "9a19952b-a6f1-43ed-af94-5488af69db7c", "comment": "Malware payload (RedLineStealer)", "value": "776ba133c12c5f24a2d88b6fc8ad1b2c33193e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426130, "uuid": "92bd1e9f-db7c-4043-ade5-1de6ec203c13", "comment": "Malware payload (RedLineStealer)", "value": "0752b0964f94edaec0f21800a3e26ab50b4a979f18726c5db8fd1cad1a1d1477674e5f64c70fe814bed4a32c14b6e96f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426130, "uuid": "b0583d45-42e6-4d00-aca5-0237f9771a7a", "value": "T1C4B523407E75EF65E9FC07F2A8A141901370AE6670D2E0392ED629CA7879F90DB10D9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426130, "uuid": "87032261-7940-486a-8c12-3b081de492ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426130, "uuid": "c0ae313a-dbb2-41ae-b231-9079bbaa9c4f", "value": "49152:tpm7v3mjKRJkXgcO9xQkUCbyDxs/AWwnPBhFLtgU4WxmrIcU:+PzbcO3QdpNoAW0LJgUsUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426130, "uuid": "77b7ec6a-d8b0-42fc-98e8-f0bf9266a208", "value": 2289152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426130, "uuid": "992a6621-63cf-4e82-9874-b6a7020e84a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426130, "uuid": "5f872754-e166-45db-a0d3-d7203440f3f5", "value": "a5722ef79a5d1b6307b9f79e9d77a85d8421be629123f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579fdce2-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639415330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415330, "uuid": "a1cf6a3b-47a9-467b-9090-8d49c739d83f", "comment": "Malware payload (Formbook)", "value": "bf0831bbdbd42b83389ccfa197d7feab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415330, "uuid": "335eb38a-54a0-4c5b-9a0b-4c745a2ea7d8", "comment": "Malware payload (Formbook)", "value": "a5ad2e2a940e084ddec9db413a6c44a30b6029c8cf2bafb1320d67b1c60280e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415330, "uuid": "a5c9f0ab-355d-4cb9-8dd8-870a33b36a05", "comment": "Malware payload (Formbook)", "value": "bf1e36ce6dc352f117b06ea6a80afe0b89610c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415330, "uuid": "8896bc57-7fb1-4825-bd4c-fd021ff479f7", "comment": "Malware payload (Formbook)", "value": "fcd4f66410e8ed62bb9c51bf814ce141fc578b670c4809a36f2fb0abfed4b3e129bdf9be10b55eb9633145c681236e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415330, "uuid": "0fe9f4bd-3b14-4ce9-903b-555880c934b7", "value": "T1BF55125863D49D28F17E17B8A0B0C230D736BD01A81A931DAAD56DEF7E737809E05367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415330, "uuid": "addd80f2-0af4-4b27-a645-862cefad9728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415330, "uuid": "fa6e3158-ad0c-499c-8624-cea3426af712", "value": "24576:1JdLWzjOCZ/qejomZnTQW+vgNSe19F4hH4kk7vdMXOHtEgas:1JMzD/qQomZTpZNSXykKAOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415330, "uuid": "b032772b-2018-41f6-81b0-09015cab8a0f", "value": 1353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415330, "uuid": "5d404887-435a-4cfb-adcc-9956d2cc1237", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415330, "uuid": "9a081078-d10d-42d8-8108-c50f56176c18", "value": "bf0831bbdbd42b83389ccfa197d7feab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad3fe81-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639386532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386532, "uuid": "aae5b7ed-a0b9-4e5c-868e-80a8483d8c44", "comment": "Malware payload (Formbook)", "value": "e829d9ffd3cc1622887fafedd45802c4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386532, "uuid": "cc1f6170-2c61-4e65-92fa-b078d2860cc5", "comment": "Malware payload (Formbook)", "value": "a5dc85573f0e829ba617665b1bd227567eb71b2e1110372534ead2838eb9dae8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386532, "uuid": "a6d42289-6758-43ac-bfe6-07238a34f9c9", "comment": "Malware payload (Formbook)", "value": "60b6570099f7a679185f711499db14bf08251df2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386532, "uuid": "79bd146d-307b-44e5-9669-f73be3ec5115", "comment": "Malware payload (Formbook)", "value": "b05390c6ed524eeaddc17e21b8ccd6d0ce4d7fd74322f43543ee73c922942e5d251fce990a0248a59d311353281dee05", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386532, "uuid": "a44b387a-b99f-47a9-a682-63698b2167ff", "value": "T1745533012527153DFAD8FBE056498C51608A38BCF27DB955CE41A2962E13B1E3EE5F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386532, "uuid": "651db4ba-1ae0-4d56-b4d8-dc2c6d957d92", "value": "24576:8OfXLD7+iTsFeGfRo+IOpEHtnMZE1lLfIeu/mTflx2kDJSUfbBfP+:8Gn7+iTvIRoruEH6UlymTd7wUfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386532, "uuid": "bc83de92-b84e-41ef-99c7-9d0b7a570b88", "value": 1355611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386532, "uuid": "782df547-b9cb-476f-b770-74db107de4a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386532, "uuid": "4514dd8e-5e8a-4953-a6f6-1d4309f7dfea", "value": "PO 212RC048.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8073e06-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355819, "uuid": "861c1dff-e228-4758-ac6a-7be623feaf43", "comment": "Malware payload (RedLineStealer)", "value": "f638e98f308d4d207280963161f0b6d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355819, "uuid": "114ee163-4015-4d48-9f09-4919783d8b9b", "comment": "Malware payload (RedLineStealer)", "value": "a77124e75801468ee6d25d88abd0cdd9de0a3cdcd86459253d02836a77a320a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355819, "uuid": "eb95bcb3-ee6a-4b67-a336-c9275ded1a60", "comment": "Malware payload (RedLineStealer)", "value": "3a44bf4583928da372d40e212271709aceeb92d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355819, "uuid": "7dfd882d-0549-4df6-92f3-11476fc57a33", "comment": "Malware payload (RedLineStealer)", "value": "fdce5bcb1521dd694d82f6c2491544d094a6dba0379802a8d715d3b80cb01cbbcda696eaec60fd388a7c1e5333ba9a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355819, "uuid": "3b6cfca9-89d4-4774-9e9e-be9c432ff0cf", "value": "T1F3C4E5283AFB5019F273EF759AE8749ADA6FF7633703A51E205003864A13A81DDD1639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355819, "uuid": "ce3b6cb6-e1fc-410d-9584-2b374c8c38ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355819, "uuid": "3c608107-07c3-4ca7-8fed-e132ac14cbd7", "value": "12288:9zPFKxVpYnT4jI7gpKyAmeZEDOkjnfNwEfExnxGawhIlLC:e04ky2Qf4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355819, "uuid": "1ee9bb4f-d916-4604-b1fc-293e9fb76f6c", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355819, "uuid": "7faacc86-2187-4e83-9ad7-d1c6b6a11ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355819, "uuid": "1437cd34-2fbe-46a7-81eb-d1594141cca8", "value": "SecuriteInfo.com.Trojan.PWS.Steam.21709.798.25836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a4db21-5c2f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639411835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639411835, "uuid": "c88e5b48-038d-402a-b8f1-ac6edc0c2d82", "comment": "Malware payload (Formbook)", "value": "384321447cda357ac2a95041dedc5763", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639411835, "uuid": "4114001d-4b03-4290-9005-57a7ac058864", "comment": "Malware payload (Formbook)", "value": "a82c2e7e5e36d0c0df3b9677e4ec9df7031958e3abc394b0380f2d5e29d10f9d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639411835, "uuid": "0186c6f1-55d4-4a54-9fc6-fc0bb69a9f94", "comment": "Malware payload (Formbook)", "value": "9c25a3c567d9c4b3712b7c9bc8cf741556b3e487", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639411835, "uuid": "13e1bbbd-fd2a-46db-9b06-5644d02d870c", "comment": "Malware payload (Formbook)", "value": "8ff8fd46729558bf993c154ded40816872a92b903474f901684db2bdb18a026e6ace33f1159a13436b09ec526342e7f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639411835, "uuid": "68606f88-9699-425b-9402-8fa075207364", "value": "T145452383AD91C677D0971339277366A2F6F87B4C21438F033B9C0F259FAB6526669183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639411835, "uuid": "f6d6a87b-2267-4829-80ae-a506e1136c77", "value": "12288:GSxN/gNDhYH9qJ0exbmyja9AvTYMhoOdwETdjx8pZLXRLS:DgNCIK6m1AvRhPwidqfLXJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639411835, "uuid": "6a7325a3-9b33-454d-8152-aa3fd50bf6ce", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639411835, "uuid": "995f9ef5-af76-4acb-abbb-2bd2d936b499", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639411835, "uuid": "a63343f2-87c9-45a7-8dde-54ac659f42ab", "value": "Neue Ordnung_PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85aa046-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639386770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386770, "uuid": "b58673d5-7bba-4e84-a4fc-b3c7a0ac3a17", "comment": "Malware payload (Dridex)", "value": "7ba200f49d13a96dfdd45dc79adcc650", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386770, "uuid": "98d9b0cd-4651-41eb-8d50-e0234c7419d8", "comment": "Malware payload (Dridex)", "value": "a83b9c9f0af5bb42e766173ff97620900ea9290d73b388ec91178382d69c727b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386770, "uuid": "aec90ebc-5435-41d9-a794-843e89109e1b", "comment": "Malware payload (Dridex)", "value": "96c9ea4da827ec681af9cfeb6f4a82a5cae50d34", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386770, "uuid": "e5d47116-d223-4a84-8c54-244f985373cc", "comment": "Malware payload (Dridex)", "value": "197538d255c75228f8e0f5fbb4433ff3cbb5af7d63f96a75cc596260002dc71f22efb202b86717aa51988609935c64be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386770, "uuid": "65843822-5387-42ff-9211-53671c32d655", "value": "T15A15AE56BEC6AEA2EF7F51B7C360EA391116736D03A09ACF760305993955FD2403EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386770, "uuid": "ae9f8dfc-d39e-4de5-9d55-689e4bb70022", "value": "8c8bba54a9dc287053536e212411cdac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386770, "uuid": "1833110a-e50b-4681-b981-c24b10924601", "value": "12288:BHB8k2IlwP0iruRPlOF8bzbBSreFNlKVWf9mkqe4sNIlrjCrIL+Cc3kOam:78mO2X1fsgkkNbNIherU+mV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386770, "uuid": "0f8c4c25-ce98-4cab-a90e-fa5fa83e57c6", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386770, "uuid": "a027fb32-14ba-4639-8936-8253757ab43c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386770, "uuid": "3e0d2181-027f-4cd8-bebc-5a8e3542b85d", "value": "DEQeobxl321.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d68f63-5bee-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639383838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383838, "uuid": "4b0c692c-687c-4121-a62c-c47e3274e51d", "comment": "Malware payload (AgentTesla)", "value": "548fad0b5f3d7cb2d0bc97dfbae3187f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383838, "uuid": "1d4b5c2c-75a9-4615-be64-3078d497e998", "comment": "Malware payload (AgentTesla)", "value": "a93776c54f71adaf727e7a9bc24a37587f19af6139372d2264b2f863575020b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383838, "uuid": "cc96f8a0-df8e-4726-8e09-f4df8b846811", "comment": "Malware payload (AgentTesla)", "value": "799d77af3453f18c9e9be966f5aeb4ab050e89b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639383838, "uuid": "28492e88-2c6b-4e3c-aa31-bf0b50b781fd", "comment": "Malware payload (AgentTesla)", "value": "727266445ac30430ba448f976c0563ddf26b7b4b21e5699a0f449e469c0c5b60ab6cfdf8f53870883bb9fa18a159016c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383838, "uuid": "62ef95ea-25b1-4b36-bf7d-abc0baec344b", "value": "T1635523A5B9505313C9ADC1F066FAF99013FC92767449F3AD4CA0E2D23E93BC186862C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383838, "uuid": "9de0efc4-b0a0-4eb1-8e91-a3a18f99e212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383838, "uuid": "d5551100-8a08-4896-be83-512d2033e52e", "value": "24576:vulERciFJ3LHyt8SpQfABUiiNxexroIR7oVHx7ztBu+CqLk4im9gQbYcNUjYn9I:vrFJ3OCfuUqroI1oVR7xBu+Cqg4imOQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639383838, "uuid": "0d162db1-c8c9-406a-8d8c-3b4caaadc3d2", "value": 1325056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639383838, "uuid": "9f1b1250-a693-43ad-b812-926538c97873", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639383838, "uuid": "ea505693-13bf-469c-bdaf-a335625a1e83", "value": "Attached CO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30783e64-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426002, "uuid": "28b64601-dca7-4a22-9676-8da0f31baa41", "comment": "Malware payload (RedLineStealer)", "value": "9ac2258253cc3d48130828845dbc26ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426002, "uuid": "e93b2f3a-eac1-4282-ad07-4f203f7f85ec", "comment": "Malware payload (RedLineStealer)", "value": "a9e5a35019b6d8cd832c451876d5956bf227435740254c537c758dcd978dfc0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426002, "uuid": "93021b44-06e1-47d7-9b61-1e51279dc331", "comment": "Malware payload (RedLineStealer)", "value": "0e6aff9f5bd79d25e0142e2e19f30e83f8f1edda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426002, "uuid": "96f9ce65-8eda-452e-80b2-fe50d2dd34d4", "comment": "Malware payload (RedLineStealer)", "value": "b6295b1c74c0ae4ca618d144c2e2d80d53ed5154c08462cf5dcbead8d53d61619c60370f81980b5814220f77019993f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426002, "uuid": "b3da0479-7239-4ede-bf9c-e1171e8f0ac3", "value": "T1EE64E0C175F0D871C6A3293188348AA45E7FB811EE21854E777B2BAE6FB27C14636316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426002, "uuid": "fe91db17-1ea5-4b0e-9071-f3ad7963611a", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426002, "uuid": "a3e79252-d5e0-467b-b6bb-2b57510f516c", "value": "6144:ih7O8YeubhRvAQZVT3wS40/6T47T9rIpkJC1Nb7ITsq3satPLx:iRO87ePvAadO0/6T47T9cpbT7Latj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426002, "uuid": "2224b184-6b32-4b11-b35a-880ee42b1abe", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426002, "uuid": "1bb4c726-4950-46ae-92d4-d8d55f9eb89b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426002, "uuid": "09c38723-aef0-4d46-a1cd-7bbf12f77a0e", "value": "9ac2258253cc3d48130828845dbc26ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23057a1e-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639388183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388183, "uuid": "c297aca4-269d-4575-855c-0cd5ca4f8b54", "comment": "Malware payload (RedLineStealer)", "value": "c90c058ce44f41118fad4c0c9780aef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388183, "uuid": "5851d2a2-3d2b-4732-9016-c5aeade04017", "comment": "Malware payload (RedLineStealer)", "value": "aa31392317ad9f86210f7c9c6792b60802b737fdd6b3a016ca9b2a68d9a546f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388183, "uuid": "a199010f-cbd5-4e82-b429-573091fa481a", "comment": "Malware payload (RedLineStealer)", "value": "fda0fa09c577ebdb0779c4e3ab6de911f0daaadb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388183, "uuid": "60698bf0-af2d-48fe-963c-61ea906d4f28", "comment": "Malware payload (RedLineStealer)", "value": "dece9c8398eb14a9285441945eea0548777906aa5cc8650d32120a21799848e09a3374a9587a4c1b9687f400e766fb44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388183, "uuid": "0d3a0b29-c795-453a-9e4a-4cc4d4d57103", "value": "T13BB34B5037C8DA04E6FF0F746CB0511883F1F5536451DB5F6EC5A4EE2E66B80AA12AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388183, "uuid": "29613ac8-1dad-4d56-b23d-8f73355a3026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388183, "uuid": "a82b02fe-db02-47c7-b669-fbfcf11467cc", "value": "1536:msLSqThEWHmdiMf6SnW+daIkGPHUEGbZAK0m0jCtbnUf9T00QDn:zLS2hTHmtf6EM3Q9e8VyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388183, "uuid": "b3c8df23-ce86-422d-8cd4-2a610e846e8c", "value": 108776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388183, "uuid": "8c04d152-3138-4855-b695-021cfe17fe33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388183, "uuid": "0b8096b7-61a7-4fc0-867f-45fbb451099a", "value": "SecuriteInfo.com.Trojan.PWS.Steam.23526.28071.29750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb40999a-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408276, "uuid": "e68eccde-7bcd-48ca-8a9e-2612060b30d2", "comment": "Malware payload (Formbook)", "value": "a6caf7ee5f8b5a2945d7b4b22e5c03e0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408276, "uuid": "366fae80-8407-48db-a53a-c08a826ab946", "comment": "Malware payload (Formbook)", "value": "aa52d9c063592963d44c2b4c08fe63913c692e5cd535f573561ba1c01d818b3a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408276, "uuid": "d3b045a4-ccfe-4fdb-b35c-b5232cf74675", "comment": "Malware payload (Formbook)", "value": "8ac9d076731c636972334590457dd34e9ca50406", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408276, "uuid": "fdbc7eca-ba2f-40ad-9ccb-9aa767be88bd", "comment": "Malware payload (Formbook)", "value": "50808643266468a07128937e2e0fafe1c2062582913b2789aa3ebdcce9cb58570886721c1b05adcb0b57af2a5ef678d6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408276, "uuid": "0b196d69-1915-4c70-b5b4-c2564d97912c", "value": "T1216412546F2B1B02C033BBFC6DA52AB9CC67FD56C270858158A1F5B91DF8F92894C2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408276, "uuid": "ba4055b4-5aff-4c47-a5c5-4ab35cf9f05c", "value": "6144:4wbTPN/r5bgklC6X4aR+KVFiu10RuiHWFXF2HkOg7kE7j7Z:4wP9r5bgROU0Fz0AirEOgQE7HZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408276, "uuid": "f4472df8-47ce-48d1-85b3-eb02e157a81a", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408276, "uuid": "da16a538-39dc-4231-b0d3-80d18ffd49bf", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408276, "uuid": "be29dce0-5d3f-4bee-abf1-1973f5257a88", "value": "Draft BL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b985babb-5bba-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639361807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639361807, "uuid": "55cdf9ba-6793-491a-9be8-dcce4dd3000f", "comment": "Malware payload", "value": "b3cf77a5a7cada8e78b070a0cde369e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639361807, "uuid": "36ea4c35-44b1-4511-a832-775afc906a4b", "comment": "Malware payload", "value": "aa8d724a3ccb201f5ff5f02e23bc1ef0a8a30a3324691e8181a84ff6b0a9e358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639361807, "uuid": "de455354-a3ed-4d67-825b-f348f04dff5b", "comment": "Malware payload", "value": "5ca41e90362072fc81e3208f7253fd5c106b4168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639361807, "uuid": "262dbd7f-8b34-4248-814a-3096102cb60d", "comment": "Malware payload", "value": "ebed677d03d8d0775bf207b542c74983cffed665d20db56e208d12d86320c0bb8d7dd209db9f60964911d240aadbe9e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639361807, "uuid": "f55824a4-18f2-41ff-9c99-6fdf22975031", "value": "T1B3C4BE1D35D796DCF87AD7B43B64719403B5BDF1E543E2CDE894304F8863A81BA222A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639361807, "uuid": "bd3e4c5e-ddb4-4d4a-8be6-76e6ec011573", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639361807, "uuid": "a2f5cb3b-47ac-4ee5-86e9-31153e8f5871", "value": "12288:p9WfOerQnIgEdbg/sli1kfY8stn5ewW+Tz:IOjnIJ5li12StQwWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639361807, "uuid": "a05bb1dd-fe70-4620-ae0e-97bf29ed4e7b", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639361807, "uuid": "73e6edba-67e9-4c2c-b9e3-ad22421c4367", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639361807, "uuid": "84c9160c-ffc1-47c5-9da6-decd9266d374", "value": "invoice and packing details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f7eb16-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355807, "uuid": "857bd236-b8e7-4e00-8196-8f90c98ddadd", "comment": "Malware payload (RedLineStealer)", "value": "04ec733f14289a8592fe3b8f4636c656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355807, "uuid": "c5075c7c-66b5-4391-b2ec-b078f863ac2b", "comment": "Malware payload (RedLineStealer)", "value": "ab1c8e6b2894409e9d9808b0ef61fc6bd876a33db22d4bc7eb8e28fd450f68c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355807, "uuid": "46954874-0a1a-42ac-a5e2-b7d207fcdab5", "comment": "Malware payload (RedLineStealer)", "value": "be8ae7a37564d6c04f48fbc3a00a60cf1a8b6ee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355807, "uuid": "f98a1c18-a620-4728-81d6-d2b544894738", "comment": "Malware payload (RedLineStealer)", "value": "97e0a24a832dada4bae31a3a47b8e5413d0d75e86466a222a7bc39966c1a8352682c44223a124d715fe15b551e0d24d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355807, "uuid": "78c6a86f-080e-45f1-b963-12561a212811", "value": "T10F74CF1013E80E4BF1F5AFB559F501515F32B692A836DB4E0EC8A4ED48B9F885F29B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355807, "uuid": "d6f10065-79c6-4984-b45d-3472214c05e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355807, "uuid": "3370881b-9a47-48a6-b9ae-0465477b569f", "value": "6144:JXcOnhTpRnhFgINeDIctFtTqM1KsBpoqjI1A0Uw3kwb:JvnrtniIOfpKswqkcwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355807, "uuid": "7d4e1405-d034-488a-a855-f8a94e6637a2", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355807, "uuid": "675c2242-88db-43c5-92b2-84d800662089", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355807, "uuid": "737afe1f-7330-4dd3-b080-c363ccd1a2e9", "value": "SecuriteInfo.com.Trojan.Injector.4383.7292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4db145-5c68-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639436413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436413, "uuid": "a3588991-51de-44a1-b75a-bfe819ccd75a", "comment": "Malware payload (Mirai)", "value": "a9bcf4c64b0816ccaf43b4d58b49c44f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436413, "uuid": "65b6ac42-95e4-457d-a455-e52ef101373b", "comment": "Malware payload (Mirai)", "value": "ab4dad4d5eb069e97b44f35ddd38d6ccd401a6acf0e4612c3ace51e68d058239", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436413, "uuid": "816a56ca-7971-45e6-a563-4e20446742f7", "comment": "Malware payload (Mirai)", "value": "38a80c7a5242ab64cd76721155548728a08cd7ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436413, "uuid": "274717d0-1343-4a98-a7d7-d8fd27faa708", "comment": "Malware payload (Mirai)", "value": "b94d2147e7c8d6a78a23e7bffb68a0ef94bfb14bc079cd9a2b084c99f206ed80f9b3648ebd886b7d1de57bf9bb8eea45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436413, "uuid": "32eb757d-c8be-4cd1-a541-eab64de6dd4e", "value": "T176533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F413BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436413, "uuid": "fbf9661c-c1e5-4cf8-b94d-43a833e534e4", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyYgGhd2G4NMiplImpcvwJZY10UPZvBqJ:0aHuAzgjjfUKU0NONyYgG+7XtJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639436413, "uuid": "15ec529e-0b9d-4adc-a755-798b6ebbeba5", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639436413, "uuid": "a2a22923-4da4-4054-b6ca-ebc18f94eaa5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436413, "uuid": "fc40aea0-52d1-4caf-8b22-7b1b449227a9", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca48a371-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1639408650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408650, "uuid": "b6c0017c-aa7c-4c52-89f2-9e3160a892e5", "comment": "Malware payload (STRRAT)", "value": "91f2de012a840b47d9d11d1507ca14be", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408650, "uuid": "314b5026-e108-4419-a1ab-78d655926d4f", "comment": "Malware payload (STRRAT)", "value": "abacf97d6fd2b2c59717692c05fb25a5a9295aea2908b76324531e5e9fdc4311", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408650, "uuid": "cca4797b-e0a3-4cbc-843c-38fdd3e431a4", "comment": "Malware payload (STRRAT)", "value": "79b813a33705605527483ead1aea2537c198e571", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408650, "uuid": "8dfbca47-e55d-43d4-bd65-e3ebee292b54", "comment": "Malware payload (STRRAT)", "value": "7c43752a3e9de13613dee0f78acdfae9f8794aca422861fa01c73543790ff7b4995d56c48ee44f5bd2d744fcb17dc4ac", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408650, "uuid": "b1ed1a6f-f6c3-4d90-b492-4a04ae6f2399", "value": "T1C8A3CF1B3DAB91BAE1579472A0848737B61D52A8D06AA11B2FFD14C70DF0C6D4722ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408650, "uuid": "027c1921-e657-43a7-9d38-2f0ccbfa36be", "value": "1536:PnJbqy7dObQlTYkH3AIJFCwYLX5vAnZxzJ5nukEguUKvsowYgVXKXD4:Pntt6y9AIvKLX5viZ5J5uzlr0owPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408650, "uuid": "7b44c8a8-7955-4a84-bac8-0792acc6f640", "value": 97739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408650, "uuid": "1833f431-8893-425a-8be9-ab4259cb3490", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408650, "uuid": "bd437452-d36d-4731-937d-a583e19fb0fd", "value": "CUSTOMS DOCUMENTS PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25f8627-5c36-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1639415053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415053, "uuid": "d65c8c1e-28e5-4882-8695-db6a35772dc0", "comment": "Malware payload (GuLoader)", "value": "d4d0e4cfb3711cba916ce7ed8b051c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415053, "uuid": "0ef68f49-e272-4c48-90da-692033d5485f", "comment": "Malware payload (GuLoader)", "value": "ac71d79b8d50683efa66ed4b3866a7f00b3ecc710918267fd0c60779640982d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415053, "uuid": "1350da98-dc20-4d85-bf48-677ca74d7999", "comment": "Malware payload (GuLoader)", "value": "b7a869f97cae854f8c5934209d49ab3307d921da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415053, "uuid": "85f28eff-1a13-46b7-b701-eb38bb7bae52", "comment": "Malware payload (GuLoader)", "value": "a3ef95757ee9ad46e671fb6b365b2f56373c11746171962971ab09daf9089ce9f64080cba2ae69dee55701955e4cd455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415053, "uuid": "f72203fb-8ccb-41ea-b514-b1de7d48434a", "value": "T198F35B519694FE53F321C4F42B35A02481AA78759700B423B95FBB6E6231BC37E6C72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415053, "uuid": "6057e3a2-e9bf-4592-abb2-b93d96737cb5", "value": "e7597de960f525af7c9e8aa5873fcec3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415053, "uuid": "5eb00ef5-19f2-4b8a-b584-89cc4edc5782", "value": "3072:kP8lPzd/6qZWND84+uks4JNS7hdc9M32DdXx:NdiqZM+XPYe9MGDdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415053, "uuid": "2b93de15-4229-4819-acdb-d54e3bef9880", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415053, "uuid": "b42ba51c-9ea0-4cb6-a3c0-6f47644e452d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415053, "uuid": "aac0655d-bc24-4e44-8df5-5d38d6ea0b68", "value": "MX-LC-20210809-P00286 JUSTIFICANTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3686615a-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426012, "uuid": "0cb71a17-42dc-422a-9eb6-0107ba1d2183", "comment": "Malware payload (RedLineStealer)", "value": "26401279b0905b7ef9f323db11cbdc5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426012, "uuid": "0449b438-8ccd-40fa-a84e-c448b981ccd5", "comment": "Malware payload (RedLineStealer)", "value": "acb3a7ff58ef974db7ad5fef95168c75a0e0049ac176b6bb03834d2974e3630e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426012, "uuid": "b4e9966d-64ca-468c-9263-0fc07a0a0c9d", "comment": "Malware payload (RedLineStealer)", "value": "5c15679d301e42ee3618fdef8d1206fd193bdc18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426012, "uuid": "1226ced1-ebae-4322-a031-baec5a415881", "comment": "Malware payload (RedLineStealer)", "value": "c5213d046afefa9c90263df38ac3db5db7df804f15130d3b35538c6220f66c97193ceb6ce1a7a20e44fa4674f86f1ebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426012, "uuid": "55128fa4-a295-4210-a08e-8b1b0fec00d9", "value": "T1BC64E0C175A2D971C6A239318831CEE54D7ABC50EA60414B77F86BBF6F726D09A33306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426012, "uuid": "5258505b-cab7-4967-9601-451e213daa06", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426012, "uuid": "13c5e82d-8c8d-4968-8387-bca416993f29", "value": "6144:/h7mt3j4xYFOIU3YVsgD9KdJAWcVxhQJNV6Dbb7ITsqlhSb4Etse:/RgFF3U3YVRsAdpr7eSbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426012, "uuid": "785b682f-41d6-4ef8-ae4a-8b93dfed7d74", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426012, "uuid": "bc5ba460-2cbe-4cbc-bcc8-83a3d7dd2d7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426012, "uuid": "df11c565-8986-4bd9-9481-36de31f67a7d", "value": "26401279b0905b7ef9f323db11cbdc5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71acbfa6-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408072, "uuid": "4d0c8f1c-9143-4d61-bddb-0506cc04f0d2", "comment": "Malware payload (AgentTesla)", "value": "5415faf160b802e1e1b7e35dfc08ddfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408072, "uuid": "03650932-8e1f-422c-8cbb-fd493d91ba94", "comment": "Malware payload (AgentTesla)", "value": "aeae4939ea6ffe1d8ffbb4ab959d98753610b937a1894e6640ab6719a9325328", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408072, "uuid": "983397cf-7c9f-42a7-b786-ca110a2f052a", "comment": "Malware payload (AgentTesla)", "value": "2ff126355be9521684d665eb643fc8854f08f539", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408072, "uuid": "1c419e57-199d-4e01-9415-e643f09c2ea5", "comment": "Malware payload (AgentTesla)", "value": "1335c8c5837427ed30fae11300b73b62dbfdb0dba9c1790cc839f44f934e32036e22f0a09fd8afa07815241498dedf91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408072, "uuid": "a7d2e0d6-5479-4545-b800-293400ba7c72", "value": "T1039118645B192E83DD5286B5D925BFA809E3F56AC1CF0968B39CFDE00B7E2212927C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408072, "uuid": "e824f148-46fc-4a06-8c90-05e845471b8b", "value": "96:Q8jBQ6MuY1eeNPYlvZTIMriSb4vPKIH/+OoVqjeyOpEx3y+dJI:QKBxMur4MriuS/YTyOpEx3y+dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408072, "uuid": "8d74ffcc-391e-41f1-aa0b-797ef7ef3f48", "value": 4520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408072, "uuid": "5248e76d-7094-46a9-ba02-eab761407fc4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408072, "uuid": "b975079e-e0c3-4251-9661-ca222880efa5", "value": "PTORDERS_5637673267362326.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e43fb25-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639388229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388229, "uuid": "ae23075e-82ec-4277-9c09-5b17b2f9e3a6", "comment": "Malware payload (AgentTesla)", "value": "20aaab514973d8359e46092d5b39d400", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r05", "colour": "#7FF751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388229, "uuid": "abddd328-8edc-47c2-9e43-10ee0f1f5d0e", "comment": "Malware payload (AgentTesla)", "value": "aec8d99989e16ebb47ae52c4f76a33d965279120e095d4922495737c65706892", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r05", "colour": "#7FF751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388229, "uuid": "016f4be6-a5a1-4bd9-b218-3ff8606df361", "comment": "Malware payload (AgentTesla)", "value": "7ae237ec373efb419fa3148a0f7c88d28e462c2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r05", "colour": "#7FF751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388229, "uuid": "64d9f2b8-40b8-4c34-81ce-74df37792e10", "comment": "Malware payload (AgentTesla)", "value": "48469462f827cf4bed453143c37904e49e2d312190b905db643a10c47ec42ebc0590ad4d57c91e904f7230520bb4b829", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r05", "colour": "#7FF751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388229, "uuid": "2c7924d9-1ac4-4b34-a05b-0c415e1c44e1", "value": "T1BA55334061EB52BA6DE5684089566872F3DAE6DCD52D4D1FC730B2E370B6389F1CE2B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388229, "uuid": "317b7ada-af7f-4f74-90a3-38046f2465ef", "value": "24576:lpYded7dUHqEykBdpjS/NQehsQiKNT/vpjDvGB/G/VF0W6M1IVqhvcOo4mSlHX:lpYgBdQqzkBdpfQrvpXE/G/x724", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388229, "uuid": "62ba5897-8399-4c31-b4bc-ea1059d23f66", "value": 1297580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388229, "uuid": "df6cb7f9-055a-4304-849d-897192a945eb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388229, "uuid": "b78a83d9-6717-4d73-89b0-85e8e6dd93a3", "value": "DHL SHIPMENT ARRIVAL NOTICEHAWB R129724.r05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0b9001-5c49-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639423120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639423120, "uuid": "e840da8e-f45e-41cc-8612-f7cb1d51c613", "comment": "Malware payload (Dridex)", "value": "7c4dba81eccea65acca159ea7c730dab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639423120, "uuid": "142e2281-0548-457a-907c-7e306e4ea46d", "comment": "Malware payload (Dridex)", "value": "afd3d540c9806ec47ae8e234368b513b16265e33ca487b9c54e1e435d70aaea0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639423120, "uuid": "da8aaddc-df2e-459a-b56d-4743ae293087", "comment": "Malware payload (Dridex)", "value": "cb3242ae6fd27f6a98926ed5349cdc9d561b36f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639423120, "uuid": "7c45c520-e9b0-4efa-9a6f-eab3302d8b82", "comment": "Malware payload (Dridex)", "value": "6124eabe935df5fc623ac03747c08a850614ac2b2c75b6a941cb154ef0b73219ff7713fead9a15894a55cb3fad9f6956", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639423120, "uuid": "e3c8607e-97de-4f76-99ed-407cb9bcd525", "value": "T158B4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639423120, "uuid": "b8e7ae62-8953-4f3b-aad8-cfc508d67a79", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639423120, "uuid": "ece102a5-cba0-4ff1-9e01-ae3d787ce7af", "value": "6144:6KMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:69hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639423120, "uuid": "0aef44a4-ef88-4ed5-a935-53c24666fbe2", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639423120, "uuid": "7c52ed29-c197-4382-86cc-b73bc1a969ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639423120, "uuid": "ed179eb3-cc93-4133-9b0c-3eee46e2c75d", "value": "7c4dba81eccea65acca159ea7c730dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38da153f-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426016, "uuid": "c0262490-f944-49fd-9207-62b61b2f2bcb", "comment": "Malware payload (RedLineStealer)", "value": "3205c3ee8d72f7309f623a998a51f943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426016, "uuid": "cb568983-ac25-401e-900c-3a5f487669aa", "comment": "Malware payload (RedLineStealer)", "value": "afefda816ef046d6c0bc78d588cdf14d4ded6227d27d7395039531933087ce01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426016, "uuid": "3e081055-504f-441e-8d30-f57f15fffae9", "comment": "Malware payload (RedLineStealer)", "value": "7393195585e8e07d37f1274829175ce8ba0eee64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426016, "uuid": "b0ff5ac6-9d8d-4469-ab02-905fda262283", "comment": "Malware payload (RedLineStealer)", "value": "e2c56bc4dc9d354ba66b2bb75c736b4e3b39385466503b37ac728614abd2e6305bd138f935ffc72735b5462487047e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426016, "uuid": "a923183e-bc74-4876-8a4c-cb706e0933cb", "value": "T171149DC135D0C473C1B239309960CAA49E7BF8A1EA2C555BF37827AE6F722F15E25316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426016, "uuid": "f2d3cc33-c090-46bd-ad76-347fa836bc65", "value": "da86082cd27b859e55ff9843cf87f36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426016, "uuid": "361c7a22-5fd9-489b-b4dc-4bf6dc276284", "value": "3072:rta0+PMh32On3TChltrmmEY5G03hsZVggjcGkNIVqIYWSWtWhbe0dPj32:Ikh3L3Wr4Xb7ITsqLH1J7pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426016, "uuid": "d03cf352-5499-433e-baa4-a5c23af9430f", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426016, "uuid": "b3bcf6b8-8aab-4177-b86f-7dbf993a8f06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426016, "uuid": "0d947d4a-f0e1-450a-b7d9-6c3830ee19e8", "value": "3205c3ee8d72f7309f623a998a51f943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa32d3a4-5c43-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639420622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420622, "uuid": "7815baf7-1363-450a-b856-670da711f045", "comment": "Malware payload (Formbook)", "value": "3a53c286fd9b022444d64a8d55aef067", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420622, "uuid": "1f40e8cf-8e2c-4c1d-a21e-c673931ac4e1", "comment": "Malware payload (Formbook)", "value": "b02b6cbcd855ba24e38b46c1bf1cc9744bde93bb931c55fa5ac98e595e15b347", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420622, "uuid": "9fd420c4-e2b9-42b3-80e7-2171217c911b", "comment": "Malware payload (Formbook)", "value": "4cab32b04fe213e6a0f1fe71213f91d7190a83fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420622, "uuid": "64dac517-2f55-4f44-9969-fe0d19f28ada", "comment": "Malware payload (Formbook)", "value": "d5c3a6dbb7f7f1499757e92a732ffa212d7e652dea9a9d50be3bd12c0fdfe5859dbca4085ec48374f6fa99f6cb1ffa37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420622, "uuid": "0e0a54ee-8e58-4103-8313-fa06fa8d6033", "value": "T1D1A4232EA4E146FFE4A382F30D62FF86D3F6528E86E5145757982F3726420DB1C1C962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420622, "uuid": "fa13b63c-8c39-4dc2-9419-f354dd7d49bd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420622, "uuid": "57198d67-f8d8-4993-bb89-00220efaa252", "value": "12288:CQfryqX7befK0lLfFixd6Qk5HW1DauY5FJL3z/K:CMrbzULIG81s5L3bK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639420622, "uuid": "616d9ded-fd6d-4a80-801c-534cf1fddf89", "value": 468537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639420622, "uuid": "c8c92f4c-83eb-4470-bd4b-08c9fa29a9d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420622, "uuid": "125f241a-09fa-4981-868b-295a39f29b76", "value": "3a53c286fd9b022444d64a8d55aef067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4a590d-5c68-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639436410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436410, "uuid": "974061f9-25cf-4822-8333-9e79f1b1d147", "comment": "Malware payload (Mirai)", "value": "c4ef4b2cc28d319746bbd0693def8d43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436410, "uuid": "f1f7fd55-2e87-49f1-982f-1aa29fab2aa8", "comment": "Malware payload (Mirai)", "value": "b0fbe9420f1c9293e250e0407149eacd1339139284280c90bfd0f840f80ac0b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436410, "uuid": "f61f7fb0-e2d7-45e2-87e7-3cf4d6b12496", "comment": "Malware payload (Mirai)", "value": "2465f9e6210353c636fff59cfd02061b0ccdc1be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436410, "uuid": "093ab52d-734f-47c7-97d7-dee639ecc64c", "comment": "Malware payload (Mirai)", "value": "7977e2c3142e7a4e05e833dab6b3f3bfdb437746a1664f8de48fe4c9f48dd2c1199a68d03a6e96f27f026ec9f1169d02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436410, "uuid": "b83397c6-abe4-4732-8ac3-e34e258c8027", "value": "T1B6434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436410, "uuid": "97d00d14-2a52-45b1-83dd-dcb850a00510", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmc2Dj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6amvlWnU4GH+dNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639436410, "uuid": "8d54f8d0-d27e-4c16-b908-4a8fc23d69a8", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639436410, "uuid": "a75b400d-a019-4d7e-b6e9-1148722ff5b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436410, "uuid": "631e80cb-9a7c-4299-8090-967d5d0417e4", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a93a07-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386416, "uuid": "a04bcdc0-50a7-4a2d-be4d-216c6c14d417", "comment": "Malware payload (Mirai)", "value": "5fb62dc3b30b51999c86c399d60fbe8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386416, "uuid": "182a73ce-8790-4403-ab03-4b8f268d04b9", "comment": "Malware payload (Mirai)", "value": "b13788aa0216358103ac4f8531512952df5a1d8fd36331efc6d32b458809bdb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386416, "uuid": "4cfc1c5d-ffbe-4ba9-8f49-a47cdd948807", "comment": "Malware payload (Mirai)", "value": "252adbab6e909bbd8ae83f1f025be7f61b7c25b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386416, "uuid": "57c42f2e-42be-4f04-beb7-41789ab3e587", "comment": "Malware payload (Mirai)", "value": "c3eb073b33e7494f54f9d1e6dea359287a621e8fda06158159c1f7f3f80c6b343f7545aa4b29d94f62cf6ad15afcdfbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386416, "uuid": "c668d4c4-318b-4c94-8800-54078caf67ec", "value": "T144833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386416, "uuid": "8505603f-1e4b-4d79-bcb6-366c9d5e8030", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LBWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yd2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386416, "uuid": "3febf6bc-c30d-4611-9f28-1e0eb8f453bf", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386416, "uuid": "38b6be3e-1cae-44ea-899a-e27400684ee0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386416, "uuid": "e617e3d7-906e-417d-a96a-56e1162cdf67", "value": "5fb62dc3b30b51999c86c399d60fbe8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40b1f33-5c5f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639432665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432665, "uuid": "f20b145d-21b3-4111-a6ae-df07e035a95a", "comment": "Malware payload", "value": "e8425731d24430d3eb25182dfc18200a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432665, "uuid": "c09c4489-a4dd-4c44-a135-c3df1bbf68d2", "comment": "Malware payload", "value": "b24c3ed00e59dbcff18037648cad503072b9e0d7a13f30d2bbfa9c466fdbee66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432665, "uuid": "60cf9816-911a-4181-be15-f566119183a8", "comment": "Malware payload", "value": "a24bb1158c01117b14646e83243308396230e2a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432665, "uuid": "9666efb0-b441-444b-aaa5-e97fbeda1743", "comment": "Malware payload", "value": "2a3d6d834e84651f1588158022ad2c52b18b662f296d4a1b197fad3975b0819a1e84feea5caaa1beffc4633c23e5795d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432665, "uuid": "b5fce503-eda2-4f05-97ff-0087222e660f", "value": "T1A2B4A0D1F05FE94AFA5F46712E189932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432665, "uuid": "d2d83fe5-a006-4c45-b6a7-52b1f8c263a0", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432665, "uuid": "4b4e9f7b-efaa-4f52-9b98-375b067c27cb", "value": "6144:7KMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:79hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432665, "uuid": "bf0d7259-0875-4b70-91fb-478151b0b655", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432665, "uuid": "2f009883-d874-47b7-b809-5c18d023d05c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432665, "uuid": "471dd84e-1df6-4090-b106-935281eb7e40", "value": "e8425731d24430d3eb25182dfc18200a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadd73bd-5c13-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400088, "uuid": "228e89f1-4bda-4920-9b42-1ce0466c2b38", "comment": "Malware payload (Mirai)", "value": "1c629d3d156b202a4ac8554d692c137b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400088, "uuid": "d93ed42b-f98b-4ae7-9666-fbdbd835f3c7", "comment": "Malware payload (Mirai)", "value": "b34779996efa3bb8918390241eeec95bb6bfd9e2fdc58bd49ac76170e56b8708", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400088, "uuid": "3bbc4f21-66ac-4868-b71b-da233e53eff5", "comment": "Malware payload (Mirai)", "value": "03c9ce8c7debdafd40b6be2ae6dff848415815bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400088, "uuid": "1d7efd39-d6eb-4062-a573-05c2e20c2e72", "comment": "Malware payload (Mirai)", "value": "b7038fb3d45f315fb92da7e7fb59caa8fdd7571e55d6cf8dd643b8639b66f6e2b9539bef82e761bce5792b76df53019d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400088, "uuid": "ba1d509c-9cab-485e-a898-b5357bc08db2", "value": "T16CA37C217D7A2E27C1D4A13B12B74B61B1E2274E35F8CA5DBE710E4EEF186A03523536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400088, "uuid": "f63ceee1-08e6-40e6-a822-58e80908707c", "value": "1536:lhUwWwwLStcL880qcsK+iq6gDuf+3vzOs0j5XicOoouY/:lK3uSLtisfflGi5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400088, "uuid": "72e569a7-0f25-4a96-b510-0f51f86ebff1", "value": 103432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400088, "uuid": "cc285f40-85fb-4b1a-847d-761017a862ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400088, "uuid": "8ce963c2-1a67-465b-93b6-1a20695c82e2", "value": "1c629d3d156b202a4ac8554d692c137b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc4588f-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355825, "uuid": "1f90fbe0-eb0c-4a27-b3a1-60bf1604d0f3", "comment": "Malware payload (RedLineStealer)", "value": "c5b6dee0bdd57086d955bad03812b71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355825, "uuid": "4df96208-bacf-4bd0-bc50-fbb7eddafa13", "comment": "Malware payload (RedLineStealer)", "value": "b39c858766d31fba41aa2266a4e518446c87e9f724e1092d79a24f009a9ec2ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355825, "uuid": "3ebf97e2-ec14-4209-9c8a-92f2dabb3f49", "comment": "Malware payload (RedLineStealer)", "value": "122221b7a9fabf95349e00f00efbdc7ad4662a6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355825, "uuid": "b729cd07-99ac-4f60-ab6d-c7dd309a3e0e", "comment": "Malware payload (RedLineStealer)", "value": "08538dea13cdb4fe0443c0a216156b74565e31055cf48dda2ffecbad1f9f4bc4ed379e87e26c6a483e96844894ff7a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355825, "uuid": "26c9071f-126f-4920-a401-604fdd513a2f", "value": "T1DD451B8FB5348D6ACD808336264E1F779A475EB0C11FE7CA5828E3229C95F798D15E32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355825, "uuid": "5ee43177-deb5-4051-b396-ac2bc4a0cbad", "value": "63cc1fcf347efb24c1b52c9c8ffbad90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355825, "uuid": "453fd73d-e588-4043-91b7-44179c03c971", "value": "24576:VACilDsS3I95pp1zFMknZPXYlXSjzTIy3OB9fw8MuUKU35/ue4D+znHfLQoBjdVD:VACilDsS3I95pp1zFMknZPXYlXSjzU3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355825, "uuid": "11dfeec5-825a-4e9c-b16b-326fb1cc15ba", "value": 1263488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355825, "uuid": "c6854689-4eee-4e04-bd3a-f1da015d9528", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355825, "uuid": "3a877ecb-64ee-45d5-b559-7a6933d7e987", "value": "SecuriteInfo.com.Trojan.PWS.Steam.23512.32208.31889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bc7f5b-5c41-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639419669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419669, "uuid": "304f4756-94e4-44f9-acc3-9e03e476d165", "comment": "Malware payload", "value": "09182a337c35ac466e5fda627002e01c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419669, "uuid": "ef766221-6ab2-45f0-bce4-fe72d08d1ee0", "comment": "Malware payload", "value": "b40575480fa2ea9a41dafdaf4b73c38e449898fa658096695fa3dc4c1f268872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419669, "uuid": "a142b236-84a3-43bc-98d1-5b09edddaa62", "comment": "Malware payload", "value": "4b6421311f0403940f478d938c4ee8d86526e1ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639419669, "uuid": "64515551-f87a-4025-8f7b-bdb8e849239a", "comment": "Malware payload", "value": "b1b777f47a46bcc1d9d315de0b7a7121efca756c0bce203940cd827d04a9faa4567086be8757031d2332eac479e43bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419669, "uuid": "18bc2e80-fad6-4f68-a908-9aabf6d2e544", "value": "T147644A17E28554F8C06EC1B883569532F771BC890721B6EF2BD47A212E25FD0AB3DB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419669, "uuid": "e8ae4ed2-c432-4f07-9244-a64b983d62df", "value": "3c62972d0e739e7a5826b7a97d820ec7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419669, "uuid": "6c7d094c-5bdb-47b9-9016-9b2c2d261abf", "value": "6144:813oI43BAIO6shpT/KGgRqro527ML7Y3YRF9hTMUHmmI9YdVK9sD:UomIO6e//gRqroAMXRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639419669, "uuid": "61991b95-ea52-460b-8bff-06d3749846eb", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639419669, "uuid": "9860f1c1-8254-48c6-bb5f-eac89321f2b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639419669, "uuid": "5f7aaec9-3e18-4b12-8fc2-fd8c4e0ccfef", "value": "09182a337c35ac466e5fda627002e01c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcac0c28-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639408628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408628, "uuid": "ac761d9c-1b49-4603-adea-4afdedf6f0e7", "comment": "Malware payload (AveMariaRAT)", "value": "3ea6cbc34bbecd275c600a86bed7402e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408628, "uuid": "1cc0f47e-c8b8-4e91-ac8f-d27bda13f777", "comment": "Malware payload (AveMariaRAT)", "value": "b43107ed72641b41abb01917cd3cb2e98a919ebf112c29853ef925602d5b64e9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408628, "uuid": "158e7c7c-435b-47e5-9251-44d5f6a02fdd", "comment": "Malware payload (AveMariaRAT)", "value": "e86bcf28addc210f8cff02a5d4d9ea5d67b1b851", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408628, "uuid": "ad30deff-9a43-42b3-ba5e-f82ce67254f3", "comment": "Malware payload (AveMariaRAT)", "value": "35ebd69e224e124da1dde09db51458df6ed79c3c57e407cafaf59ec435377718a35f8ea6bf328ebe7a85dee45b46e38f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408628, "uuid": "1c7e9ce3-bb31-4dbc-bef0-2a0249070646", "value": "T1B06533569489FD75F0DE181E14DF6336A763490BAF2DCFE6B8C807131883AAD326216D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408628, "uuid": "c7bcfeb3-8c7c-4a74-b632-308ce789b1d1", "value": "24576:aqaU0o2N9KX4c2lWaMBbxNnF03nOua6K879v9TQ1L+op/vIj:aqaU0zN8X4c2l1UVF0Va6K8BSB/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408628, "uuid": "98cc9a5f-d622-4a95-a3a5-4b7303fbb8c0", "value": 1441204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408628, "uuid": "f0bb741b-88f1-4599-ab6c-0c55fd0169cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408628, "uuid": "823771c3-00f7-492e-9fd8-aa370fee8ea7", "value": "New Order#84859947.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f530119-5c3a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639416685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416685, "uuid": "96cfe6fe-c39c-4225-86da-f223b8be4609", "comment": "Malware payload", "value": "00e2dfad8760460dbb3f5dee7ccf237d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416685, "uuid": "082f7249-d686-4422-909e-9940becd45ac", "comment": "Malware payload", "value": "b4ca3a0c8a99e48af7f5f31940a9f09e5dc357ceb2869487a867ac02b4a7e397", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416685, "uuid": "332b2b95-8152-462b-8d80-ff92914ac788", "comment": "Malware payload", "value": "4a1b41c5955b38af29c644d2440d34a116ba2ffc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416685, "uuid": "06da47e5-d56d-4e65-93ba-a64d440b1017", "comment": "Malware payload", "value": "106d1f7099a403c707271d5b629a2e8570ea02493e13a626006654a2d12170f5b435ddd70c379330d50f3b62156a470a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416685, "uuid": "25b84850-444d-4b2d-88f9-611d84b8a7b4", "value": "T17E55AE59325549B8C9A7E17CC4938F4AEAB074058370D6DB07B15AAE2F233E21E7F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416685, "uuid": "57d65499-0065-4a82-8e12-c961ab3048ac", "value": "4ca54a6ae85170224dd88abf6fab85e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416685, "uuid": "5ba671e0-f3ec-4671-abb4-c8eb4b608148", "value": "24576:rQBkfVOBDngq2VKveeuisyD3n2sDxCfy3AZeW8aAIL7xyaD8DV6AcE/8zDZb4o:roktOJ8irsyDGvE/8zV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639416685, "uuid": "161fbc1c-99a2-4941-8258-f0302e5d7190", "value": 1400320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639416685, "uuid": "67943019-e9f7-43ce-8fc8-fc8b4dcaa0b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416685, "uuid": "764442c4-497d-4687-9e7d-0647e4d845b6", "value": "00e2dfad8760460dbb3f5dee7ccf237d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4998c6df-5c46-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639421749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421749, "uuid": "3dcbe0e1-c335-4190-8caf-87b7d63cc0b7", "comment": "Malware payload", "value": "dc3f941cf7a73362ce3d5302d1620f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421749, "uuid": "911d5a38-ef4e-49a2-a81e-1599e309aeb8", "comment": "Malware payload", "value": "b507fc72a1c40df38fa193c4571979860a5939b3a28473c64f212564889c98e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421749, "uuid": "fe61d84f-ed21-419e-90d0-f4ca4b98394b", "comment": "Malware payload", "value": "ff5b338132e3c9cbd7623a505dbeaca5fa70b943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421749, "uuid": "e26bdb80-0122-4c0a-8879-affe35644e9a", "comment": "Malware payload", "value": "cd88c4601350a5a166bd9bf340713eb727b1b7eddd9b6485cda72569811a548c2e1e906271bddba5bcd92e35a90a9bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421749, "uuid": "2574d2f3-9b78-4a64-96e0-4475b01cbde6", "value": "T1F2734A5EBE0AE672CD9949338CB3D285073C5F46AD47AB2F7A88B76D2D7220D0911360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421749, "uuid": "7b42ad7f-f735-42e2-acfe-6c10cf6c9563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421749, "uuid": "c76f9ce3-231a-4b31-85a2-6ecd8662808f", "value": "768:wZixtOWXPqMkSuM1zenr6iCLQ1QfddSw:VtOW/qMkmFenraQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639421749, "uuid": "d0485063-4a26-4cc9-864c-2eb89ac6d45b", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639421749, "uuid": "9a63e016-3dd1-4616-a515-40940a60b157", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421749, "uuid": "fa12c732-969c-4e50-aadc-e4e36bbbc821", "value": "dc3f941cf7a73362ce3d5302d1620f8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0705f1b4-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639425932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425932, "uuid": "188f94a3-9042-4c5d-b232-397f11fc1fcf", "comment": "Malware payload (Loki)", "value": "e49fe965fac546dd81864efdb9863399", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425932, "uuid": "08bff4f3-d2db-4daa-a2ed-6eb4ba872937", "comment": "Malware payload (Loki)", "value": "b50d5b8185bfa8534fd19369b3226e1b62c4b5a61dd2cac4ed5f237039556fc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425932, "uuid": "eb5849ad-4343-4b25-8c66-a02ed264e527", "comment": "Malware payload (Loki)", "value": "cc619d5376ae451ed9253c2b3b53fc41b0ee123d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425932, "uuid": "3785e3eb-e901-4ca3-bd6c-9723ec65f921", "comment": "Malware payload (Loki)", "value": "fea80ceed2d3100e21e7e406590d0f31864cd41120c5006433aa9f2caf11952dac5744233ccb78b79632c8daa450c22c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425932, "uuid": "9710a614-2713-46a7-8cd2-7b2fc86a655b", "value": "T1CF352343333C4717D05A0BF80675189997726A086B12E37A8EE6F0FA4E6CF50A615BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425932, "uuid": "ddb71f23-436d-4a2c-be8f-5cf21244970c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425932, "uuid": "7e5ef9ab-9707-4fe5-9289-15251e11b913", "value": "24576:Cig5YoeNNDovg3ZAUuF2Q2vaCuBtDxeDdtUp3Nl1O:Tg5qNNDqgl/0tIDdIl1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425932, "uuid": "2e457b3d-1a82-4dcd-9b77-dbfe959c345e", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425932, "uuid": "7aa7c1ca-40f4-4e7d-974a-aed312dc0561", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425932, "uuid": "65763041-8a8d-471e-8549-e0c5ef77d6e3", "value": "e49fe965fac546dd81864efdb9863399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2759a675-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425986, "uuid": "956cf579-0278-4b0a-a5c9-ccf5f7feab3d", "comment": "Malware payload (RedLineStealer)", "value": "11383857b69bc863d8dbb43c0048c7a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425986, "uuid": "336b92ba-8204-4b7f-86e4-bcf97a378a18", "comment": "Malware payload (RedLineStealer)", "value": "b58eb1e951c25b38be138deb3328745a2ff2c641b88e2988a2b8f40f84ede43a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425986, "uuid": "6d898b7c-1ed6-4d83-8332-be2b7e54a287", "comment": "Malware payload (RedLineStealer)", "value": "19899c498a463471f9716cfa5d9fcf65965a18be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425986, "uuid": "2a64006a-6f6f-49a0-a794-c67ede2fcf45", "comment": "Malware payload (RedLineStealer)", "value": "47e5f575af09989f1ba3c9910646445fc461a3eabc450fedd8b354a7a6ac1412ce7a080cedcbf52320f6cd72259de815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425986, "uuid": "fd7959e3-4d89-46ca-9172-3e24eabc2eba", "value": "T13E149EC175D0C871E7A279318821CBE44E7BF8A2E564554B77783BAF2F322F05A29352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425986, "uuid": "d2af31ce-01ae-4816-813d-8da633b20987", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425986, "uuid": "8a04b31a-5563-4b22-a76a-b0df63c31cfa", "value": "3072:mot0ues/vqnc0umXwSu3v75GohsZVggjcGkNIVqIV9MQmwYIx32:vX/v6c0umX1Tb7ITsqo9r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425986, "uuid": "9d952429-8884-433f-96d2-18002dd0da63", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425986, "uuid": "2ac9018e-834f-49fd-9684-e27c2f10e35e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425986, "uuid": "f2b30936-7c09-4c40-808d-428a305d28fd", "value": "11383857b69bc863d8dbb43c0048c7a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cfea25-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639426090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426090, "uuid": "359ca2fd-004d-4aaa-988e-4ce25955fced", "comment": "Malware payload (RemcosRAT)", "value": "9be307f41e052df503335331a182d0eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426090, "uuid": "38c17965-750e-44ed-9740-ef9d51a200a7", "comment": "Malware payload (RemcosRAT)", "value": "b59a94fa3d43aaa64ce137a035dc166ff2226e9113decc5b24b120f0309a6c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426090, "uuid": "7817a6a8-9123-4abe-9bbe-98cb7864b70a", "comment": "Malware payload (RemcosRAT)", "value": "72fb11a20f5d6c3483aeb7afba2c72398fd91b6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426090, "uuid": "b3073a1a-305c-40a9-a05a-9afe76adf29d", "comment": "Malware payload (RemcosRAT)", "value": "a7249761d110e3cf6f8e941d2633081dd373400d076a09b5d312bceeeb99c8068a674d491ca0944e79486265d0a580d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426090, "uuid": "2ff328f1-6d63-49e0-9a7f-a3d1d7346936", "value": "T1A3F49E13A2A0C437D1722A78EC7B56A49DE5BF402D38E8467FE53D4C4F386A27931297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426090, "uuid": "d81345d3-fdcf-45b1-ab8f-dac9516b3da2", "value": "fa0e7f1e414f64ce479e9b2ae5bbfdde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426090, "uuid": "728593cf-d523-4835-af9a-1bdadba6f4e6", "value": "12288:x3+1u3fSageKokouFWsr1wYs60jHD0dhc1squpMQ:x3+iboodOLf0f0dmmNpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426090, "uuid": "98620876-4a97-4192-a681-f8af7538a4ae", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426090, "uuid": "dc1f4a4d-21c6-42a1-a4b7-273b6a38f232", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426090, "uuid": "081d4980-13f0-4ebb-9d76-aad319138343", "value": "VERG? \u00d6DEME FATURASI 13 ARALIK 2021 PAZARTES?.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8107a45c-5c52-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639426996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426996, "uuid": "9d846691-c614-42b7-9700-c2f202231b53", "comment": "Malware payload", "value": "49b3c1358ddeebe2f8b01150de50e41d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426996, "uuid": "58cf08ba-6220-4ead-beef-0147e30c4119", "comment": "Malware payload", "value": "b5e0c798ab50e980da7913863a372892d4580a51ad0cb371c152ba993d70dcdd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426996, "uuid": "ad2e2c93-7e9c-464f-9688-3865e0bbb27e", "comment": "Malware payload", "value": "6feac2a54407fa37ab45f5aedd917d56602ca9ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426996, "uuid": "3dcaded5-9b32-4f0c-b458-6b5f7e098e91", "comment": "Malware payload", "value": "bab541a52e970b92f356b16239bb808be300155fb32c6a0ccf3e411c7608941665b6725c4ec641e9c1ef19944ed73adc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426996, "uuid": "78936fd9-7c08-46a1-93f9-d578ae2b0d4f", "value": "T15155072BDE92D1CDD3040AF19B329677DE35FA2CD0229763AFCA0FA46C51B11A8BD550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426996, "uuid": "cd698701-2dc6-4008-8607-45919604188e", "value": "3072:rsnbkYos14XklkXyUfjel5TgVP22N+2I1Rmj2mQMR1vTVf:6314XoUfilRyZj2mQMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426996, "uuid": "3e960a1e-c57b-48e6-bf94-40a1731227b0", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426996, "uuid": "0f60eb45-d2ad-4558-a126-533985287ce4", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426996, "uuid": "9fe4a5d4-545c-4b3d-9c48-f7cb9277bd5d", "value": "Stolen_Images_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86699b75-5c61-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433447, "uuid": "895643fb-6d20-4a7e-896d-52df6e2af691", "comment": "Malware payload", "value": "45136bfc4106d64ec76eb5a780fbb3a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433447, "uuid": "18f2395e-8728-41e7-9262-0440fd877284", "comment": "Malware payload", "value": "b79eba80851c27f7eb480be38bd3b6c574e3a5f7f980092db6d9a4c86667949c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433447, "uuid": "e0c89023-31bb-45c2-ae4a-298586a42329", "comment": "Malware payload", "value": "eb28c76135a14d1a1c2312bd1b8d9e912bff9252", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433447, "uuid": "b4f3234e-9237-4c02-aef7-f007df833b87", "comment": "Malware payload", "value": "f36cf2ef1bbf5a9fe041ddddd890e7091396c55332a6fdd1c7f72337a90ee07fc9c776fc5ce1b1ac8e4b6b856dd3f89d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433447, "uuid": "f620931e-2815-48d6-83c6-7f416f48a8a6", "value": "T15455129963A08915E86F637994B5C230C3357E117926D30E6AE83EEF7E73B80C905793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433447, "uuid": "ed8a7ae0-0084-4d7d-a945-cdc92a8307cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433447, "uuid": "c7d188f1-398e-4a7e-b447-431c2727d36e", "value": "24576:Nc9Y9YCaMiWXEsQzhberWvK80y5MwMSrxbyi2T6XdOHtEge:O9yfaMiW0sQzhSrN80UfxNOyge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433447, "uuid": "8a993e7c-2e01-4062-9033-f9c82dbf4ed7", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433447, "uuid": "762e8397-60c6-40c7-b2c3-e044582d7ad8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433447, "uuid": "8c5dd26a-e61e-4815-95f2-435c56dd74cb", "value": "SCANNED EXPORT DOCUMENTS_ASSE COMPANY FILE DOCX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9f2c71-5c51-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639426725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426725, "uuid": "f45f3c31-78d1-4154-a8fb-0ebc653672f7", "comment": "Malware payload", "value": "bd8a1ba3556221c105087262321114d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426725, "uuid": "fd735e06-3691-474b-b56d-a0748e20fb77", "comment": "Malware payload", "value": "b7a6d7f4d15e42eb71836dc7372f48654462c7752d015513232346f0af92f81e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426725, "uuid": "9ccd56c8-f063-454b-b035-193a1a07c8bf", "comment": "Malware payload", "value": "ef49cd974cf09508d3b86c9fdc48ce33f1a5aeed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426725, "uuid": "39e7b0a2-4e79-4df9-aa7c-c846c053ad3d", "comment": "Malware payload", "value": "159c8bbb9cb50d44a7708dd2363b4d778d33169a548e241e1a8420a1f89406ae0d1eff9b19594539ab8ad5438df5e540", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426725, "uuid": "886b228b-5137-443e-91f4-9b4e6b4b4c2c", "value": "T17A159DF2F3909932C16A1B79CC9767A869357F512A84E84B1AF92D4C0F36751F1360E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426725, "uuid": "830ace3c-04b5-49ae-8887-25404b7bec2f", "value": "af8e28172abd75abb781940a16f30334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426725, "uuid": "5f78c2f5-8c6f-4510-a34d-2e38da6ab936", "value": "12288:MPsoiI7FQUmu07nG0qaCbHuYd7yIh5+72Ht0l0v4VMnUip/sl6tOOikh:/o9Kf7nG0ubHuYom5+7/c4VSpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426725, "uuid": "74f756a3-906a-47fb-a64d-478468852749", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426725, "uuid": "3c77c816-2874-4453-8960-101558562854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426725, "uuid": "5220a696-963f-4481-bf4d-8947d018658e", "value": "bd8a1ba3556221c105087262321114d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9e94a7-5c15-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400653, "uuid": "8d6a4a69-7c45-479b-814c-575396a413bb", "comment": "Malware payload (Mirai)", "value": "61aa7fcad359f4956593a9d9e7e712bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400653, "uuid": "313c9b9e-738d-4dac-88b2-f14f78ac985c", "comment": "Malware payload (Mirai)", "value": "b9993bb8bf187e6979efb0a75b38c827e528678e249ed7143a3f597f616e8532", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400653, "uuid": "a7c84b4c-a362-49e3-ac4c-2b00636ba91f", "comment": "Malware payload (Mirai)", "value": "87db9ad8ec6798ecbe568b4d32ff360e886411e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400653, "uuid": "57d87e44-f9f0-4bcc-b8a4-4b8289e4cc18", "comment": "Malware payload (Mirai)", "value": "872aee9810be6c19850d634b72461f3abc2cdf45db4e6881abe96c3dba81171e4ed9ea5b21b116e2dcbb11458b0c4470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400653, "uuid": "a2bb7300-47fd-4f49-a750-007c21d63f12", "value": "T1F7F2E1AAC5105A80CBBFBF6682E5A7D177A48BC7B577E792C2883F55600702399632C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400653, "uuid": "d3b0290f-845a-42cb-83e5-f4d93bd14b4b", "value": "768:/iv7KYuM8EEPyGhBA6Eqz4zYbUgXOcyjVRLAz/vX4uVcqgw0RKWXI:HM8VyZsyXgXOHjVRkjX4u+qgw0UWXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400653, "uuid": "bfc0bf87-ecfd-40e4-bf3c-ab87d3e8cd8c", "value": 36208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400653, "uuid": "dbc84963-cef4-4f01-8ff5-c133a7d6acb3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400653, "uuid": "005904af-dcbc-458e-aba9-e391b5db767c", "value": "61aa7fcad359f4956593a9d9e7e712bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787c7228-5c33-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639413667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413667, "uuid": "54266e88-ff4f-4d1d-9914-bee76f14ce2c", "comment": "Malware payload (Quakbot)", "value": "2ed78132f033a1753b123ea2787c3bfd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama144", "colour": "#BD1EE2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413667, "uuid": "09faf902-0688-4b95-97c6-80e839cbaf4f", "comment": "Malware payload (Quakbot)", "value": "b9c526c7a9110bb1b9c0e8a69e2d85634d745f11376f6ef415cb4ae936539517", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama144", "colour": "#BD1EE2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413667, "uuid": "714c089a-fc4a-49bf-9d21-6c6a899779e1", "comment": "Malware payload (Quakbot)", "value": "68fc872f9593aad5df5956761ab1f6aea5ffa0ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama144", "colour": "#BD1EE2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413667, "uuid": "b67d4bd2-cbc3-4c71-b991-b14bee896b3b", "comment": "Malware payload (Quakbot)", "value": "305de75a6fec7199f613cc4140271e8a4076ce6d21972579d7716f502fa9564b76ae11f45b0e1ee615f2371909005cd7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama144", "colour": "#BD1EE2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413667, "uuid": "2e6bc365-5146-462d-b667-7738e74ccc09", "value": "T101F49F22B2F14477C1B32A3D9C7B52A594297E113E38AC4E77E41D4C4F392917A392AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413667, "uuid": "05f10004-d177-4de7-b9f4-31ebf6032e01", "value": "c967abd8a4b2caed74d57814c5fadb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413667, "uuid": "a427d382-cb93-4af0-9d01-9389632fdc67", "value": "12288:p03XYpmWl+zDTCWxLgXUlId1AMK++U4wvpAHXQDf6bChL/NrKpM:WnnvNxUVIaIHYf6bw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413667, "uuid": "567f8524-c45c-49e1-a80e-94989db8bc3d", "value": 782256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413667, "uuid": "bea2361b-06ac-41bd-94fc-602bbaa6fa7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413667, "uuid": "2a90578b-f552-4363-a36e-7807a3f791e0", "value": "b9c526c7a9110bb1b9c0e8a69e2d85634d745f11376f6ef415cb4ae936539517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7cf351-5c5f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639432657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432657, "uuid": "3ccb5008-7f22-47fb-8609-2ae5cbeff9ea", "comment": "Malware payload", "value": "3e2881e591904f85336d7e37f781f7c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432657, "uuid": "d6586be9-1837-488b-b409-56e82911a847", "comment": "Malware payload", "value": "ba01a2cb78c39adf8042c658ac9c193a663e7f3311864763dd2b8ba400a93249", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432657, "uuid": "e016d049-449e-4897-a7c5-0c8f1c520fa4", "comment": "Malware payload", "value": "3c729b379ebbe02683a88d6b3846188616388818", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432657, "uuid": "4ea4c40f-e233-4991-add6-d6b6c3e05444", "comment": "Malware payload", "value": "394968bd28b15e39fcfa12c71e24d3cd5906931193bbe597c6b4bd81eaac8fd63af05d320dc270786af7f4c68b1fbd7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432657, "uuid": "7c66cbe5-b30e-4a93-862a-3710636d85e3", "value": "T10CB4B0D1F05FE94AFA5E46712E189932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432657, "uuid": "daf28233-e1cc-42b4-bbde-f372be3c6679", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432657, "uuid": "e4c1e43e-9ac7-43ce-91b4-b59a8cf0d0a0", "value": "6144:ZKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:Z9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432657, "uuid": "7f671ee2-8aa1-436a-b08d-76cf1e3bc2c0", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432657, "uuid": "56c66090-bc5f-4bb3-acbb-8e8ac73556de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432657, "uuid": "25370652-3258-4e7c-a2f3-e00a485fe36b", "value": "3e2881e591904f85336d7e37f781f7c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b6382d-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426069, "uuid": "04d88c46-2a01-44b2-bae4-9488106b5656", "comment": "Malware payload (RedLineStealer)", "value": "a94c04956aeba72deaded575f6d5a766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426069, "uuid": "208e5ed3-6da2-40b4-90dd-a9907966aa87", "comment": "Malware payload (RedLineStealer)", "value": "ba91af8bf0dda872436bbe08b15ba8f9ba2971d619da3e88f2556304eafa24f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426069, "uuid": "34119950-fa04-4cb2-8fbe-04c46b9dcb7b", "comment": "Malware payload (RedLineStealer)", "value": "e7f1a2bfa14f882706d4d9038efc5f8395248c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426069, "uuid": "befb0164-416c-4e00-bb9c-3552391c3eb9", "comment": "Malware payload (RedLineStealer)", "value": "2884fbe80da4cccbe5b9cb6185d083eb1006680cce94d1f7eb56ac3e6d477ba4f1c9515d7b150124dc96dfa98109743d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426069, "uuid": "9da0c7ba-307c-4cd7-9a48-a1e3d295f236", "value": "T18C74E0C1B6E0C832C6A2793158338BD44E3BB852ED60954B77783B9E6F726D19E21317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426069, "uuid": "462dcb03-dc4f-488d-aa64-92bb2e3d1b4a", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426069, "uuid": "4dee3440-de60-4bd4-8e27-4f9a800ad520", "value": "6144:z9bc8Kol7zeRTMDcLX51JfY5krRb7ITsqx5N:pbcQl/4jTkk57S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426069, "uuid": "432eef21-3801-4424-bfa2-4815ecb880f4", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426069, "uuid": "db191e22-da2f-484b-9b72-c1c1adb86be2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426069, "uuid": "c2b916ef-4751-468b-9f75-baf77a8167ff", "value": "a94c04956aeba72deaded575f6d5a766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d2ae90-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407839, "uuid": "cc228d1e-b935-49a6-9e36-94647ae77e27", "comment": "Malware payload (SnakeKeylogger)", "value": "6f4fe4e8379284923b3cbb28eb7b0ef4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407839, "uuid": "6474710c-4c9a-44b7-9391-afc142e78353", "comment": "Malware payload (SnakeKeylogger)", "value": "bb3cc194757915ce2b346b1a3082214d77a02e54ad33190824cc7c25125bd932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407839, "uuid": "8aed86c2-d7bf-4c93-88d5-6aead6643d6f", "comment": "Malware payload (SnakeKeylogger)", "value": "660fe1edcb908371e6432c56b2e92de8da8d502d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407839, "uuid": "b0cd8d9d-a7ff-4a31-a25d-e8c25f1bc746", "comment": "Malware payload (SnakeKeylogger)", "value": "84561411efcdfbf80988a24e13f83559aa0b93eeb976aef86051d22e1c033799cd36eb104cc030232b30039e09ea06d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407839, "uuid": "f4468eca-9342-4fd6-b568-3018d3681399", "value": "T14944F16AA2EA73E5C57F6F39FE67D3000639B8443CABD52F231040E641632615787B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407839, "uuid": "a73fd5e6-13b6-4784-9f23-09ebe95e4187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407839, "uuid": "52a6f57e-4713-48cb-82bc-169d638be32f", "value": "6144:SLrtvJ/xaxxMFQnPkwManwJF99pG6HEeYcmGr:epFxEuFQnPkwMSwJFbU6HEJor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407839, "uuid": "e1288bcd-f319-4aea-847d-6198dfcf3e62", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407839, "uuid": "3bfc16e8-5150-4ca5-b801-a2e1d1e77615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407839, "uuid": "f309ff22-4454-4a50-b5e7-b9e32e696a45", "value": "400000000000000000876543456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66e548c-5c48-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639422790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422790, "uuid": "2d8a4895-97ff-4edd-b753-b4f66c34969b", "comment": "Malware payload", "value": "8b22323e8a0b8bf647766c2343edc45b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422790, "uuid": "cfbeb886-3f00-4a7b-95ae-2f52749d81bc", "comment": "Malware payload", "value": "bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422790, "uuid": "34f13d58-0c53-4c1b-b85e-4e331e9644f4", "comment": "Malware payload", "value": "8843599ba312e4842ca139157fe48aed18d7696b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422790, "uuid": "2f7ed429-5cb9-4561-bb72-06affec933f8", "comment": "Malware payload", "value": "b4141b28f03964e3f3772122f1c7f9c58508ddcee332017efd2a64ffdcd552b49a433be39ce3fee304a2650ed5a42586", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422790, "uuid": "5295e763-9662-450f-b160-6c2de78fed2d", "value": "T192B4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422790, "uuid": "5f0c3831-9f70-4000-a205-15120ec6b073", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422790, "uuid": "e9cc32c1-7a2b-43fb-8f28-09c646516bd0", "value": "6144:zKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:z9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639422790, "uuid": "59f3d089-252e-4bd8-bf99-14d160936b33", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639422790, "uuid": "e72bdca8-30ab-43f2-832a-7ac3969c5381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422790, "uuid": "b4e11fa0-2de8-4bda-af89-6f3b8cbef20e", "value": "8b22323e8a0b8bf647766c2343edc45b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4761ffc-5bf5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639387219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387219, "uuid": "3e046fb3-76c2-4e1d-b65d-6341c4ebb584", "comment": "Malware payload (Formbook)", "value": "d10706812d4958fe71f6bb293501bcfd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387219, "uuid": "d1ea1ea7-0519-4adc-a6c1-7a3b8b563894", "comment": "Malware payload (Formbook)", "value": "bd3e04b2627a9bc8b875322177b830802c396c95f4f705ab41530be0da253d3d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387219, "uuid": "eb0d3829-c298-4e47-9749-a350a4f49ff8", "comment": "Malware payload (Formbook)", "value": "78af16eb2ded4acc52cfd23526e040bb45c2aa31", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387219, "uuid": "8338ff9d-2a0d-4fa1-868b-153779b7df13", "comment": "Malware payload (Formbook)", "value": "ac532695405226f98049e2b007a339def1546e4f40d3f7eb11f3678bfbc7c55431d9752b98134a9b98894b3fd9dfbd89", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387219, "uuid": "1fe13516-28f0-453f-bc43-e46a468b0c44", "value": "T15E4533E69D5F3FB6121553BEE38987807A73C279AE8752B8CB60443F93D5E12342184E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387219, "uuid": "6accf5d8-baa5-4631-be06-bb1cbadbe9ac", "value": "24576:omV9O6B/7bmVo/wmAG0TVfF9uPoaXJI5usz7LibU2HVAaeWla9CMJu8gQHn:8s8ofAHTF/uPfJzC7Gg2HqarliCM3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639387219, "uuid": "f48a9431-f0f9-4654-810c-9d5dc25c48bf", "value": 1224937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639387219, "uuid": "9958df68-7189-4420-90cd-e6cdbec4e2bf", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387219, "uuid": "b841ffbf-70ea-4aa9-bf36-f2be6718240f", "value": "Statement of Account-Invoices Overdue.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8279e1-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639407585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407585, "uuid": "bbb165da-40fa-4b84-b9ca-066d28980c48", "comment": "Malware payload (Formbook)", "value": "3057b7c270b8b36c08de7c6e8e7eb347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407585, "uuid": "5d66aed3-bc6d-419d-b325-6faa5cffcdfe", "comment": "Malware payload (Formbook)", "value": "bd7febfa6643e2189ff7a10305f9ed8cc76d205810721689ca3c6c8b2dd68c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407585, "uuid": "266dc73b-2509-4430-896b-9bc9df0f3458", "comment": "Malware payload (Formbook)", "value": "e4b79d262ef042c1062f3373f94524b7122fad0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407585, "uuid": "5bddd423-5da4-47cd-b014-c2372883d595", "comment": "Malware payload (Formbook)", "value": "2a6a311e1b1aeedd25babb62268cb3514980f3e7155dde415e4dfe6ef37a9685dd32054f2018fbfd54b4ae1721b28c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407585, "uuid": "cb0cf05e-a6d5-4c6f-b3e3-0400a675436c", "value": "T1B3B4345C3E210E6EFD7FC130A6891E48BB921FE75240494B67EB39CFA7AE0165C4D894", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407585, "uuid": "aa8d95b4-4fcb-4b69-aaa4-917fbd81a517", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407585, "uuid": "09602cb4-d7e4-492e-b79e-b5b9e044ecee", "value": "12288:IEcfoHJr6mWGIinlXf7+8lXIEnlCA61hbQ6MVCba4iQgVVfS7wDaTyaoch8UAG+h:kljj8k0IIvME9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407585, "uuid": "2524a5be-ba52-410d-97eb-7e3a3266a2c1", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407585, "uuid": "bde81996-ec75-47bf-bb89-6800e794de69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407585, "uuid": "3f2c500b-b9f0-435f-a00e-e0340475cee8", "value": "3057b7c270b8b36c08de7c6e8e7eb347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e56c31-5c0b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639396433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396433, "uuid": "f985e489-fe56-48c9-834f-ab0145ca0013", "comment": "Malware payload (AveMariaRAT)", "value": "3c78f089d150c66f71ec0987f4735f98", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396433, "uuid": "cf82b121-79a7-476b-8f81-7396414f986e", "comment": "Malware payload (AveMariaRAT)", "value": "bd9685ae1dd6938d43cca6f2b897c9083f006243b673891da76b01c9298a3d98", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396433, "uuid": "31757be7-2d21-40d4-8661-bd8047b2403f", "comment": "Malware payload (AveMariaRAT)", "value": "d9f423e4b93c3b84a0b36aa43fdfa5efbe1881d7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396433, "uuid": "b27e5a72-7351-4a4d-9545-60fa308e401e", "comment": "Malware payload (AveMariaRAT)", "value": "28832c399de3daff04693afe50d4f15f515b14579a25c868132e9d657e42b61c6043cf406e01c1ef2aef1feedc38ed65", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396433, "uuid": "50782a4c-56c1-4ef4-a3d1-a82974fefd7c", "value": "T1BAB401693847B91EE897023FC137AC6683B45D2997C14D7332ED39AB5462BF22417273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396433, "uuid": "f2e62e3a-9499-48c7-816d-5e95752c0ce0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396433, "uuid": "3040b063-c569-4151-8f65-fd70e35732b8", "value": "12288:vp5Rk4T9eTopfw5qlzyvbIRfTYMsoOdwXTdjx84ZLXXHbG:x5R5UILrfRsPwjdq8LXXHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639396433, "uuid": "14fc9967-17c5-429c-91ed-f42f592ea59d", "value": 505678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639396433, "uuid": "6ddb174a-8a69-4d72-b2a0-694c69657d46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396433, "uuid": "69af8bb9-cdb7-46ae-8227-79d6ecb31477", "value": "Transaction Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d9e737-5bf5-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639386960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386960, "uuid": "cfe34e38-4282-488c-ab0b-932bb08c10e2", "comment": "Malware payload (AgentTesla)", "value": "a97addc2c3a59209730d160b0c618a17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386960, "uuid": "5b8d9b0c-ce03-4426-b072-e9b8042cd4a6", "comment": "Malware payload (AgentTesla)", "value": "bed210e24eb758d50ba57a168b84963a22f7e96161bb81d2f859dbc25dbcaa1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386960, "uuid": "7e89ce30-6450-465c-83bd-340f182a1ae7", "comment": "Malware payload (AgentTesla)", "value": "413e6c256e7020e8a2e4b42f577918992c93c107", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386960, "uuid": "f9e7391d-27a8-4125-9efe-7b5bb1c2b098", "comment": "Malware payload (AgentTesla)", "value": "fdfbe551eb788eb8e58ac3180fd003ab8132d297b6ddf63c7484bcc664443a15a75767e4f0dfb190c5969249266aaf73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386960, "uuid": "f9229d6a-1848-4f5b-8ede-7f53970ab85b", "value": "T1D405230DC67AB8BDB642611CCCCAEC1A6B7A0D65121E9C167DE467EFB308F345328535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386960, "uuid": "658c7a70-09b2-4db4-832a-5d6291f84c94", "value": "24576:xQOHqoLDG0y/kcJRDgZkzhnHvtikXvBkD8libP:mOHzvG0yc2gZeRHvTBk0ibP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386960, "uuid": "5fb3e8c6-039b-42d6-a143-138f6b2069f8", "value": 810614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386960, "uuid": "f6d97538-35dc-4a63-ab46-16c02c6a268d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386960, "uuid": "93da04b9-9b27-412f-9ea3-fbc7ecc2165e", "value": "DHLRECEIPT&TRACKING_NUMBER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538c256c-5c46-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639421766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421766, "uuid": "6fe84125-3e75-4cff-99df-bdc219fc0134", "comment": "Malware payload (AgentTesla)", "value": "a3030c1310540e1c430ab18a64cca6e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421766, "uuid": "8596a3f3-b133-4aad-97ee-3e266a070330", "comment": "Malware payload (AgentTesla)", "value": "c03c78f82f01b7d63da5ec6c64b58170d85dc6b4c0cbfe90bf634fffe352ce75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421766, "uuid": "d6e9365f-be6a-4895-aa62-2a13c1ce54f7", "comment": "Malware payload (AgentTesla)", "value": "0c20a9c30487610c655b393cf02324fc056232ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421766, "uuid": "f3708e61-5c54-4385-96c7-b9302926cdf1", "comment": "Malware payload (AgentTesla)", "value": "1a13c648f3c75d1a360ddede4b90e003d7c746abe5225bc271717c56a934b64e8f81e0295adc846cf0a802d726e7ccf4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421766, "uuid": "c263d3e2-b010-41a0-88a5-42dcfd3d3cc3", "value": "T19784EB50912E3D6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421766, "uuid": "2659f6c8-9adf-4d31-ae39-6b73cd4da498", "value": "1536:iIHYJDDDDDDDDlBhTBE24hCkyoGjajt64ploIb7hKfedzFz76mAg5eeVhMDw5wfg:ifDDDDDDDDjI4QdzFtr5RDAw5wfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639421766, "uuid": "480ea8a4-a065-4a2d-a8e0-863a6040901c", "value": 392699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639421766, "uuid": "13e307c2-1b04-4ec3-95ef-fb3645af6fd7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421766, "uuid": "9367c9d7-f48b-4298-a84c-076ef5f77fbc", "value": "PAGO DEL SALDO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da809dad-5c52-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639427146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427146, "uuid": "d0aa49d7-7c58-4536-8163-094f749e5047", "comment": "Malware payload (Loki)", "value": "eee462dcf16aa2c5fbd1c4d49549dda0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427146, "uuid": "e1423829-e708-45d9-9b32-587aef26450c", "comment": "Malware payload (Loki)", "value": "c13e80ad965af2380469299e8b983362a2966d0fc5a50eeefc6dbc221238e051", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427146, "uuid": "648d83cc-21d1-4482-85f7-1b1d103f2329", "comment": "Malware payload (Loki)", "value": "df3f00d0ecd23e33f2d4ee15aad1a1e1db2a8456", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427146, "uuid": "93fd6bda-2d18-4868-8123-51db9284fa4e", "comment": "Malware payload (Loki)", "value": "04f0c9dae22ee9870534c500819114883d437556b059a41fe17f686eb2e844ccef56a83f896f6ae8724028870ae1cbf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427146, "uuid": "ae4cc631-fc9c-4db3-a9ce-b18a626b3997", "value": "T1C6A4234D93C4B7ABE154D9716AB31E65F3FC9AAE0195350B8FE83C78C9B2432A3444A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427146, "uuid": "9cfa15b6-b449-4a26-ba82-18692994b9bd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427146, "uuid": "a987d0e3-6ced-4a5c-9dce-9cb0bb6b79b5", "value": "12288:OmCys8jQ1+LQgAk/EsaMe2AwoOdwVSt20JXmMU4kHFM:wyZNLQgdWiPwct20J2fjHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427146, "uuid": "87011035-e59f-4420-b545-43fd434474cb", "value": 467946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427146, "uuid": "1c73c3e4-a9dc-4fa0-88d7-221d554f972f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427146, "uuid": "bb464095-a17b-4296-aed8-e7846f61b250", "value": "eee462dcf16aa2c5fbd1c4d49549dda0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aa2a4f-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639386792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386792, "uuid": "be4fad66-46a0-469d-81b4-5287d4b734f2", "comment": "Malware payload", "value": "b889f5a9304fd99303b59998b92f6367", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386792, "uuid": "61bcba2a-0670-4ded-87ad-53ef070c27f7", "comment": "Malware payload", "value": "c15e611acddf8c81f2fb8b4974c1d94cd79ae01c35a36605fc199cbe1119e961", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386792, "uuid": "ef02ac34-e6f8-4cb3-9228-c13596ceef3c", "comment": "Malware payload", "value": "318c7aca62e38fa282d1019bdca1fd8d74fd0c92", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386792, "uuid": "fe18f569-e945-4321-a91b-d1086cb17caa", "comment": "Malware payload", "value": "b1248a3dd8ec55f311c6451eee89feb263426d2946f8a3c1f485a09cba9d99a74b91ec6844ec496bebdaea168c8ca621", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386792, "uuid": "f3ccb796-c6a9-4810-8000-76a3ab079e27", "value": "T13294230D6274CDB9FA460404959D1E781D213F8138A4A34E2AE1B189DBEACB1FDF27DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386792, "uuid": "4eae5346-bcb8-4594-bd57-0462eef305c9", "value": "6144:hkkkc7EdmXivqZbXnR0zbFshgr1kvH/IinythD1m5ExpOVwDp6m/JmeTmgdgroA:hkkkFY0qZbGdshi1kfwiytn3uw8YT/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386792, "uuid": "00f26cb1-d56e-4437-90bb-6f493a907e54", "value": 416824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386792, "uuid": "d0b0e954-d1e4-4708-b2a4-a77b4e139082", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386792, "uuid": "dcf416a2-c2aa-4d0b-867d-2c6916af7afb", "value": "new order 00041221.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc20c6f2-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355799, "uuid": "9cf3b126-c8ba-4151-bc2e-3feb113d5a8b", "comment": "Malware payload (RedLineStealer)", "value": "910a7ced3185fa4436daa5a9ff9ddd6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355799, "uuid": "d7d92c9a-8b71-4efd-baa6-c537f638776e", "comment": "Malware payload (RedLineStealer)", "value": "c1bbf0118dae9a0413e03c6b4096bb1697fcb9e42c51331dff78ae26f25b0757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355799, "uuid": "c959a25a-f194-4b04-8080-651f976771b4", "comment": "Malware payload (RedLineStealer)", "value": "00cc2c35643a01d4249b1919ec0c1de0cf3ef707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355799, "uuid": "ec2fc49b-ee32-4e03-8428-a432c36e722d", "comment": "Malware payload (RedLineStealer)", "value": "2d9d93640a822c1189c96887fffb71f7c4b1a9621342dbafd6e4ba446fd4d749c49e64c237ebaf32309d6c35e021074f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355799, "uuid": "609e013d-0f1c-49ed-9ddc-796452527f15", "value": "T192B33A6037D89A08E6FF0E747CB1501883F1F5532412E75F6EC554EE2E72B81AA52AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355799, "uuid": "d42e1784-2745-4c05-81a0-de734f02378d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355799, "uuid": "91139b89-b91a-4f1d-af82-32c68c1f50f9", "value": "1536:0WZ7SnbKhhCE+HmzBFe9rf4WmdgkiB/DR6HEk9GbZAKGm0j1YbnUf9i00Z:0WZ2nbK7CTHmLe9baJi97C9K8of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355799, "uuid": "f7482713-f5de-4aa3-b22b-0732fee2a9ac", "value": 107768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355799, "uuid": "59ec9985-895c-4398-b13e-096123622dd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355799, "uuid": "dd534452-875c-43e9-ba03-e5002de5aff8", "value": "SecuriteInfo.com.Trojan.Siggen16.711.9054.2833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb03f95c-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355824, "uuid": "3fbf1c79-9988-4076-8d6e-721889ad0f1b", "comment": "Malware payload (RedLineStealer)", "value": "9df60f0b84e96e73615a654d31332d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355824, "uuid": "32554b17-eaf5-452c-bcbe-2b27d183dce4", "comment": "Malware payload (RedLineStealer)", "value": "c1f2e60965b0155b4d30544d808f9a975d179df4c5d6ec3386ddc8ca261371f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355824, "uuid": "af908f3d-37c2-4ae7-9307-68b8dee8c98e", "comment": "Malware payload (RedLineStealer)", "value": "921fcadcf41e55f84344c4c49f18cea9b728f065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355824, "uuid": "63ffbad4-0749-4757-819f-1ae1a476e0b7", "comment": "Malware payload (RedLineStealer)", "value": "6d85f98024eea22201f2092143ecad40c4acd6647998321e6ab4634f24f4a9c6990cda835ced837c7e953a1c13d9b316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355824, "uuid": "70b780fe-6e50-4bda-9844-f155479b0531", "value": "T1CA35DF24E551A91AEDC700FBDBFFCAECE41D98618B4C30C750A867AA517A1E1FD33942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355824, "uuid": "44e7c48c-40d6-4c00-b94f-ea81ea92414f", "value": "568d713f44826fc56eab6ff2ac0e9629", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355824, "uuid": "d206a18b-2986-4ced-8afd-7450cd3f5557", "value": "12288:pXDsxumTCbANWuuKN9CwV3int6yTzzIIuK/k8k8k8kgr:pIxBCbANWnE9CwV3it6gzII8FFFgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355824, "uuid": "e4f29882-4961-4516-ada6-3aa95159481f", "value": 1067453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355824, "uuid": "e2ade605-27ff-4c5f-8131-7946a806c43a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355824, "uuid": "ddc95c2a-cde8-402d-aa4a-a6278d1163d2", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.8335.2086.5299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f20fab4-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426026, "uuid": "07426da6-9beb-47a6-a174-f76246c8eb06", "comment": "Malware payload (RedLineStealer)", "value": "f7ad098646f18c89bb8ef0f00fd2353e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426026, "uuid": "a27325cd-3dcc-4ae4-8be4-0ddc8f5cfa82", "comment": "Malware payload (RedLineStealer)", "value": "c2e4aa8f1dfd484773003664c1e5331d9175828c62911e6ba29931d3a9c3e43a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426026, "uuid": "6bd55957-9bc5-4fd3-a773-ca34d52a388e", "comment": "Malware payload (RedLineStealer)", "value": "04ed233eb731433b9a1cb4d7ccf60921d84d8c44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426026, "uuid": "7a55751c-3a94-44bd-88a4-e0fa63994e48", "comment": "Malware payload (RedLineStealer)", "value": "f73f64888a4223815afdc6b33dbe7c2c20291d2760e32ff29be8df35efcd8e177f464406b8e80a0592453cff6cc88f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426026, "uuid": "109b14f4-6300-43b6-a21d-b46fc46040e9", "value": "T17F64E0C135B0CA72D1A2793498778AAC1E3BF952D620864B77783B6F3F727C05522366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426026, "uuid": "7a6c3677-127e-4294-b5d8-2b6264f12d61", "value": "da86082cd27b859e55ff9843cf87f36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426026, "uuid": "bef2deaa-d0d2-4ac4-94d2-d1003c654f4a", "value": "6144:hWJsdwrPftApwrRFIQaLc+JAHWZtAk8dIOb7ITsqDokuMm:hoVrPftApqRFI4DHC6f7NM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426026, "uuid": "25b0eb3b-41c6-4f40-b9ae-67836bbb6403", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426026, "uuid": "4606aeb0-918c-4ed5-953e-0ca3d4bbf3db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426026, "uuid": "a4449c23-b144-47fb-a4fe-4ad96370ed25", "value": "f7ad098646f18c89bb8ef0f00fd2353e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054911e1-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639408320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408320, "uuid": "1482e818-c22d-4c3f-9221-93ab18556ff0", "comment": "Malware payload (NanoCore)", "value": "1032eaa609fa071985c3fa90669f0e58", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408320, "uuid": "41590d75-0461-45db-8448-4c21bdf8cd03", "comment": "Malware payload (NanoCore)", "value": "c41fd11d73f74efdf7101b01e2ca0150ce00bf28151cc8670f996fecfe9115d0", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408320, "uuid": "79fef4c1-426b-46c7-b56e-205a4d73a84c", "comment": "Malware payload (NanoCore)", "value": "9b48089fc2c7adec8a4bb165aa27035f748cc0e9", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408320, "uuid": "cd48dedf-f625-493c-960f-20d81cb9c573", "comment": "Malware payload (NanoCore)", "value": "c38a98248596f15ddcc8bef35ed23756889f99974a8094a766090b45852e241cf8f1dfb54757102ec323b39e84b92e82", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408320, "uuid": "0bd91e40-3d82-408a-8805-c676f55ac4ec", "value": "T10024120BBF646F17CCA386760E97C15C441AFEAFF4544BD8C0B1B39AE2349808A63B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408320, "uuid": "e0be6647-dfe6-41c0-990d-af2f0aa2561a", "value": "6144:ySYVfXbWVyl4BAFlJ0TLN10ffFgCFmLYwneCTkFc:BYVzWVylY0lJ03N10f9yTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408320, "uuid": "a9351260-f005-4b78-85cb-b658ebb856bd", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408320, "uuid": "959df553-1ebd-489e-a98e-2cecf6996140", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408320, "uuid": "c72dc882-6465-4c6d-a46a-a0c4b515c095", "value": "Telex Release.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d38dde7-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639408038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408038, "uuid": "687e1c3b-4f69-40fd-91ae-6dc6b8f969d7", "comment": "Malware payload (DCRat)", "value": "fe503b34902368387c6c149a65bb3514", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408038, "uuid": "02b41d49-6510-42c1-94e4-b756e0ab5266", "comment": "Malware payload (DCRat)", "value": "c425ff04a3e4e249af5045d96ef9471413312810a088b74f1648f85b5d5113da", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408038, "uuid": "515f7cb3-d4fa-4ca8-b134-8641fdd1ac58", "comment": "Malware payload (DCRat)", "value": "21956d35cb3c47c05439c8e662aba57bada30d52", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408038, "uuid": "f9af20d8-a63d-48c1-bc1c-915472d3fd46", "comment": "Malware payload (DCRat)", "value": "6518dcb771a8a9710a4baa0496238f60768764e964eb9137cf7e873439140fdeee99ba7f676f7c809fc68a8a7efe2130", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408038, "uuid": "2f538f6a-4467-4979-a3ed-1eef140597e8", "value": "T100235C4037E88136F2BD4BB5ACF3E2418675E6676903CA596CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408038, "uuid": "958557ba-2ae2-43d3-9d1c-3f9e4efb61fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408038, "uuid": "b8ca95a8-ea4d-42bc-a0ca-658cc57a7cb8", "value": "768:dOEuILWCKi+DiBtelDSN+iV08YbygeR8BfvEgK/J9lZVc6KN:dOtmBtKDs4zb1Y8BfnkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408038, "uuid": "26dde690-a2ce-47cb-8f3b-f74b71cba41a", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408038, "uuid": "e924705d-bf85-49e1-8b0f-7d3cf8577dd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408038, "uuid": "42302543-b7dc-4edd-8c07-ff91a9b2dba9", "value": "fe503b34902368387c6c149a65bb3514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded42881-5c52-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639427153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427153, "uuid": "ed57f56b-1735-4924-81bd-f3dadf51158e", "comment": "Malware payload", "value": "7cc70457d1d48e4bddc798a8a91e6141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427153, "uuid": "e3b1918f-7c1d-4308-b38c-e1aabbb3de9e", "comment": "Malware payload", "value": "c442dbbdef2dd26dd9dd4548b07e55b999acc73ff90e31624c2cd651c9924019", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427153, "uuid": "6ef9c285-2d80-4bea-bd39-b0b12d231471", "comment": "Malware payload", "value": "ad9c9c929b7f8c491f81bcd8e68cf225c753b20e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427153, "uuid": "de14b6ba-0936-46de-8a85-0e07bcb69d7a", "comment": "Malware payload", "value": "bcd3c463f24fd78439805c53771f72f95a84bf0b00578b1e401a10d18b88d242fa4f8097b1984e509d90cf2a5527bfc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427153, "uuid": "f5702893-6a50-40ea-8811-51363552c1b7", "value": "T12944F12133F18433E0B725355871BB614EBB7EB26934D78B67643A6A9F213C09A74387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427153, "uuid": "475eb33b-c689-4e57-b803-8033f3530b64", "value": "78c8430db0cbfbd938307d41d500bf50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427153, "uuid": "9a6cff60-db3a-4e8e-bb09-5d0d88c730b9", "value": "6144:rjoNpGalNZxWJ7Qh49E/eRHQAKjf6v8XCu15jPXrY:rMDGavZxWmh46GRfKLGi3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427153, "uuid": "b7bd501c-85e3-45b4-ac14-1ee30b3dc811", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427153, "uuid": "e9bf9a30-894b-4f65-9428-89c9f4abcabf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427153, "uuid": "945aecfe-702c-4c10-8ee3-6ae83a2e329d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102174c1-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639425947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425947, "uuid": "bf5558da-fbf8-4e2e-9f93-59bf6b87983b", "comment": "Malware payload (DCRat)", "value": "a2624b8837f85a16c7ad85b3e7d4398f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425947, "uuid": "6474d22a-db6b-4ea6-bafb-4e0b0111760c", "comment": "Malware payload (DCRat)", "value": "c4ea44baed3a46845d2727ae9cea730f746eead4b25799429fb30d1adab10561", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425947, "uuid": "7cf16e19-a644-4590-9fd3-7c9e87a433b9", "comment": "Malware payload (DCRat)", "value": "b5883b5d56990a2b587213a8dec7488824c27cd5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425947, "uuid": "39446155-0039-4358-b222-d97317951ad0", "comment": "Malware payload (DCRat)", "value": "8c7ce724290e772348fa99276dab53b679c2cd5b0dec83a69f077f48aa48e489d8c44b2b2ca3c2aa972182c2dd9f2208", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425947, "uuid": "ff5c0408-0f0a-43f2-a742-b59da75f05ec", "value": "T1C3E58C027E84DD22D1A9163AC9EF405847BCFD016A26CB1B7EAE3B5DE4113A35E0D5CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425947, "uuid": "94f7dbfe-75db-474c-8f81-e11b57786fba", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425947, "uuid": "27d61dcc-38d2-4d6f-9590-d1071be470cc", "value": "49152:8bA3jJ3kHY0aNLIw/wn8yyIbA3jJ3kHY0aNLIw/wn8yy4:8bL4dNLIwon8yyIbL4dNLIwon8yy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425947, "uuid": "a49bca3c-eac7-4ec2-9519-923cd519432c", "value": 3296256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425947, "uuid": "10e67845-245f-4a1e-9fee-00145d1f68c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425947, "uuid": "2d63daf6-830d-4ff2-a17f-b532a04f0f4d", "value": "a2624b8837f85a16c7ad85b3e7d4398f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b411d3-5c47-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639422283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422283, "uuid": "dc745f7a-2ddc-4b9b-afdf-31fac3d22973", "comment": "Malware payload (Formbook)", "value": "146634bc6551dd4b99d47a9f7b6bc6cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422283, "uuid": "fed81f6b-82eb-45c0-9ae6-2b60d84fa81a", "comment": "Malware payload (Formbook)", "value": "c5c6248caa8d0e035434be7fefacaacdc490b1f763917683db5270cfe7d289aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422283, "uuid": "18d88248-ba5b-4775-b049-bc49cc143ef7", "comment": "Malware payload (Formbook)", "value": "e3abdd3c1926a1934369b41b47269ba4697fc4d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639422283, "uuid": "82713253-46c2-49cd-9e07-12bb76f0c546", "comment": "Malware payload (Formbook)", "value": "f7363bdbb8bc3ac4ec882bd59989bd5aa417091ae0f697c1cb2781c35af835a6b611f38d8e2957d372ee677200f0d7d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422283, "uuid": "bb65ac15-2d4b-40de-8252-c1580142d353", "value": "T117552317BAFC9972C1246FF85660522117F8EE4AB416E709CEDE74EA6B923805F016C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422283, "uuid": "d1592a69-a910-4b5d-9633-39ca0edfc7cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422283, "uuid": "1ec7f614-57e3-4f46-bdfd-70359337ff26", "value": "24576:8yC1iKj1UDgcyrjkHJ+MOkHkBD/xDwxgRR5zoYJIbZqGG:81iKjiDg/3kVOW0DZUCzoPFqGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639422283, "uuid": "9fd1abc5-8ceb-4626-8bb3-5d7414c7feb4", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639422283, "uuid": "385227c8-8bb6-4382-b86a-35c784ef67d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639422283, "uuid": "3beddd4c-7e66-4788-93ef-befa6b01049c", "value": "146634bc6551dd4b99d47a9f7b6bc6cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023b92e8-5c07-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639394571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639394571, "uuid": "c163a149-5580-4334-b1d8-df6d0e036227", "comment": "Malware payload (AgentTesla)", "value": "e731a2dbd0c2f4d883a4cb2f0b6c717f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639394571, "uuid": "02f0f8c5-5336-403e-a527-dbc4e2b7baae", "comment": "Malware payload (AgentTesla)", "value": "c699e170823118b10d268b8ca0f09a4fa867a9596bbccff07dfdb80dafe25a06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639394571, "uuid": "39f1c691-05bd-4038-a5d8-049eca4a8802", "comment": "Malware payload (AgentTesla)", "value": "ab2829db5b7ed67e26fab9e4047c2be8d12cd54f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639394571, "uuid": "e018f0d9-1522-4e37-8f73-0e81d315fee2", "comment": "Malware payload (AgentTesla)", "value": "8fe54fcb3227b9851ec4f60c54dae4c3fc5b303a0003b95114e2cfbfb6a771d6ff6186323ce4083f5769f5740d42c724", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639394571, "uuid": "30272305-7f35-4092-9eaf-2ded3a7266a2", "value": "T15255330663F88BD2E53A06F921515AE023F24C051310F6ED5ECFB2D125A5BD6DB92BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639394571, "uuid": "e50b39a3-d8ba-4246-8f3c-85c0759c8345", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639394571, "uuid": "855fec51-ea03-4702-be12-10b150a2cca2", "value": "24576:+yW98iENID7Y6GGN6IJT4Epj0LTD3TXwpWWbqveRDgARXnAUw77ZChju1:vUD7LXN6IJTxj0DDkMeR8A943ME1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639394571, "uuid": "7d964779-fc91-491e-ad33-6c39bf477c20", "value": 1323520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639394571, "uuid": "08e3fe83-d816-43da-88d8-9f1d82facce5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639394571, "uuid": "3ebab04e-292f-443a-bbdf-c201e654bd81", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e6d184-5bf7-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639388114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388114, "uuid": "c5e5f67c-bbc5-4de0-a2a2-a6656fb6ba87", "comment": "Malware payload (AgentTesla)", "value": "3bdbc5a8c4065b749a4c2c185fc07c88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388114, "uuid": "f25aa2d4-12d5-46b3-877c-5f727031b251", "comment": "Malware payload (AgentTesla)", "value": "c770f7698a5cc4a28f25e5b2dbd7bf072b7fc1673d8c15d17e7f923861a15998", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388114, "uuid": "99d5cd03-f1b0-4f7e-ae95-a0d590c975be", "comment": "Malware payload (AgentTesla)", "value": "fb2a62f28fc3115ce029a23fe5a0e7e236b738e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388114, "uuid": "16c7f32f-5bf7-4288-a9e4-6da63fa01390", "comment": "Malware payload (AgentTesla)", "value": "11960f2261e94438e12ab2f67de50da2a2dfeee5640e43a7fc60667bbb352b6736f04698fca28f0a5eb1b749f834f55a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388114, "uuid": "25ef3dc8-f8bd-46a8-b869-3e5e76ca0c64", "value": "T19B5533D62AB14613E67D8FFA0AC16982C3F695045131FF1A8DD972E5743A38143A0BEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388114, "uuid": "8f8af014-dbed-46ce-9839-64300fcfbe73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388114, "uuid": "d2d044a7-7afa-4768-ae54-9d666ef57938", "value": "24576:mBATBR8XSgkcSd1mOVZ3h+R44WmlJLs62Alq9BWO6OFq2KOt9remz0BnKhB4DX:1NReSzdNZV4Wg8A4eOFWi9qnKD4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388114, "uuid": "bc9d5abb-77e7-4501-a15b-659742f4a894", "value": 1336832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388114, "uuid": "dca27649-74cf-492a-9e9f-9cb220040377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388114, "uuid": "b668a3d0-ef78-4a92-bc9a-a8b02986aa72", "value": "NEW_PO#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5772fecf-5c46-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639421772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421772, "uuid": "34ac2624-4cb5-477a-998f-18ca04cb0753", "comment": "Malware payload (RemcosRAT)", "value": "118224e6dd2a2b5c3fdb5af7115b315a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421772, "uuid": "9bef5312-e646-436b-b734-ea9ce4380506", "comment": "Malware payload (RemcosRAT)", "value": "c78a1ef10324fee5e8f829ac91fbf159e5d5f59db0b99ba424e17a0ca79fbd15", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421772, "uuid": "d5a92dd2-bc86-4610-b574-fac5ce62de2e", "comment": "Malware payload (RemcosRAT)", "value": "e0076331af4c32a460fae0413dff2b371025649a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639421772, "uuid": "681f4809-8507-48bd-969a-589d0cf8083c", "comment": "Malware payload (RemcosRAT)", "value": "a53dd0ddd186192bc5a64333d504b9032293104456073975dfae4392dc4de65b6aff970275337115072ae17cb906ab88", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421772, "uuid": "a9707f3b-9b7b-415d-a123-6589a5037d94", "value": "T19A92C49CD06B02C84F8667B86B1B2F85004DB66CF749AA73723C977557E2C7AA41393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421772, "uuid": "f42269fb-7f76-481c-99c0-cf3165280ce6", "value": "384:R+PZBfGx18CCGIJDrKNGhKTCzM0R6klyAfbgthEfGhDOjq:RK+xCNKCKyCksEMthEfGhCjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639421772, "uuid": "a85edcbe-d1c7-4942-8562-be2f6f354313", "value": 19773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639421772, "uuid": "ecc7c29a-83b8-455b-bfa3-a044244458a8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639421772, "uuid": "1643740e-66e0-4330-af13-ce2077b58426", "value": "PURCHASE ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecdc214-5bcc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639369252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369252, "uuid": "21a7bf0c-e234-4cf1-88e1-b0dafa28de11", "comment": "Malware payload (Mirai)", "value": "a700bd609ec4594a11dfaf019282d19d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369252, "uuid": "01ec31d5-444f-4286-9355-dc1130e49cb2", "comment": "Malware payload (Mirai)", "value": "c840fc906f5f01852c56a31ae77117a52864fdad789e33af73ef074827dbe329", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369252, "uuid": "ebf3bfd7-d209-4d0f-812a-cdab5c1c4a57", "comment": "Malware payload (Mirai)", "value": "0c78ae6f4b24287edce23f64d68085cf5f79cecd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369252, "uuid": "e2d55630-9ed8-4b23-b491-b639789026b4", "comment": "Malware payload (Mirai)", "value": "63145b7286b4d85b947330c1d63b829c834cf2d3510a227f3537ceef5b4580d518f0920f8b7701052d0a29baa17be49e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369252, "uuid": "9b46c862-c44e-451f-8366-4b3f5cf28638", "value": "T15FB2C0FD45005DECCEBBD13D8B9413E03EAA0D77A422AD1EE541BE0DAD845962C4B5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369252, "uuid": "fbdd2a89-6077-46ba-ac7a-d10506843819", "value": "384:7b34k2kJrd/aTsR2aj1IaTGC0OfEqZMQqU2oXzQjjVUZyO/MfXdpdIy8JgGlzDpA:P34yuT/7aTGqMQrjsj4xIdgy8JgGlzDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639369252, "uuid": "756d3d15-6ef2-4e35-8a86-8b374cc78310", "value": 24048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639369252, "uuid": "856571c4-96b1-42f2-96e0-459177893a4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369252, "uuid": "94036aa1-12a8-47a4-8780-d66d2d51946e", "value": "a700bd609ec4594a11dfaf019282d19d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934f246d-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639426168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426168, "uuid": "eb3628a5-8f5d-43ae-97b0-e6fe5c53c932", "comment": "Malware payload (IcedID)", "value": "180f8bc18b25973e29776cd653defda1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426168, "uuid": "9919d2c1-f693-48f1-b064-b5c236540cb0", "comment": "Malware payload (IcedID)", "value": "c9182fc89f598f5a1aef2facbc771b80655d1e60dbdeeaf37cf57d88c09ac842", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426168, "uuid": "8858ce84-46d0-4232-8be6-0643ab318fa1", "comment": "Malware payload (IcedID)", "value": "cf6ff187a5cb875539012b9332800902360b5c5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426168, "uuid": "09eb971e-1092-493e-956a-8d5a8f0b8313", "comment": "Malware payload (IcedID)", "value": "816291d42565d016a80b15d335163606fbc22344bd7cf8a9dc17e182d5953f70eb4d743985bbdbf620ae3daab7d10e00", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426168, "uuid": "e2880cb1-f9ac-4f75-87e1-27920fbcb6b6", "value": "T135549E57F29610B9E067C17CC6535A22BBF67C510B21EEFF1264A2362E277D05A3DB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426168, "uuid": "20129bad-3861-4fab-9fc9-7cd5731630cc", "value": "250afdf6e481982814b553e7d757233c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426168, "uuid": "9151487e-3246-473c-8a64-02b91b0528b7", "value": "6144:oUSk9kO71LPAo2hfmtDjev2TznE4DLTOJzBJf44zqywdCF:qk9kOZLP02CufBDLTCvTjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426168, "uuid": "754f618c-69a6-4c5f-b9d4-90b62e86415a", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426168, "uuid": "9796c2e8-5320-4088-af41-74f3514f6017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426168, "uuid": "1d591fbd-0b3a-4db7-a570-d8ae6c6bf0e0", "value": "cf6ff187a5cb875539012b9332800902360b5c5c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98bde21-5c57-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639429238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429238, "uuid": "a13d6b00-b2d0-4be8-81ae-c6218f6be113", "comment": "Malware payload", "value": "459c713901e0429ec2617f224df949df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429238, "uuid": "7b0d7448-5e9f-4182-bbf2-85d94bc98f6b", "comment": "Malware payload", "value": "c93073bdd03e0b2771da3997ba7fe5aff86edf2c682d70b5be4bd3d2d30ee5b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429238, "uuid": "6131d472-a39a-4b74-8423-34dc8649d835", "comment": "Malware payload", "value": "1166f2fdabc2b053926c3fcdce56a6de33e3de4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639429238, "uuid": "3710f28a-f043-45de-a3c4-ca2ad61ec4fc", "comment": "Malware payload", "value": "881c7c9818f552598a26f6960b338a12691a8654ac2c9e1b2ab92e92f210288f99906a9e14d5a8409ebeb212e8c199c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429238, "uuid": "c335a4e6-38af-4d4f-b2d6-d906329b8a78", "value": "T1BDB4B0D1F05FE94AFA5F46712E189932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429238, "uuid": "e69ed69b-9d65-4491-820c-00963fa4813d", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429238, "uuid": "d83e29c7-349a-4db5-873f-3dd0edf95ca2", "value": "6144:HKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:H9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639429238, "uuid": "e3161862-3977-419a-b00b-4db9c61532aa", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639429238, "uuid": "6efd7ba2-128b-493c-8b4b-3d712554a17b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639429238, "uuid": "214c08c3-be99-45e9-b186-fcd69624dc87", "value": "459c713901e0429ec2617f224df949df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11dbe6e7-5c0f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639398033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639398033, "uuid": "1a51bec6-ef8a-4850-833f-9ce84451e8bf", "comment": "Malware payload (AgentTesla)", "value": "b08d66158212b38d70bbbc380ef0ea27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639398033, "uuid": "0a4026ad-c625-426d-82bb-d6efc0039741", "comment": "Malware payload (AgentTesla)", "value": "c97bc7f2679b74ba4e17173ef49d88e900f2e0c3570cdeee81c29997c26c1f24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639398033, "uuid": "1141b953-1361-4706-8288-b6876b7463b5", "comment": "Malware payload (AgentTesla)", "value": "2afdd4f9133f27dfb6a6536938e04d5423e538fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639398033, "uuid": "de70b7b1-d16b-4950-82de-3a0f114f1f42", "comment": "Malware payload (AgentTesla)", "value": "8091627d0311094ef15647d200383d244deeea9c5eea62ea658c5f8fa7b47c0124083797d00cb8c0d1a34af1d26dab46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639398033, "uuid": "498dde43-f988-49ba-86b1-0228324dda96", "value": "T105B4238764E16437E59154F40831D379EBBBD83827A928CB5BD09F1BBBF1BA18203395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639398033, "uuid": "886d5114-d46a-418a-9cb9-1f963547c671", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639398033, "uuid": "3d56212c-db83-4a44-a0f8-fcff4c280d36", "value": "6144:rGiuu2mueZLrl1p5egEDZDbfpCp5csB3bky09YvDgkK+8O+fvcYI2Gg5DN0/bWSJ:Se5l7lE1D7pMcUjgsgvc+GGkSSqYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639398033, "uuid": "244fa520-ced9-4da0-9672-f5f7c19ed98a", "value": 522119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639398033, "uuid": "ef9d4793-aca7-4f83-8e13-83900e876b4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639398033, "uuid": "fec0282d-d39f-4f93-8709-9e21797b1ddd", "value": "Bank Fund Transfer8300006139 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8d9459-5c18-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639402291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402291, "uuid": "33fb49f0-4e1c-40bf-bb1e-c32e2419d89a", "comment": "Malware payload (AgentTesla)", "value": "32671506107dfb43ab011c240c4ccd49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402291, "uuid": "2f0bc695-9149-4e28-95ca-4a0b034ab599", "comment": "Malware payload (AgentTesla)", "value": "c9b1104a86f46ff95c669ac6a80470fb1881aaa61fb84ef67c9db32d33b5d3fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402291, "uuid": "13e0a7ef-22db-4c6e-a4ca-93cb2de2c89f", "comment": "Malware payload (AgentTesla)", "value": "709e88191aec5a320ad3ef255aca8a68cc5f46f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402291, "uuid": "7d595a9b-ea6c-4575-8ab6-91ad6899ce8e", "comment": "Malware payload (AgentTesla)", "value": "bb7596eabb82bb6a78923a7bcdaccfb052362be9b25acc4acfe387dca24023c6b90eb854c926e0fabd28ec044e7ae98e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402291, "uuid": "60290b2d-afdb-4b69-b472-0655671566c1", "value": "T1E635235C25EC6317D6728BB10A101610D3796A691330E8783EDE79FD6273B33DA82D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402291, "uuid": "7a07bd49-4227-48dc-9683-aa58a5ff0865", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402291, "uuid": "1ddfc2c2-b704-4b58-b8da-c7f5179c121d", "value": "12288:WJ70Ajbn01uhAcnQvez6LbytWx/sBw2FZbe1lQTbi27qi4wDNuBfZkorJywe:WJ4AMuAcQv/LbyUxE7v61lcWXiLNYXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639402291, "uuid": "cf63f332-5fb1-4e9b-95f7-8bec22f3bfd8", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639402291, "uuid": "c9396b0b-7bd3-4f5c-9bce-437a045f90d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402291, "uuid": "ac7f0848-04ed-4c85-ae0c-bf3fabcad2b5", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155733f2-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639425956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425956, "uuid": "0c6b2beb-7ac6-434b-8b76-2081b17b5b4b", "comment": "Malware payload (Loki)", "value": "123d0e3003afc564153a3d41a0b81a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425956, "uuid": "108bb99d-080d-4b74-a661-2d997525ad1f", "comment": "Malware payload (Loki)", "value": "ca118b1754f9ee3ceb3fb1fc40be5ae9f28ee8bc3731b02ab420a90142c72f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425956, "uuid": "4dc5cea0-cac5-4e51-847b-9aa849acf03f", "comment": "Malware payload (Loki)", "value": "7e208c038d5f730a8f743dc26c07229c1edd2be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425956, "uuid": "6ac4fa8c-47ae-4211-9efa-c3e705e88489", "comment": "Malware payload (Loki)", "value": "d003a9cc1d7f0815f06b34b6fc56f89c8553de040d66440b826000b8958aeb48032421f776236dcc94690dbba883f7ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425956, "uuid": "cdbb9481-36a3-45e3-86bd-74ca702e6c91", "value": "T120D4AC5573714B45C8726E30E0250E1E6E1A7F6C2CBE713EA66CFA54E27F68314A8DC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425956, "uuid": "ef8051d2-bb26-44ae-ad34-0bdf862db72f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425956, "uuid": "6113efb9-ea28-4281-aaa9-9cefe24c1aef", "value": "12288:lnZ0Pj57XC2gxdGMd4l4pBhCzIzmWTKCB14LJYclk8qdbp:H0P4dDdm4pBUIzm6KCPYJllk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425956, "uuid": "e2a1c6b7-1b7f-4bc8-9ef2-837bb0a34bae", "value": 650173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425956, "uuid": "586cedc4-053e-4eca-b590-647c648bd49d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425956, "uuid": "eada18e6-1171-4a6a-a3ba-67e2ae60648a", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd67bc3-5c2a-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639409755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639409755, "uuid": "3ea1e14f-75a7-415b-9d9f-db4c6eb37eb0", "comment": "Malware payload (CoinMiner)", "value": "aa490d623ce35534b4b5cd6f73d7c7df", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639409755, "uuid": "21aad65a-d60a-4656-8130-f44aa4421ef6", "comment": "Malware payload (CoinMiner)", "value": "cb3e7a8aa992a9161844025266cc333567e192ef73bb4590c95ef0994d7456f6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639409755, "uuid": "8f5c3232-4d2d-44d5-a67f-3505e032633b", "comment": "Malware payload (CoinMiner)", "value": "3fca5c6c55e9fce384b35544f6a7d17ca003a2eb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639409755, "uuid": "6bace1e7-536e-4e84-b0f2-6fb4995434dd", "comment": "Malware payload (CoinMiner)", "value": "e73d96991b892a3dcf818a8a9fd660f79ca84b540a7f6a5649f297c7ebe45f55a31affde7f07bd43b182f4597617dce0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639409755, "uuid": "021fb8bd-0e11-421d-9c80-6789694c5c24", "value": "T154B533652691AD52C449D771DBA0E03984ABFD4198806337BFEFFC273C731A2D8EA056", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639409755, "uuid": "af2100f8-a590-4554-8fb1-ee005c1cd92e", "value": "c0a448f9c8cf5bcde437d0f1a57fac6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639409755, "uuid": "48fac270-b4ab-465b-950f-0186c041c432", "value": "49152:FzlVC5lXadYdXTYNe5NsCTdJtrxxyUTH2JaZDke2dgeX:PVC58KzsYDtPbb2QhkvdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639409755, "uuid": "6ecbed90-654f-4453-b458-7a3404f02fea", "value": 2454045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639409755, "uuid": "ffaa0a8a-4d4f-4573-b339-021964b86e41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639409755, "uuid": "4040bbe2-3a75-43d9-95ab-ce9c0a89e641", "value": "SecuriteInfo.com.W32.AIDetect.malware1.9284.10163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117bf8f9-5bcc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639369256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369256, "uuid": "7611352a-b3c8-4ae1-9a56-dbe760d875ee", "comment": "Malware payload (Mirai)", "value": "3697329f3349a427ead82cf9dbd7ec6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369256, "uuid": "ce7bf529-1547-4eb1-9386-1963fa2600a0", "comment": "Malware payload (Mirai)", "value": "cebb6b1333c12dff480f8290821a0abc346a279098cb189b48adbe28a5f715c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369256, "uuid": "a9a7d05d-da22-4316-9981-1a93b40fd1c4", "comment": "Malware payload (Mirai)", "value": "753557957c43a08ff3e49e7fb7d5e57a765e08bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369256, "uuid": "0be596d1-96f5-4fd2-84aa-2e75f982c25c", "comment": "Malware payload (Mirai)", "value": "3a40f9cdb6e417e2e1c81835d52366780636d12f6ceb2a274a70e169fae217b5f9e5e28759a5b65ac22b655eb9e94005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369256, "uuid": "1b0620a9-99ea-4cd4-b932-c0198288e9f5", "value": "T119333BC6F800BD7CF56BE3BB8623490DB930A25491920B27B7B7FDD76C311A85A16D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369256, "uuid": "166ddb55-9ee8-48f0-8d86-0660ec192fd4", "value": "768:i/eTp2hZh4abfCMa0fiz2dv7lOtFn/v6FNSENPdeEjzcIC8mTachR:iuq4jMGKh4B/vXENPdfzcr8Uay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639369256, "uuid": "ebe46189-0c8e-42cc-8791-6235fcfa16e0", "value": 51472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639369256, "uuid": "968e35f1-3ca1-40f0-af66-a61c613c0a28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369256, "uuid": "d48757c3-d095-4049-807f-cbde8d00744b", "value": "3697329f3349a427ead82cf9dbd7ec6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94e618c-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639415574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415574, "uuid": "6e79acba-d49e-4508-a4e9-43738be9c0e9", "comment": "Malware payload (Loki)", "value": "47ec99c2cf9e8662bf186066228ad6fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415574, "uuid": "cff29b63-5dee-45f4-857c-f71b0b4f27c5", "comment": "Malware payload (Loki)", "value": "ced602b3c1506b507074aa67d7c92afff240d0a02bb1142868ee09b78ae3b7d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415574, "uuid": "38265950-7465-4011-8cd0-8addea9337f4", "comment": "Malware payload (Loki)", "value": "fcd3082762ca17dd5a67114328b635ecae0fa628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415574, "uuid": "c6396d3a-652d-4f3e-96c0-98ad0c977c0b", "comment": "Malware payload (Loki)", "value": "623bb2f7807e8fffae7cbadc98bf74243b9c2c20f0f77f1edc53852d299a06bdea644e48fff14c88924c54c069e53fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415574, "uuid": "513a7294-c0ec-4e4d-beb4-993dd7eca5e7", "value": "T1832501DD725032EFC857C876CFA82CA4EA65747B975F5107A42312A9EA0C887DF250F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415574, "uuid": "eecd5bf4-e48d-4e98-826e-dae80962c1e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415574, "uuid": "74d1bcd1-70aa-45bb-9724-e559b0a86769", "value": "24576:ThoUzHG2KcovYSXCFTtwHAkMnLaS07lCSdRM65sFA5T:TvzmZvYS4TtoAkMLslCeRVua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415574, "uuid": "b72e2bfa-d00a-4f28-9a2c-d963980f5519", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415574, "uuid": "c28075fb-e6de-47b4-91bf-b28205160bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415574, "uuid": "3537c0ac-e178-40d0-aff0-fc5f6f3a4510", "value": "47ec99c2cf9e8662bf186066228ad6fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1859e82a-5c0a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639395896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395896, "uuid": "0bd0088a-e1dd-4cb2-a10d-1e4e5cd08891", "comment": "Malware payload (Formbook)", "value": "293e6f24948e741030ca61bdbbe0994b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395896, "uuid": "ae682064-8360-4665-8aa2-cf458966f54f", "comment": "Malware payload (Formbook)", "value": "cf58d4385f81f977c243864573bafc608d6665611ad5c3c3dfa3fb5f33ec8a5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395896, "uuid": "83279130-f1cc-418e-824d-e73578da80df", "comment": "Malware payload (Formbook)", "value": "b7fdac77f3c9dfb3faf196419cd76db436d8117f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395896, "uuid": "d76aff26-68fc-4595-abb0-cbc8f7199ff9", "comment": "Malware payload (Formbook)", "value": "da5b18a4439d1fec188b56feb82a559feb9538e565e896044142ab224e4dc9cdc3aaffffadc3ec593a49f01f0d4a5bcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395896, "uuid": "a0abe1f2-a2d3-4734-97f1-233aceb6371f", "value": "T1FFA4230BA5EAE673C0B1447E03FB6118DAF5C0689639165377B80EECEB3132D95C6786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395896, "uuid": "71d82b33-4221-4602-90e5-531f9a40f635", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395896, "uuid": "b4b5955d-53a4-46e1-b613-e4fc81942706", "value": "12288:H07mUbN9xNw4P/eEDyvkXFVXwk5HWVDHNemmRuNu:H0t9/wqg8Vdt8V7NcIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395896, "uuid": "3a683a61-c7a4-453a-bfd4-816f8c345327", "value": 470795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395896, "uuid": "af0f1366-f6c2-4a9b-b3ce-8e35d274fb73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395896, "uuid": "bb8ffe5f-a02d-4729-b023-3e69d448311d", "value": "293e6f24948e741030ca61bdbbe0994b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7777d787-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639388325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388325, "uuid": "e316fece-7736-4590-8bae-54bc7dda070b", "comment": "Malware payload (Formbook)", "value": "38f475aae6898cbfc7d3dbb59d0d4993", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388325, "uuid": "5a5fe3e0-db0b-45ef-a358-8315df547bca", "comment": "Malware payload (Formbook)", "value": "cfa58b9e04c7eef75086919738866f0d4029de3466b1bfa259467c273b30fc49", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388325, "uuid": "330a1c1e-513a-455c-9fab-467449abb5cd", "comment": "Malware payload (Formbook)", "value": "32c628854c6ac78ff8a7abb2da8dcc99366369a3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388325, "uuid": "d2c3a632-7779-4d72-b4fc-3f3084722b43", "comment": "Malware payload (Formbook)", "value": "bbda34f6be9f9db230f40ec52c1faac52025c5bfe064151578a485a1f543a31847ddc294a6a81ba6b7c84d151275c04b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388325, "uuid": "0eda034a-d914-4487-8442-011fb13df43b", "value": "T15245331D9EDD5E167B2648235E997832E143FCB1586D25EE3B3FC3492180363CA63B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388325, "uuid": "8f589da2-100c-4689-87f0-dfd4c6ebbad4", "value": "24576:8UZssk8ZJ7IPGJDbPBeCHmAAIvALDhImMrcjVpC8/3cN4XpwNfkD702Zw5:Pk8tb3HmL6s7/3DpwFkvny5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388325, "uuid": "45cf7661-8c2c-4913-97b3-d23f059089af", "value": 1254074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388325, "uuid": "f47f4983-9686-4b26-b673-21c1c45e04d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388325, "uuid": "02dfe5c4-f78d-4a49-9f9f-b9bebec144bc", "value": "20211213024914214.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262dc2f5-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (DarkComet)", "timestamp": 1639413959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413959, "uuid": "638db093-c597-4258-8e4c-467cfdcf6e32", "comment": "Malware payload (DarkComet)", "value": "652e641f77e5b08925c7fe346345da8f", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413959, "uuid": "2f8fac57-0496-45e3-8b08-e7040d4004fc", "comment": "Malware payload (DarkComet)", "value": "d0a8468dfbafda6ac1a013bd391f81c806f59ce4af63dc1875c4362a4e5ae1d4", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413959, "uuid": "93b8da6d-9e34-4917-9a39-b3fd0f456f12", "comment": "Malware payload (DarkComet)", "value": "f3a74f0fea9c688e0ad0a946b16a5aa702a057eb", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413959, "uuid": "91e8b6bd-47d6-4614-91d3-40c4424baf1f", "comment": "Malware payload (DarkComet)", "value": "ab6a0dd6cadc5fbab9bd58febecd46d929e67797aa445451cd4af5398c0aba753a4c35417e1d8475335e65da1162efcd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413959, "uuid": "c5523bef-b6f6-49ff-b4f1-86984fb04749", "value": "T14EF45B21B5808833C52239F99C5A92F5942A7E202E29794776F53F4C7E39183FD262DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413959, "uuid": "84cbe0e6-3b38-4a12-93ee-48146dfa9973", "value": "8033c11f8a2fdfc317e8655120579933", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413959, "uuid": "2b77755f-1a2f-40e4-b92a-d7bc230f03d1", "value": "12288:Q9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFXvvNVRO:0iBIGkbxqEcjsWiDxguehC2SCvzRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413959, "uuid": "16aa4042-ccf0-4078-af05-c8a85c57554b", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413959, "uuid": "da36e384-bd47-47bc-a20c-bf06bd0fec04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413959, "uuid": "c85f1836-6593-4b41-875e-83681e9c0e8b", "value": "652e641f77e5b08925c7fe346345da8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0ac328-5bad-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355933, "uuid": "6aaf327d-f963-4332-99a5-9df07f7b105b", "comment": "Malware payload (RedLineStealer)", "value": "3cd2c9691d69e4d603b6e4d9454f2668", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355933, "uuid": "e08b2be0-df0f-4085-9888-52fbe52d2379", "comment": "Malware payload (RedLineStealer)", "value": "d0ed9f821877fa4df18b92aba1497bc789614e2eecbb6f40694032fa43034b84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355933, "uuid": "865ad32c-d006-4c70-82ec-c5e62874e2c1", "comment": "Malware payload (RedLineStealer)", "value": "5436bc850e1ecde62342b29b8fb6b9096907161a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355933, "uuid": "f579a6c4-38d8-4f5e-9de0-34c9ea20e32d", "comment": "Malware payload (RedLineStealer)", "value": "68a8d154041a38383d8bbb2f62ae1fe74438431c9edc20864969765741550592d279fc257244adfb3c078cb426379038", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355933, "uuid": "d6d30005-a6b9-4a61-bba2-a7e0f4c90c22", "value": "T17715BA1B26D29295E946277645F3AB809FE551D9C3BB03D89334E9F04AFC2E21F00F69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355933, "uuid": "04cdf153-f3bd-439f-871e-b1a7504b2a66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355933, "uuid": "9f55978e-693d-4aaa-be2c-6aa4af52737c", "value": "12288:bzB4D0eZpMqaSbCI94UYjLZkR9fZ0GUNM+oI:qhtR10XZqLmNLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355933, "uuid": "7b7d11b0-0cac-4a84-a87f-713ecb2df86c", "value": 891784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355933, "uuid": "dedfcd4a-add7-4919-be0c-09ba43b06405", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355933, "uuid": "81724307-c258-4a33-b77f-200c3a65c0d6", "value": "3cd2c9691d69e4d603b6e4d9454f2668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f0f99e-5bf3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639386039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386039, "uuid": "8efc5913-fa01-44ef-a8ff-e5bf8cd409ec", "comment": "Malware payload (Formbook)", "value": "d59b10675f34c9725bad740d861d83c5", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386039, "uuid": "a11de90f-5931-4f94-9727-5afa1bd2eacd", "comment": "Malware payload (Formbook)", "value": "d12c264102a42c65f256f4b4387031c6444c6958934acbb13b335567bc3735a0", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386039, "uuid": "91892526-a88e-4dc9-927d-8800edcd71a5", "comment": "Malware payload (Formbook)", "value": "16aede0762fb5feeba39ee04316d410297c8d3ae", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386039, "uuid": "6ce98e2e-612e-4c3b-aa6c-a12ac3a1c97c", "comment": "Malware payload (Formbook)", "value": "9e43584d60c40a69ea9727e143a4372e907cad6760a86d02c38577922d697954c20ff4875eae4af310fb32afa9e7700b", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386039, "uuid": "8bab137d-894e-4208-9746-0e2390a51fc0", "value": "T10215339E38257928C6C55E2311F26738EB4A4A1F073C5F7DA81822AD5257F3C8F61BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386039, "uuid": "fe988c17-1823-4f59-aa40-1a6e1ed2fb90", "value": "24576:+/+ABQv78drHbOsoHQPR+rYyMqLHFCdUmwJD74YCJ:+/3BQvIdr7OsoH6+sylLHFCA3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386039, "uuid": "38b45af0-b7ab-4798-bca0-71b96a0c0f30", "value": 916334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386039, "uuid": "efe963a1-2f47-421e-aa0a-a07b1ceab0d0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386039, "uuid": "6ff7e173-b902-48fb-b57e-ea4235928416", "value": "Courtesy Request Letter on 12DEC.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5101455-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386818, "uuid": "7cf5f646-1b2b-4fba-98eb-66b3aaa103ee", "comment": "Malware payload (Mirai)", "value": "e8532824adc5062adffd19bc202657e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386818, "uuid": "80c9ec1a-092c-4f67-87b2-33be30119c77", "comment": "Malware payload (Mirai)", "value": "d1606aa4a005d5a32713d3f6408fd9e340c0b04d154e875a4a6b2751225043ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386818, "uuid": "4b40b3e2-b6b5-4c69-b866-54d9bc7c9754", "comment": "Malware payload (Mirai)", "value": "d409155ba66fc24fe7b5a26429ff88b05bacaab1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386818, "uuid": "8804ec9b-7696-49e8-b9df-3714dc870204", "comment": "Malware payload (Mirai)", "value": "c5bc461f8fc9bf952c95818ad825939996cfe03ccc48841f930d5c98e40447eefadf597ae00f7de729f560d3ce85fd58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386818, "uuid": "cd32f089-35a2-43c8-8e40-e89548febaf4", "value": "T1B0A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386818, "uuid": "40420f3b-4126-4f87-93a8-6ff2e948ed8b", "value": "3072:VSx+i6mqaObhNGnPNKV+qKmZuqQ4DPwXXtse:y6mRObnGnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386818, "uuid": "4a3637ea-97db-4ecf-90a4-263729ed7cde", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386818, "uuid": "5e225a39-f569-4ca5-b355-ef7df9a31ff7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386818, "uuid": "19ceb37a-9e7f-42b5-a1cd-0c54b09aa3e5", "value": "e8532824adc5062adffd19bc202657e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc0997d-5c08-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639395097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395097, "uuid": "dfb7b9b6-edfc-45da-86ea-6cac767af055", "comment": "Malware payload (AveMariaRAT)", "value": "230d1914e610ff1d4b57a4399efb88b6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395097, "uuid": "c8de080c-b72b-48b6-bfbc-00592976278c", "comment": "Malware payload (AveMariaRAT)", "value": "d161e738a48936ff92c1c1ff0286e9284a8935f71fc556dd84d6623074fb0af5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395097, "uuid": "61d08010-8016-4b59-9f55-0aef2a87cd23", "comment": "Malware payload (AveMariaRAT)", "value": "1ceb2b99edf398c68e6a086da85aa25e939ef6bc", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639395097, "uuid": "309b320d-f2cf-4aa9-835a-243415e1e335", "comment": "Malware payload (AveMariaRAT)", "value": "62f64bf76a9146bdba4775e89116a04dbacbd4c73b8ef511e7f7831a7c36163f395b519dacc056aa43b86cb6ea763e31", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395097, "uuid": "7ec83c95-e4f0-4fc9-905d-c7ca11b40ced", "value": "T1DA453332DA2891F7C514E10DB8C8FCEB89AFD5FBE911773479C699C624B24B4B51C228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395097, "uuid": "c668cd62-83df-445c-b444-c3082c43e3b8", "value": "24576:rVATwlGEndKH4s03ETJTU53V4tb+igxeZHrBQds+N/SuxFBx+fXl6rhg:rEw4owH4slTJGl49xgeZLmd/ZBYlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639395097, "uuid": "6a0b239f-5f1b-4daf-8170-c286b1b1fb5f", "value": 1190817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639395097, "uuid": "90f577ee-b0d1-4682-9c54-56108b9e40e1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639395097, "uuid": "08a93183-97d8-405b-a0d8-fd3e0441aeea", "value": "Payment AdvicePDF.7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0722220c-5bcc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639369239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369239, "uuid": "6fd242e9-d860-4524-8845-2b9769f121b7", "comment": "Malware payload (Mirai)", "value": "4c4a257dc8085cfb7e4980a1c474121b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369239, "uuid": "046d2c9d-e483-4a41-b250-9d5e24dd2131", "comment": "Malware payload (Mirai)", "value": "d413e9ea40755576b182ee618bc32fafad5ba2f7252ab547263fcfd96b8168fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369239, "uuid": "cdb1b4a3-cc46-4200-83ac-e965f0217f74", "comment": "Malware payload (Mirai)", "value": "95159254b62cdd38342e0d59ef530c4df268e5f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639369239, "uuid": "c18ccc17-30d9-4301-b90d-8602139004a4", "comment": "Malware payload (Mirai)", "value": "aed6e473ae9848a60f34572d9dc72ebb6d77f3e4bd2a5cd1c14fa406c56cf1c3615dcbc8cdbe40792441db271f4d88f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369239, "uuid": "771d059e-67c6-4cff-9b5a-ce667fbe009c", "value": "T1C4A2E15DF56A2E80FF6EAFA3188BC1CEE7A44B4E7780CD81149186159843D2F5F099D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369239, "uuid": "9b6b8ff5-6773-4b13-a203-10032691ae41", "value": "384:c9ICojPedF4jdNjD9w93GlEdwWElWhFOyv3XOeT+LQAfYbTM4uVcqgw05VxJ/:mzehNlwI8wWElWhFOyvH/bQ4uVcqgw0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639369239, "uuid": "1a9b14be-027a-4913-a8eb-b156e570c621", "value": 22232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639369239, "uuid": "57f3e751-6999-49a9-a633-ae9ff9818f15", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639369239, "uuid": "01fcb824-6df9-4485-b379-28e2e6c6644e", "value": "4c4a257dc8085cfb7e4980a1c474121b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ed14aa-5c0b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639396428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396428, "uuid": "e2d71e91-e844-4c73-bec2-18fe8ee0e5fd", "comment": "Malware payload (Guildma)", "value": "09418efcbfc9bc33ddc8ae7dcb036371", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396428, "uuid": "37ccd5bc-8f37-43ec-9805-714cc8140b46", "comment": "Malware payload (Guildma)", "value": "d46a2eee5119d85730f1a3c1f9d91a5dc2da810aad484f147cfdea63e1e948a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396428, "uuid": "4ed62ed7-0410-4d6e-bea6-0b468b2d4555", "comment": "Malware payload (Guildma)", "value": "d23a30400660ef0131df95adec66ffc6735dca07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639396428, "uuid": "ff104dc9-9243-4a21-b5ca-fd4ce46971f8", "comment": "Malware payload (Guildma)", "value": "34fd500cfa58381820292a4b140de549f15dacf231784e8cbed6f3045af009d9d5513b9f6b409838e997a5b44f03665d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396428, "uuid": "be4f321c-bd30-40d2-a61d-8a23f376835e", "value": "T1CAE36A2462E0F6E9D059B7B1EFA6F6AD41152D37382048E79DD63F1A6530B8382D334B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396428, "uuid": "0d55a5d5-ceff-49e2-8a10-b73540361398", "value": "98b6dd560a57b8960045d82e7d77c431", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396428, "uuid": "10bc83f4-fcf0-4ee8-8ee2-a6a6156028a9", "value": "1536:K2zvsCisEFhEiXYWYsp5qwxqspA4d6kq94Nbiz9Oq//:LsXVF/D5Eq64Akq94Nm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639396428, "uuid": "e306607f-c520-4610-8ef6-c86fe2282464", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639396428, "uuid": "d3354fd0-a4a2-4e8f-806b-f7fb542a461d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639396428, "uuid": "5844bfb9-2b88-4811-b0d8-cb6d7a1a1dec", "value": "Pedido de compras Nro. 4500581224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd1da55-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355800, "uuid": "787cc656-3ea1-4881-9b3e-87d7d811c9b8", "comment": "Malware payload (RedLineStealer)", "value": "90216d0750d6e4229dee2123564e957c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355800, "uuid": "955ce479-b924-4024-ba4a-081d0e1324cc", "comment": "Malware payload (RedLineStealer)", "value": "d4b14f425260d95e1f47be359d1c0aa0a6bb74a2ab04d756db4a583c3e64b6a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355800, "uuid": "e6581d1e-adc7-41d6-bfff-c55e5e77b072", "comment": "Malware payload (RedLineStealer)", "value": "e59a4705be090309856b7671441974598cef9f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355800, "uuid": "7f3ba202-7129-4d75-845c-64493c7acc6f", "comment": "Malware payload (RedLineStealer)", "value": "3a527682dde1168e233091d6710f36aef8738c85390485ca7251953ea5480a0d96715bb91b3faf5413b7e3bd34b8a89b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355800, "uuid": "f2dbeb80-ea4d-432e-9d65-887e33127e8d", "value": "T150C4E5283DFB5019F2B3AF759BE875A6DA5FFB633703A45E205003864A13A81DDC1639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355800, "uuid": "c53801d4-e539-41e7-800e-a368f3927ffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355800, "uuid": "c7e07d49-b68a-43f6-b8fd-ae548a429e8e", "value": "12288:HCHG2CZbJild7zYw3sNo4QH4wQ/HZaoRY3UWZN:HMDCZtM4uHik9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355800, "uuid": "100fb1c2-8c6c-43a1-8c17-551bdb7925df", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355800, "uuid": "d80bc9f5-e604-40da-928e-e690dd0397f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355800, "uuid": "3f8476dd-dfeb-46c7-924d-07dee1abca53", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.7997.6857.14113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798caf55-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426124, "uuid": "554c4335-a198-457b-a140-7b1cb156d88b", "comment": "Malware payload (RedLineStealer)", "value": "66f1e447f2a0c2bfe99cf13d4c3f9efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426124, "uuid": "f16aa3ca-d280-4c28-989e-29ed9f3457ac", "comment": "Malware payload (RedLineStealer)", "value": "d4f7af9b6ceec25d9037812dde2945f63883cd0cb056e71da9dba7a5cb797256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426124, "uuid": "6a97a1df-a027-4a35-8fd6-362e7f00b421", "comment": "Malware payload (RedLineStealer)", "value": "7d666a3afe0bd4607b72d5f490ab8fa244e3d519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426124, "uuid": "28e964eb-3e4b-4e19-9080-6485bf8b8b67", "comment": "Malware payload (RedLineStealer)", "value": "9dcfe9f265d6a3ea5cf08722fe81e10dc8722218c1a28810321b4eb232c3aa292a0008eeecdbde58d8db745c52b1ef03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426124, "uuid": "4075778a-efbc-4c3c-a347-620659c1977c", "value": "T17715131FB6E29256ED53077545F3BB408FBA90EA037F43D99314AAE84EF81601F029D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426124, "uuid": "4d0bebbc-0a0e-45fd-9141-8584d756466c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426124, "uuid": "9025845a-2d91-4d7e-85b2-12323ae60e2f", "value": "12288:pjWQ7DpFDK3y6V7mSyiPuTVRvrGwxGjXdM0Q95l:BHj+5jyDT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426124, "uuid": "b9b38326-20b8-44c0-8ae8-ee7f85dd6f99", "value": 894344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426124, "uuid": "4b96a769-cbd7-43bd-a613-2c25fe7c1ed0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426124, "uuid": "27c8bc91-40a4-4ee6-abae-27f1d64691f0", "value": "d4f7af9b6ceec25d9037812dde2945f63883cd0cb056e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8611be3-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639407788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407788, "uuid": "57ada994-8a5e-4ab1-b5e8-7b1c49566df8", "comment": "Malware payload (Gafgyt)", "value": "9153451aae723b41fe248af004d84c7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407788, "uuid": "60e76fd4-b87b-411e-8578-28bc5fb901ab", "comment": "Malware payload (Gafgyt)", "value": "d5392f6c476a01549a91f7f9d89aaa1172cf8e72a1b4e22e43cc79f717979c5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407788, "uuid": "1ad291a9-5d50-4748-b071-eef35057b504", "comment": "Malware payload (Gafgyt)", "value": "38a17f1aca4f11c36a72c77ff610af290600d91f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407788, "uuid": "b7188e85-9bae-4124-a8d6-5574f63b50ee", "comment": "Malware payload (Gafgyt)", "value": "fcb165aa010db3572fcda3b5d617a2cf706bd21c7dbf831c03b43444ac19cf17d60edcd2df925407145615e1fdcb4a05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407788, "uuid": "37a4a260-00e0-4346-9150-6c61630d5ac6", "value": "T10AA309A2F800DFA6F40AEB7604D74B247630FB660F53562673173967AE762D42823F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407788, "uuid": "5efad8fe-1021-41b0-9c6f-08a926068980", "value": "3072:NipaIS0Ax3rT0qTRDAFWxy4B1kGDmU9VqFyOfk/X:NVIS1x3rTlTvy4QGDmU9VqFyOfk/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407788, "uuid": "44e86548-b397-46a6-b816-fc3a40d2125b", "value": 101818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407788, "uuid": "ab8f18cc-44eb-4c6c-a674-c473cc52f8ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407788, "uuid": "3311f12b-19e3-4316-be51-3b0367995c8a", "value": "9153451aae723b41fe248af004d84c7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da09a36c-5bbe-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639363580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639363580, "uuid": "126337f1-7f72-4a18-a159-4aa9720492da", "comment": "Malware payload (Mirai)", "value": "74b19525184942e647e600fc39557bea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639363580, "uuid": "005492d6-8e5a-44ea-91c5-58c664cc0260", "comment": "Malware payload (Mirai)", "value": "d6e9629053dcc25504abde1ebe75508a5ccf394cad42bdbd2fc2df5246995534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639363580, "uuid": "784402b9-7170-4b0a-b2b6-e56f518a1e09", "comment": "Malware payload (Mirai)", "value": "ae768fb88b24fdd726c96626d287ca656691a75a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639363580, "uuid": "6a461dea-129e-41a9-a351-fd15ba374e08", "comment": "Malware payload (Mirai)", "value": "72b03428c1df9bec84bd320d7694a8af2b09ad642ccec73b3a7936cce204915fb2c08fa51a9a76c9dac4fd17424dfe83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639363580, "uuid": "4a8807aa-b7cb-4138-b785-3527af6eb684", "value": "T18913F1E94DF909C3D03DBBB95EA379170835CB88E14084E7218B6A5E29E7F3E150D4A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639363580, "uuid": "e23082b0-4a8b-405f-913b-a1d0ce96c273", "value": "768:zw5Ij+3v+Z6gbRPiqlbg7k/PKbvBwropUGMVJ/mGtI2/w2HC4eYnbcuyD7UHQRj4:zw5I6+VbRDSsQdpcvmtb2iWnouy8HyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639363580, "uuid": "78bc4f14-bdba-49cc-86d4-e12e59650ad1", "value": 44068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639363580, "uuid": "aab5aeb1-f25a-4ca8-9fa8-86a47714e143", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639363580, "uuid": "3b655f08-e548-4a52-8ead-18edf9df59a8", "value": "74b19525184942e647e600fc39557bea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff836dc-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407747, "uuid": "c867384b-aa4b-4f81-a518-32234314fe9a", "comment": "Malware payload (SnakeKeylogger)", "value": "526e21169b86f12235f37a9e397cdcae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407747, "uuid": "b071907e-8229-4694-8c69-af9df59da05e", "comment": "Malware payload (SnakeKeylogger)", "value": "d81211cc17362b9e2678dc80dc2875fa846ddbee660a8d796ed89494e84154ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407747, "uuid": "8f178fe5-afe7-4383-85ad-c45956b24a18", "comment": "Malware payload (SnakeKeylogger)", "value": "e2c87df6a6e31a951c581e84f626bf3e88fab17b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407747, "uuid": "6967d612-cd21-4d1b-bdd9-2f05be29e410", "comment": "Malware payload (SnakeKeylogger)", "value": "449d32d70330c9fe135d136f1d1e13056aeaf3c099b655771edec3714b137d2320ebe8beb264007028144aadebc21e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407747, "uuid": "8f167db2-05a0-43d3-a8c1-fc220d1c6043", "value": "T15A651283A4045774EE29ABB41A37C93107227D6D7934E42C68FA7D8B3FBEBE25015583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407747, "uuid": "8709be89-31f4-431e-8be4-fa4a5c680868", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407747, "uuid": "5b334b71-6af9-48bb-a26a-a602fea9ebca", "value": "24576:4y6hpUfHmIBl5jmrC/aaTKJubu9AYm4V28904O6KsHWnWfuhhslf:s6HmIBl5KrCya0uqQ4fMmHWVhhsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407747, "uuid": "a616d13a-e559-4100-b56c-979447bfc805", "value": 1461760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407747, "uuid": "1342478e-c883-46a6-ad8f-00435663fcf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407747, "uuid": "92b56a85-f649-499a-b4cf-9c3542785de2", "value": "PO (PO202101129 & PO202101130)..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725e53d2-5bf6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639387458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387458, "uuid": "73fded94-3681-4bce-9355-bd71eb481c72", "comment": "Malware payload (Formbook)", "value": "d9a2cdc328d73b04a1b25753fd1557e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387458, "uuid": "d17df1dc-ff15-4dbb-a0b8-4e4f287b7341", "comment": "Malware payload (Formbook)", "value": "d84e1c6fd94ab8f41d3da2b4c033a41d008596ec22577b7ac5b560f3e6fb95f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387458, "uuid": "b973e663-d49f-48f9-9b10-cd9684e2e812", "comment": "Malware payload (Formbook)", "value": "d6c470e856e8a41305c82f11c05f10d007e640d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387458, "uuid": "2886a748-5936-44fa-a5cf-3027201104ae", "comment": "Malware payload (Formbook)", "value": "878fad9dec5179036de35687377c0f81056d0f56cb12e4bd0f4226af1dd5ec163ecf0542b9802ab305b2affe42bc4a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387458, "uuid": "14baa54b-6154-4db6-b09d-64ec2821561f", "value": "T131A42343B3D5B2E7F1A62DB2493BD475BBFD16C9012528075FB02EC98A45ED302990EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387458, "uuid": "d0fd82e0-f2ca-4fe9-9a82-4dc09a755b18", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387458, "uuid": "d1e1e161-bb61-4abf-aba4-08edb9e28b98", "value": "12288:xMrxjQ56okOFUQ/e0jx9Jy0Y1VsEoOdwWSt20CgHtEz:x4x055UatfJYbsEPwjt20PtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639387458, "uuid": "b52e7915-3efa-4ae4-a695-aa6ff4012fe0", "value": 472104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639387458, "uuid": "c8a267c4-c511-41a2-936d-c6c0e4ee6ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387458, "uuid": "5efb5a49-6125-4fa3-af18-5c48674acc8d", "value": "PI S30C-921111218111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5748dca6-5c61-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433368, "uuid": "539b951b-3de8-44d5-8b45-5eeb5f4585a7", "comment": "Malware payload", "value": "030ab1a282e8eb619f8e2edd1504e32e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433368, "uuid": "d9e21f53-caa5-439a-97d0-778682d49afc", "comment": "Malware payload", "value": "d88ceed41b733547f614837d8b9c3967aefa9a81b8afb869e35657288650ef54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433368, "uuid": "369930b1-99f9-4b53-abb0-db2242fe8bce", "comment": "Malware payload", "value": "e5b49b4260cb1da2cb5b2d4ff507e38ba8925771", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433368, "uuid": "aff0f495-ceae-4001-a439-357601a69945", "comment": "Malware payload", "value": "92025e09ce25d2bb8f55e4a08a7973d263b9b220d1dde9d6daf24190af3ec22036ccaa8ff09e0e68aadb76d5143404ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433368, "uuid": "89053c86-18b5-4e72-9d98-66b68714bb8e", "value": "T1A955231A70A9D926C434A3B996E742D443F81D09B895EB097DCD63DBA0DA3D1CF042EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433368, "uuid": "1699c8f0-6b9a-4109-8e3a-3517b2caca6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433368, "uuid": "cf4c3522-6a34-49b2-93a6-c930ed682202", "value": "24576:yyaiub3VIRRjFta1iLHlTAc/ClTR9pwyvUpRHa/YoZQdqqkUkYbQzyFVP0HxoypE:FM3Wja1ClTHCP9myv0takJkObQz49k/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433368, "uuid": "fdd4be01-8ac4-4f9b-b819-2fcafee2d95a", "value": 1319424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433368, "uuid": "86f80fc5-0117-4eae-9adb-c47eda0d28db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433368, "uuid": "0e005677-e74e-4772-bf60-81c5f527e47d", "value": "030ab1a282e8eb619f8e2edd1504e32e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6a3aec-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639414046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414046, "uuid": "149d8be2-b46c-4002-9256-eb2da662c704", "comment": "Malware payload (njrat)", "value": "cebac35d906c33acfc7cdc600947a698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414046, "uuid": "d2b83a0d-0b4b-4306-b9fc-4f513d57a4f8", "comment": "Malware payload (njrat)", "value": "d8b1f0b39fd78111c2ed94874f825c9d7bac3f9030ba7e32785a2d850675711b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414046, "uuid": "06befdae-8705-4120-ad86-c0ace748e333", "comment": "Malware payload (njrat)", "value": "4ce8583cdc3dbbd77f6a9b5d9b97e06ca924e0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414046, "uuid": "523bdcf3-d146-4780-b582-0b507e30d964", "comment": "Malware payload (njrat)", "value": "0c2a5d14082bcf9f48420f88880c24e57f4707e181bd96d4a1e4ee8885055afa35cacd85dce69ed9a44b145b2933b30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414046, "uuid": "c65257f4-2328-4147-a445-81164b80892d", "value": "T18D032A4D7FE1816CC5FD067B05B2D012077AE04F6E23D90E8EF6649A37636C58B54AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414046, "uuid": "8a3142da-e225-40ae-8a3c-8e56f9237678", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414046, "uuid": "f9ac77f9-ec7e-40a1-ac45-9dac9727eb99", "value": "384:QWwDywgibfjpPu7w9qyMTIvfTSs2EWfCrAF+rMRTyN/0L+EcoinblneHQM3epzXP:w/NN9ZMTIvWVENrM+rMRa8NuPCkTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414046, "uuid": "19e4fa5a-edf8-4dd3-b8f2-f904faad0e81", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414046, "uuid": "b8e552e7-f039-452c-8ee4-39b1c91045f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414046, "uuid": "639e6609-fbc7-4df4-a47a-c5dd2aea9c2b", "value": "cebac35d906c33acfc7cdc600947a698.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7d98ec-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639413967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413967, "uuid": "07a489b6-ecbc-4586-8ecd-f2bf7d721d6d", "comment": "Malware payload (Loki)", "value": "eecc550b71fdddff201840a97d964cec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413967, "uuid": "b75301e0-4f52-4ef7-a8f1-bcb7c0be269b", "comment": "Malware payload (Loki)", "value": "d8bd8cb778625f2bccaf3fa2d274dd77a46ac52206e3324dc98943aa5d0d2036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413967, "uuid": "5937e158-0e28-4cde-9531-84833b39add4", "comment": "Malware payload (Loki)", "value": "0339947339b6a1067b398389fc4a10cac39e256f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413967, "uuid": "aaf4d95b-764b-4f6c-b533-4b0596f0af1b", "comment": "Malware payload (Loki)", "value": "bfdfa100185c794a9147eca82f246b4887c9dd606a5055e44cf86ad55f50ba4f9f3f9ab3968bf85d0c24285a81597067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413967, "uuid": "67e8c09b-b781-42f1-8226-3f6115c3e114", "value": "T15125F024D9AB801CE45736F01F15BC924E6BEE78D0528A1A677EF218493E643CF227DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413967, "uuid": "7d9004c1-eb10-4c41-8297-b02641f751dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413967, "uuid": "34964eb7-27f7-4ff9-be47-7f2736602793", "value": "12288:il55H5jwkPOpf1noDeb9FRG0q1tjd5yitdP0ry1UCyfBAYq9WTu+odhz4Ypm5QPs:i9HP2phoDebsvLLUCyf/ZG0/Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413967, "uuid": "1096a541-095f-4c3d-bced-d0bc9f4517a1", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413967, "uuid": "128472c1-e3bb-4475-a58b-291d3b62db7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413967, "uuid": "2e1daa4b-6457-41f8-b96d-58dc43e8412b", "value": "eecc550b71fdddff201840a97d964cec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fa585a-5bfe-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639391061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391061, "uuid": "137a1ecc-7620-4c17-9c50-27daada7d33a", "comment": "Malware payload (Formbook)", "value": "72a469183defc1977c90ffa9e2f2a3ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391061, "uuid": "bb8e0042-a486-454b-8bf0-b0c3c639529b", "comment": "Malware payload (Formbook)", "value": "d8ef936782d1670be4e6478054eb599c6902660ecd1ce171305b98f362ce513b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391061, "uuid": "40c63284-464f-4acb-af8d-5a6b885283f3", "comment": "Malware payload (Formbook)", "value": "eeeea25ce1f2479183bc80edfa7cbae0fba3da90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391061, "uuid": "4091a254-bbaf-47bf-a381-f24e2d2eef05", "comment": "Malware payload (Formbook)", "value": "bf6bf4869cd26c1719888a93a799e74bd8d72bca99ba0ba13d51abb55ae7e745b03b7fd3b49477734b7142667d6afd2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391061, "uuid": "668e0fd8-e458-4a2d-834b-8aa31b29897c", "value": "T169A423BB72C59CA3DF9ADB720C713EF9D3FA867C035245D393401F760A759928285A80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391061, "uuid": "51826672-a423-4505-8063-e03d19a9bf00", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391061, "uuid": "4c46e172-6fd3-4e9d-9502-588670bd99a1", "value": "12288:M0ZxjImtW8PEIJTJSs8qGsiqkkct2SX6URLRvZ6Yc:M0DjInMEplqGEXSXrlvZxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639391061, "uuid": "f8023783-3a18-4925-b340-4ed77fa155a8", "value": 473770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639391061, "uuid": "50261209-3784-4702-ab2e-4cf86e3dc34f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391061, "uuid": "317af6a9-b0e6-4c9c-b8e6-9cc7900cdcce", "value": "Invoice and Packinglist_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc880e8-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639407797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407797, "uuid": "b8e7f997-39cc-4e5d-b20f-152fd5be29aa", "comment": "Malware payload (Gafgyt)", "value": "70c5aa13e5efc16b7dc733f58c3052da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407797, "uuid": "caa85d72-c6d5-47a0-a500-a93814f98c4a", "comment": "Malware payload (Gafgyt)", "value": "d95e4e7bc25761dc9de9034e486702a20c0f43a8fa0f67bb804ce0899719be95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407797, "uuid": "52dec0f6-761c-4ef3-8e5b-005645a7ed06", "comment": "Malware payload (Gafgyt)", "value": "7c6aeae37de485c80fc836466dbe56a0243ac4b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407797, "uuid": "0a359884-59e0-4002-b5e4-03f53f1ac451", "comment": "Malware payload (Gafgyt)", "value": "f257821e1a93a02412e6d04083692857b207d57d0076ecb2b34def17f6e9619e5c72a72323e469f9dcb5fe3f8f5f2d84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407797, "uuid": "0aa58b54-ddc9-4cb5-a11a-b7191c8c07e7", "value": "T152A31744F8448767C3D327FAE78E439D77351A6457DB33116A39AEB42BC2B982E29130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407797, "uuid": "217db7d1-d31b-4449-868f-983f50da4112", "value": "3072:Plf1jKRi/VYf84YSk7XTRUmpEqQ45vVXY0X:vjdVC7YSk7qmpEqQ45vVXY0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407797, "uuid": "5b7e3f55-8c1c-4e1f-99c2-dc2b8a104174", "value": 105111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407797, "uuid": "ad5f1b1b-2b08-4228-89e2-51e474379a3d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407797, "uuid": "4bb1556f-2ff6-4802-b806-f2bb1019fb81", "value": "70c5aa13e5efc16b7dc733f58c3052da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b34c931-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1639425939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425939, "uuid": "90a0ce7d-08cf-4b77-8c96-df735fbe57a3", "comment": "Malware payload (Pony)", "value": "9de5407c6304f7afb07dbb42ac2dc881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425939, "uuid": "cf4cfb62-893a-4072-bffa-e37ab32d7b4c", "comment": "Malware payload (Pony)", "value": "da6f321c2450f9d1e7e63f619dcd2caf84c65943ff6ce555490294072e36f47c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425939, "uuid": "0fbad41d-cad0-4539-9e39-6b90b3273408", "comment": "Malware payload (Pony)", "value": "54cde0f5abcc3ce9bed6baa7b865bac85e099ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425939, "uuid": "e7833eaf-8a1f-481f-9c33-360ce6dc948d", "comment": "Malware payload (Pony)", "value": "51657731b5e74b33362eabbd69fb483ed87a9351698282434958bebb62a0cb85e9f5a9132c24a6b180732d4d48f35823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425939, "uuid": "4490058c-6ce1-45d1-b4aa-c1a237ae7149", "value": "T11B449ED1F640D589C62A02B68C37E6725153AE694860C33F359D3E2FBAF3BA21057D4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425939, "uuid": "317466cc-ee59-4794-8384-2a33594e1d5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425939, "uuid": "383c8def-ca77-4c04-b0dc-7b5284b2a430", "value": "6144:1FuN96goBmbDiuYbbjYpIJC2uYK89BeS75/GGGesLJQ6R:fhbcifbgke89BfcQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425939, "uuid": "56d17df8-efe1-4a4e-bbed-fdaf0f8991a1", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425939, "uuid": "9d61a55f-f6ae-46bf-9ca2-32c658f3b3dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425939, "uuid": "b2eebee0-2486-4416-9aa2-c6cb54e3c47a", "value": "9de5407c6304f7afb07dbb42ac2dc881.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df781e0-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639408388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408388, "uuid": "40988f35-11d5-40b1-a920-4c0f9aa1d4aa", "comment": "Malware payload (Loki)", "value": "28f8db749518d932a7e77c12e407f5b2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408388, "uuid": "05b36f4d-3dda-41f4-8a3f-229c26754943", "comment": "Malware payload (Loki)", "value": "da9541473d40c7d2402d2d698523b891e2ac76df5c31dbfb7fc1a1276e3ee016", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408388, "uuid": "34813b61-0eea-468a-a60b-28400bfd4e22", "comment": "Malware payload (Loki)", "value": "346493344fdb3d0fb05eb0256b9bb0dcfef08e2d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408388, "uuid": "f8a988a5-cba9-4713-b5c3-73ef12e0949f", "comment": "Malware payload (Loki)", "value": "095d26b998ccc5ebb36a7d30d81b132507abe18dc506dc2902d4d3ad4e4a7d1f3ff8028093a31f835c95f32eddf4f3b0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408388, "uuid": "eea954fb-76d5-4ad9-aded-0b6b2e5f9035", "value": "T1246412CC7E34071BD9526EBA14C28589A633EC68C65423D9473C7BE81D7C9BC91E633A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408388, "uuid": "45e8b2fe-87c9-4705-a42e-53909f1dd60d", "value": "6144:+cDdxrtbhtfa01BuhxXHV8SRCgFh5XlVxkHJgwzwD6bw7IMlNf7XHf+uM:+cjrVhQ0+/53/XlVm2whb8Nbf+uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408388, "uuid": "3371a560-2fa8-4135-a0cb-034fba8f5d5d", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408388, "uuid": "11d92160-62a5-4ec4-9178-9ea2b234d81d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408388, "uuid": "13a7da11-2bd9-4389-a55a-bd1780b982bc", "value": "11535 EX new Ogawa-ogi.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92e1411-5c4b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639424191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639424191, "uuid": "6912ff9d-67f2-43e8-ac3f-5814be4407e0", "comment": "Malware payload", "value": "8ed23dd6505aaa2c6997dcd39249f85a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama144", "colour": "#BD1EE2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639424191, "uuid": "dd13114b-8334-43a0-9aee-9fb9a526e44e", "comment": "Malware payload", "value": "db1bbd9e6958c9003ccdb7d4dd4f44c22f8cbf66c9fc24ca02fb9042919692da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama144", "colour": "#BD1EE2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639424191, "uuid": "fe5d59ea-cc05-4593-b9a4-e229bde7d91e", "comment": "Malware payload", "value": "42964dbb846f72b386e78137e9ec506de68f9be4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama144", "colour": "#BD1EE2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639424191, "uuid": "231fb574-3905-4800-a78b-5daa2b0d42d8", "comment": "Malware payload", "value": "82b24f02285e76bf84212be1d1424394689879e43f41ff13854e6f07f5daafd44bfc52c689d61e5fdf0e28c7209ac2b0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama144", "colour": "#BD1EE2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639424191, "uuid": "fe9b3d30-ce13-4517-a652-4b69c63d6b9f", "value": "T172F49F22B1F14477C1B32A3D9C7B52A594297E113E38AC4E77E41E4C4F392917A392AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639424191, "uuid": "20e68595-7d53-4b5d-8b3b-25cb93abd60c", "value": "c967abd8a4b2caed74d57814c5fadb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639424191, "uuid": "f182243b-f0b8-41db-b452-ffa43e3be9ef", "value": "12288:P03XYpmWl+zDTCWxLgXUlId1AMK++U4wvpAHXQDf7bSR9/NrKpJ:cnnvNxUVIaIHYf7b6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639424191, "uuid": "f7d366bd-7597-473e-857b-bf28eddad3e3", "value": 782256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639424191, "uuid": "80cc382c-0d37-4c0b-90c2-e32aee1026da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639424191, "uuid": "aa21d055-0120-449c-b01d-5db0bd3c9cf5", "value": "44543.6313048611.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25da0f5f-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425984, "uuid": "78eb19b1-beda-459c-8c4b-9a33e9501c78", "comment": "Malware payload (RedLineStealer)", "value": "57ea6dd4e0a62129f5f0a4655049db64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425984, "uuid": "4a824c6b-062e-45d6-b1ab-a8e0402d53cb", "comment": "Malware payload (RedLineStealer)", "value": "db3598189d30abede93bc33948de68d189ba0f119f762e6c28ebf8b4d422edd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425984, "uuid": "1a0c375f-82a1-43ec-ac60-56efb69f2e2c", "comment": "Malware payload (RedLineStealer)", "value": "2d95e2a394a76a7b2ce4ad54038db17e0c84fb00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425984, "uuid": "b5d5171f-95db-4b87-8a58-446c0fcb9bef", "comment": "Malware payload (RedLineStealer)", "value": "f11db786843c3768d2788b7d149dc1a7825aa68e8773835ea592ed9d7f83ea84a644fbf186826f88c2bc52f589cd064f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425984, "uuid": "1ff41751-0285-4e49-a941-4a00870eb844", "value": "T1DD64E0C1B6E0C475C1E27E718861CAE48D7FB851EA30854B37782B9F6F727D09A25352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425984, "uuid": "fb33dfca-346a-4fda-b758-cb42fc31e4e8", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425984, "uuid": "b46943c9-9a49-46a4-8ad6-66e6dc183530", "value": "6144:7h7WQFVWCMlhqK24fLMpDb8tPKIN+5TVd91y3Cb7ITsqPt8R8slz:7Rv8xlhqMf4OPJN+5Z1l7Wt8bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425984, "uuid": "60143806-d699-4e9e-8c20-6bba194ece57", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425984, "uuid": "932918eb-652e-4143-8dfc-cd3da5960a34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425984, "uuid": "9606aae4-8778-4283-bcb2-e8c06493ef94", "value": "57ea6dd4e0a62129f5f0a4655049db64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6447f14-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639355816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355816, "uuid": "b365cb93-edb9-4f94-a58d-54b49077a182", "comment": "Malware payload (Amadey)", "value": "0860dffc01b192be5e8adb54bee016d7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355816, "uuid": "3d2ca13e-9fd9-4c1e-971c-f6898056a94d", "comment": "Malware payload (Amadey)", "value": "db6881120f733df89eb9663852ff94ffd481d7ca8e49e7dcf1dbe553d11f588d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355816, "uuid": "121ebe66-ec7d-4a81-89c5-c8cd30627bc1", "comment": "Malware payload (Amadey)", "value": "7387d18fb90cfc280354e317ab0704f4d1c475e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355816, "uuid": "58e65ad2-7d1d-4421-94f1-dd403e0d7be8", "comment": "Malware payload (Amadey)", "value": "969f4941fe23991d009745b55dc3b9f51267d0e0c8fe6c92f202c23978549d5a65bdcd97bc2297f66d86c86648d8bdf4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355816, "uuid": "43e4748a-ec09-435f-8d5a-97a365784aca", "value": "T14444D0D176A1AC76C59339714CF0DBA45E7BB822E670814B33B817AE5F722D06A3D312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355816, "uuid": "3ce16166-1665-4143-8344-2ed795b98b56", "value": "06f6b6bb4c21be4bcc66385867e5427f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355816, "uuid": "b2852846-7c92-4c72-942c-ba081a59eb9b", "value": "6144:OH4kNCMcaWX02T/Mr9UuIJhsiUHJVeHb7ITsqn:o4dXaoT/Mr9b+hsiUHS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355816, "uuid": "5e3999c8-3ae6-4ebf-87c3-36653aaf1506", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355816, "uuid": "9593b9ef-bc0e-43b8-a2f0-cac5ef5acc81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355816, "uuid": "333562ae-69f5-4613-b8c3-36a91b73479f", "value": "SecuriteInfo.com.Trojan.GenericKDZ.81593.25515.12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7736d9-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426081, "uuid": "53892e06-9cb4-4152-af52-2a4a6f68a973", "comment": "Malware payload (RedLineStealer)", "value": "a4dbf52a573c98aa3760348cd19c7873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426081, "uuid": "b7bbc94a-ac3c-4083-974e-8f094096e037", "comment": "Malware payload (RedLineStealer)", "value": "dd9f9d4f7389dd8c50aad444410f5ea5ef8eaba3e4d03f6edac9753c8a786236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426081, "uuid": "d905440d-498f-4fbe-afbb-4a9ff6b33d21", "comment": "Malware payload (RedLineStealer)", "value": "db91284c47a70751e2d7936c5866cb85a7a32cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426081, "uuid": "b4ba9938-64c8-4d4b-a8a5-2feeacf93be4", "comment": "Malware payload (RedLineStealer)", "value": "77f8dccd1fee29bf3e433e8e3f9fc31fafc14419dbecbb19b243ac251d9bdccce50096691543e6ead8343fdd6bb15661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426081, "uuid": "ffae4dff-81d6-46ca-8ddf-f13c0b9baed2", "value": "T1C87512F6FBEC3009DA3CDCF2491605B6E9B1911AEF4E1D48B36C8B19A5327C8065639D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426081, "uuid": "8d2cc49c-1dec-4a89-a719-dcf9042a597c", "value": "c165aab789e113ec6a3b8d99a6c3924c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426081, "uuid": "39010b2d-a9b1-48ec-885b-bcb0e243ed88", "value": "24576:blaZedXzQqaIYulpboOkLVZ+SEBc/NjE+/wUgVeKQtADE4vU5J1L6dqfs:wZedXTY+pohLH+PBwNjr/0QtN4vwJgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426081, "uuid": "88130573-a953-4244-a084-a60ae9f47f61", "value": 1641520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426081, "uuid": "d71c7755-5a09-430d-b7c2-bb92b1d658f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426081, "uuid": "c380dc84-a68b-4e66-8874-9457006bca0e", "value": "a4dbf52a573c98aa3760348cd19c7873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edf16cf-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425972, "uuid": "cf774c7c-7ada-4fe2-9215-fe329baeda1a", "comment": "Malware payload (RedLineStealer)", "value": "0f5203665ef3f6f0253bcdeeb8b6dd35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425972, "uuid": "3959d647-d9f0-4186-bcc6-c1838e3140c4", "comment": "Malware payload (RedLineStealer)", "value": "dda11447c028c5a22af2cf880c506dbbbfee1f7bfba1bc98ab6335e2230dae6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425972, "uuid": "d9415d0f-06d4-4688-9b6d-a77ed3d0a256", "comment": "Malware payload (RedLineStealer)", "value": "be0310f48b4e636c2ca657e7b592ce03733e5801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425972, "uuid": "bbb570e7-45a2-4420-a5e2-04d8ddab8d68", "comment": "Malware payload (RedLineStealer)", "value": "d58bab73063b22286315e41aeabe2bc66975802ec6b61dfb47523e86116c3b0aaf090c6331f749bf49ef44dd03d4fd5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425972, "uuid": "98fbc848-39ca-43d3-94b8-ae28915097e7", "value": "T10E64D0C179A0CC31D5A27D3188358AD58F7AB962EA60C18A77B837EF5FF36C04621716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425972, "uuid": "61059d9e-bab4-43fb-a897-8c4b3360d446", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425972, "uuid": "f9e2fb8b-eb74-417e-abc2-67e6060c23fb", "value": "6144:le7dZtNivtIiRVhOYy1i51I708OvU9PVS2kJYb7ITsq0:lWDilIRYvfXRvC9B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425972, "uuid": "a3ac1105-27a2-40ad-9187-fba6bf494ee3", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425972, "uuid": "d1831212-84fb-4952-9785-5787261da5d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425972, "uuid": "b2809ab5-ea91-4874-9fd6-cb2f11f8dbb0", "value": "0f5203665ef3f6f0253bcdeeb8b6dd35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c05b04-5c3c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639417365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417365, "uuid": "9c6214ee-4f5f-4694-ac0a-83c46daecd80", "comment": "Malware payload (Dridex)", "value": "6da0cae03023a10e31d7fb0a5d678723", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417365, "uuid": "3c138833-8ef4-4eb4-a180-7435d9fe9eed", "comment": "Malware payload (Dridex)", "value": "ddb7acdcdb339543380bcb3d4633248ffe20e555104b26999a4c2ae2a40dfa14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417365, "uuid": "8a9117d4-a65f-483e-8b34-3171a520c29e", "comment": "Malware payload (Dridex)", "value": "5155209decb16eead575651f66d95398e6239982", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639417365, "uuid": "9a894fbd-51c6-4feb-88ab-52f7f31069fa", "comment": "Malware payload (Dridex)", "value": "87d75131e0489bd687c6dda42fd7030a8637c49b7cec3701d07a724b9cf1906f8024bdb692328db44eb2bcb9f1e073a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417365, "uuid": "b8f1dc04-ee19-4032-9412-4fdf81d4069f", "value": "T103B4B0D1F05FE94AFA5E46712E189932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417365, "uuid": "1b43ec93-7f55-4358-b542-cd272f818540", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417365, "uuid": "5ba0d26c-6efd-419e-9edb-07404f2aeff8", "value": "6144:xKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:x9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639417365, "uuid": "174d6051-8cdd-4e9e-9399-83bf0c7bc26f", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639417365, "uuid": "cdf51406-c934-43e2-9367-f94783929b5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639417365, "uuid": "28a416fe-e447-4a91-ac8e-6d199e7a0403", "value": "6da0cae03023a10e31d7fb0a5d678723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935326f4-5c04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639393526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393526, "uuid": "cc8560f0-6835-492c-87b7-021db1fe1d8d", "comment": "Malware payload (Loki)", "value": "3fe8706b305ac25d0c02ef2407cb7c2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393526, "uuid": "966f1531-cecb-4e95-b899-1137523d9f65", "comment": "Malware payload (Loki)", "value": "ddf76c4f45352c73bf4a8ed9e90d8b5b4b768eb1a4ad7e211e62e3e8b9d6c405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393526, "uuid": "47c3381d-5bcd-4821-9f08-c6442724328b", "comment": "Malware payload (Loki)", "value": "53ef6d4591a2ae408c0efd964b17de397443c409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393526, "uuid": "bc1aa28f-2a49-4358-bcb6-74fbe590e11b", "comment": "Malware payload (Loki)", "value": "f705402f0813d0f69e36f0a512cc2ab48fd4a34a9942b16b5b1605335401ddf9be2865ff7a73e708b403102ee7bf89a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393526, "uuid": "b8f36d60-169a-4e81-b733-e0f5e6177a64", "value": "T1F91509527AC09990F169323BC66A921847F49B102693D733EDFF33AB0D13B6A79049DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393526, "uuid": "87961d52-8de8-4927-8ca4-6c695ce46e75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393526, "uuid": "ed796c69-74cf-41f7-9e94-d7755d93223c", "value": "12288:KcRJh4iAmLUnVz9+9IDje9CnezNmGeAceNlR2hWMSwyHS/lkoA:KzmLUV5aIDiLNm9neZ2hWoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639393526, "uuid": "85b43af7-fc8f-4855-bbb9-4ffa45193d2f", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639393526, "uuid": "0f092ef7-859a-46e4-b471-3b3b051c5401", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393526, "uuid": "35849c8a-6944-476d-bf73-1d8c0920f4ea", "value": "53ef6d4591a2ae408c0efd964b17de397443c409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2b870c-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639425944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425944, "uuid": "cd699d30-e3cf-410b-aeae-2134bee1be96", "comment": "Malware payload", "value": "0944819f7ebdb24bbe6047aef2e7b67f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425944, "uuid": "c00c9250-6748-4bc1-9a16-d0fc8e45c537", "comment": "Malware payload", "value": "de2bf39899549200e938619cc611885e56009fcb3be48662969afe82153910f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425944, "uuid": "864cbfc3-6cff-40e6-bd97-e420683b9198", "comment": "Malware payload", "value": "6738bad131ea3e2fe035d9b66e0d6447f70c84fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425944, "uuid": "70ac65f8-4351-498a-8e8b-3fdb7497e369", "comment": "Malware payload", "value": "2967e3ea333e8e9fb52742ddd8e07101e6ab83741656ee25137fd18a4d9ae55577d3f9e37736cdc6c9e08c3f74e65efe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425944, "uuid": "13822eb6-a04a-450c-899e-dca7be93f01a", "value": "T14655330613B84B66E670873844616B6053F472EAAFA5F6910D8EFCDA2CB0FD446137DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425944, "uuid": "5ef70186-839e-4645-9e26-941e3a3dbcd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425944, "uuid": "080d669a-ba6e-4ea7-aae5-4c3e5988081c", "value": "24576:NN7U4D+nsEqIz9cC7ji4xe8fZDR7dvZuZ3XCOKlSxaZ9my3zP2Hl8+RlbWDCzEc:DF+SIz9cCjw8fZd7dG3XCOKlSq97zslZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425944, "uuid": "18f8ecf8-3512-4511-a8ed-c2c8c3b01173", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425944, "uuid": "1ca5631b-e0a8-4a95-8480-4c3c7cbc0689", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425944, "uuid": "1a7c3fab-0fa7-476a-9b82-cb2ee86bff61", "value": "0944819f7ebdb24bbe6047aef2e7b67f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d3448b-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426004, "uuid": "9625a74f-8606-4fc1-b558-6096e0df9967", "comment": "Malware payload (RedLineStealer)", "value": "d5731d937044b8750f99a9ee66d53300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426004, "uuid": "64159948-d919-4a34-ae39-7c0ae2aaa789", "comment": "Malware payload (RedLineStealer)", "value": "de41b7c8bbba61babd3868b332ed5406bed751de55b17281a7e5af8a4b6d0fd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426004, "uuid": "e5e458e1-a8b3-47c7-b09a-bd37eb47cb8c", "comment": "Malware payload (RedLineStealer)", "value": "8327a9db96aa8c0fe2a68f9f0c7ac223c1fa38d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426004, "uuid": "fdd87349-b237-4fb3-a73c-b4f83ee0c018", "comment": "Malware payload (RedLineStealer)", "value": "acedf8d641bf1e1d3b1f70aaf28796808882871b4783370debcf46c77aafee56d15061b80c94e5decd19682245cd2d8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426004, "uuid": "7df54976-2707-4379-bdab-fe996414fd48", "value": "T12C64E1C17AA1D832C5E2793088308AE48E7FBF65D963918B3778379E5F727D05626312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426004, "uuid": "a148529b-1047-424f-a0cc-211ef96a2747", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426004, "uuid": "617ada8b-53f4-4a9b-9bb0-81df8b6bd72a", "value": "6144:EQ70J9yMYuu88ADx/2slgwND0OuWb7ITsqB:Ek0JArrHOxlL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426004, "uuid": "17cdccf7-1971-4abd-b51f-81de3b83cce2", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426004, "uuid": "6cdbea9c-a7ef-4ead-9f53-701495366a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426004, "uuid": "058e1c82-4c32-42ab-8ad4-4d219b0535cb", "value": "d5731d937044b8750f99a9ee66d53300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4ca290-5c60-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433078, "uuid": "b1408a42-56c7-41ea-9f1e-72996a719a99", "comment": "Malware payload", "value": "f467f479d31f99b0e986535ab6fedad2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433078, "uuid": "0def72b9-e698-4f9c-ab86-d44080aa867d", "comment": "Malware payload", "value": "de4ced01e9e13a297adb61c70746296d1e22b3d09cf7534f9ebdb16e82684823", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433078, "uuid": "189c96d8-daf1-4ecd-970a-678aeec839e7", "comment": "Malware payload", "value": "7591f3bf8b995199c988cffbd1c6d4bdb2b0d6af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433078, "uuid": "abf7caf1-9cda-4e13-90f0-a3d6169d7088", "comment": "Malware payload", "value": "59cfeafd3fb0a3079cebd7a4854559242013ed4ee86b6dc8b9bab83d26b00425dfe4bc438201edb44fe05eff68e49e44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433078, "uuid": "84f08891-a63b-415e-b541-5f73590c906c", "value": "T15FB4B0D1F05FE94AFA5E46712E18D932D45E0B03A3A6BB787623402C66DD3253CD2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433078, "uuid": "d1a71c08-e191-465d-8eef-4109b25057b8", "value": "e9192d34e4c9dcdf739aaa1d74025eb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433078, "uuid": "87326e9b-609b-4524-b572-f7295f78da2a", "value": "6144:AKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlXO:A9hXAg5aX0CL8fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433078, "uuid": "8a4f2388-6df3-4cf4-9ced-f29d00011606", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433078, "uuid": "f305c908-6e94-4b17-8746-18c21750a73e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433078, "uuid": "edbc8782-3122-4ee4-8df1-51cd16a79e67", "value": "f467f479d31f99b0e986535ab6fedad2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5033303a-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426055, "uuid": "790922de-06f4-4770-9bdd-915cb998bee4", "comment": "Malware payload (RedLineStealer)", "value": "e8a94b60f7096fe62af751c6e76825c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426055, "uuid": "dafff6e1-8b64-41ef-8b38-cc9ab80be368", "comment": "Malware payload (RedLineStealer)", "value": "de84f59f9e999acfeea32856b866ee82728118bcb5bdd6ffee0f40c15a7d209a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426055, "uuid": "4ffb4d90-95af-4260-9b8d-ee743efc0b78", "comment": "Malware payload (RedLineStealer)", "value": "a241b6883cd7a94d3fc3d29e1ab6c8c4ddd86c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426055, "uuid": "e7125044-49ec-480f-8421-a0b45dc4e251", "comment": "Malware payload (RedLineStealer)", "value": "6c0eb961585b70d26ccc55c5685ebd13b1d721cc0d51e6d9ced64d95bf7b53ed6342c1b7c2635c6528906a08005224c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426055, "uuid": "debb96a6-3d7b-4a9b-84f7-92198702c2a1", "value": "T15764E0C13AE0C572C5B6293098718B915E7BBD53E930928B77783BAF6F726C0493135A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426055, "uuid": "b313d435-ece6-4daf-889d-d13a32d7ce1d", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426055, "uuid": "42a0b51c-6585-49a5-aa58-7bf302afb377", "value": "6144:/6UHVuLH6tjkZRXkUzd2peoDD+DXV4Khqpb7ITsqz+:iUYLn550DUa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426055, "uuid": "38f8fc34-2065-4292-9b48-fc6052fc4125", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426055, "uuid": "62f919d9-9ae5-4d62-8902-79ce00c067b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426055, "uuid": "a0a14afc-37b5-4a14-ab15-6624e7d77aa8", "value": "e8a94b60f7096fe62af751c6e76825c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ac4905-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408586, "uuid": "bb3d717a-0d69-4493-bdaf-77de4a2fcf34", "comment": "Malware payload (AgentTesla)", "value": "022a99d02d7996f1026c4474d4ef8a64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408586, "uuid": "8a5107d7-da24-4aa3-a5a8-03eb336606bb", "comment": "Malware payload (AgentTesla)", "value": "dee63b1f5f2fdc4e8568ee5605ea934ca83125ae4e9c26ecfda8e5ca13a72cda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408586, "uuid": "8cb87a34-9a98-4746-8aa1-237694d00d90", "comment": "Malware payload (AgentTesla)", "value": "20f63d568f85ecf6541d96c9ae891dee323266b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408586, "uuid": "90098d4a-442e-4637-a4ab-5e5c30e8991e", "comment": "Malware payload (AgentTesla)", "value": "af3d5fc89aa66c2720465f43f156c556615e586979fb7569049e0d7ee78ff17aae20669ea2d121e6b8ba8e2a540d4763", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408586, "uuid": "53050304-aa36-4789-9f13-e04724bf797f", "value": "T1FD640281E7D24213D1DEA77269938AC31BB4818D3D938B859CD9B0AD0C8F7D97186ECD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408586, "uuid": "de98c7ea-6027-4f0d-a055-c92f7e225ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408586, "uuid": "afab5936-311b-40db-8a4e-2286a452267d", "value": "6144:dvpL+nH9CapLk4whrBMbgQKM3zq2lEIreoJ8LXFjCDx:dp2wmRs8gQDzqEEIiDed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408586, "uuid": "3cca17c1-21c3-4f45-b71d-9363683893bd", "value": 321888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408586, "uuid": "960434fc-45fd-4ab4-aed2-7e9e3e2427ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408586, "uuid": "810cad62-bea0-4b63-a0de-d7c2b4c1f2b3", "value": "DHL_Dec 2021 at 1.10_8BZ290_JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ccb24e-5c70-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639439756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639439756, "uuid": "72f6f707-14a9-421f-b062-96d17da2e1fd", "comment": "Malware payload", "value": "55b75999aeba3ccfd5309b39d7880baa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639439756, "uuid": "c2222ede-697a-42f3-ba07-0c639d26208d", "comment": "Malware payload", "value": "e07e5f0295deb4c8a77519cf41d915046d6962db92b7e667f68267d30e0b8399", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639439756, "uuid": "631e2d26-ca99-4e20-97c4-ce79816688b5", "comment": "Malware payload", "value": "293a2c7cd6ab5851563d868d549e9a2dfd00842c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639439756, "uuid": "f1309e6a-c152-4b7b-9d04-ccc5fbb84bf4", "comment": "Malware payload", "value": "69303e997bc5fdf3dd941fdfe2907ca3b27b9abee5c4d37ad2400f208d161df4ebed24463f58a5f02e11cb8030832c0c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639439756, "uuid": "e81b83dc-a18b-467c-ad73-1add7de41b55", "value": "T1FDB59D1139C6C532E97E45306A6ADB3B14FE7EE00BB188DB63D45A2E0E745C24276F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639439756, "uuid": "dc5108d3-f11b-441f-a1f8-2c387aa218db", "value": "49152:nglrz5io+HGGWxyzYlrXVVdWgAhmLQr+uclpUO3mDOSP9HnoA/s5tFsy3I1XF2Et:LGGWDlDAhmLpUUEXF2DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639439756, "uuid": "9fcd40de-8b9a-48b5-826e-d544e9736bc8", "value": 2307584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639439756, "uuid": "e2d8469e-d2db-4b3f-a631-eb1015c3c9eb", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639439756, "uuid": "0df16495-a672-458e-8c2f-c613e5758487", "value": "RT.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a56a6f0-5c5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639430233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639430233, "uuid": "a3c802c2-aac6-4072-8eb2-d4ed211f2a77", "comment": "Malware payload (Formbook)", "value": "672ba9308e0a612a0ad94f6a00ea05e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639430233, "uuid": "584f8c6d-db2f-4b3a-93e8-67de28d250d4", "comment": "Malware payload (Formbook)", "value": "e139e7e12f7371609ac2069b8c043797fd06ea8230138b074a806b9014cf934d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639430233, "uuid": "160113f6-5c12-467f-9ba5-0766c9af151c", "comment": "Malware payload (Formbook)", "value": "e8a72d6fb871e9887d20e58cae0238d58b8bf402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639430233, "uuid": "38ec21ef-deaa-45ca-a5e3-cc6499d332b9", "comment": "Malware payload (Formbook)", "value": "035c45edd88ab1bc3406b27f4f9f616f21be51d16fc8ebeb16d36c8ba071b3fc706b6303fccf219af38dbda06485ab97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639430233, "uuid": "3ba9ba2b-f71a-46a2-8769-5c5c036b615e", "value": "T1DC55121A33A19A11E4AF07B89075C1308772BD00792AE31E79C97DEF7E337A16942767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639430233, "uuid": "9a6f6082-170e-4fe1-b11b-489ce73332b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639430233, "uuid": "53879b8a-68eb-4852-80df-45f8ec867b0f", "value": "24576:w6LZqktxlz+i1EgnRSxOEfDRxtWOHtEga:ZLckUW8OOaOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639430233, "uuid": "cc7a1116-94e4-4e6e-8f63-1682f0730878", "value": 1370624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639430233, "uuid": "36968a1d-19c1-4667-807e-4009be2693ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639430233, "uuid": "f0a7e456-f63b-4dc6-b878-4763f02d8857", "value": "PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c87b85-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426152, "uuid": "9736dd36-a63e-4125-99f9-4ec41c13c15a", "comment": "Malware payload (RedLineStealer)", "value": "11a824a92be41b18966afa0d1ca14701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426152, "uuid": "e90a5b78-d7f7-466d-9f9a-ceae85ddef6c", "comment": "Malware payload (RedLineStealer)", "value": "e1ccc1245034040dc2d04d341ffc00b5bb105f37adaa77be4ffd74c1425ff779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426152, "uuid": "cf1ea6cc-9ad4-40cf-9fb0-e300ef161720", "comment": "Malware payload (RedLineStealer)", "value": "390ad4c9de20aa49b56b61c6daf622cb84ddd81c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426152, "uuid": "694b0bd2-80d2-4455-b574-959d8c53b322", "comment": "Malware payload (RedLineStealer)", "value": "b525ca1b5fc3e4ad457ea1736cf43dc7540bdf827eb52abe9c0b672d41ab57575983d666e16eba52442eded524fb9a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426152, "uuid": "24f19d2f-a601-4131-bbd1-315149da6952", "value": "T1C35533B5C4C0951ED20301F0A932BF2825D3BB3C8FD9544EE6F9A68BCE3E1479A6C654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426152, "uuid": "04a988e3-f25d-45fe-9c8a-138800fcd9e9", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426152, "uuid": "3871d18b-e5a5-4aac-9538-4378d0e8d390", "value": "24576:CbpkyJptzlWoQEVmdUM6L6EzAynRef5tsEiE4FHaffHlUcTOpChLrszkEaHNYK3K:6tpLQEVvMKLnshKEJfubpHzNawpAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426152, "uuid": "b4379282-66f1-4fe7-b936-cd5c5dd992c6", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426152, "uuid": "3171ba2d-9a2d-4be7-9f4e-10c2b51583d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426152, "uuid": "b98f86f0-7196-4076-902a-cc6e4b18e011", "value": "390ad4c9de20aa49b56b61c6daf622cb84ddd81c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488468ea-5c18-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639401990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401990, "uuid": "e51ae5da-b606-4e64-85e0-307ad9cc48fb", "comment": "Malware payload (Loki)", "value": "03c17501969ced7e6eea23002a684a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401990, "uuid": "2b424b6a-63da-4dc2-b8ac-bacfce39ea8e", "comment": "Malware payload (Loki)", "value": "e21c8c445fea53b4acf7636138ad101451a2c42043af4289c0ac133b574ba1af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401990, "uuid": "14b2d924-dc3b-4771-be44-b8001e3d3892", "comment": "Malware payload (Loki)", "value": "b76e1cb2e7367732b778eaf1f77cbcef392f0b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401990, "uuid": "10ea2298-e82c-4bd2-87c8-0eadd2edfd25", "comment": "Malware payload (Loki)", "value": "d7dd79d03a365e5b2ba06896cbb76f63df21dd3173c9b4a59cb0184b3306b4a36f3f853f2bed943c70ceeb76b85d57e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401990, "uuid": "0ecbc59b-5c0a-46a0-9216-035642da8ad7", "value": "T10315231F89E49338CEFDBBF4D8B8E1252370641A3D69DB1E284D7AC561B4F076151A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401990, "uuid": "c4664b9d-06d1-4016-ae5a-d14b1988692b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401990, "uuid": "ba5b631e-b934-4091-abf2-11037e29c55a", "value": "24576:051mDF7n124CuEJryvX5yfERoLl4fWts:0HWR24LByfYCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639401990, "uuid": "ed874b09-2632-4197-826d-8ae65460c8b3", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639401990, "uuid": "cfe35742-821f-413b-810b-7d16382dc17f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401990, "uuid": "8b3a753a-8095-4830-9d1a-e81ee5eb1a9e", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2275170-5c17-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639401792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401792, "uuid": "7561fe4f-f8d1-44b7-ad41-334d383a1943", "comment": "Malware payload (Formbook)", "value": "f03203d8608cb68b63fe5a4870f86578", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401792, "uuid": "370edb4e-ef99-429c-9503-b9b2fef554e5", "comment": "Malware payload (Formbook)", "value": "e307387ad0f33f9aab4d1688f0e5483b191073349ddafac9625f575b5c7e1f52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401792, "uuid": "679b869c-b00d-4b0a-8b3b-f640effa1635", "comment": "Malware payload (Formbook)", "value": "1bd8980a03eb26c6c604e4cfc101035f0f6fe912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639401792, "uuid": "a4857706-70de-49e2-bcab-bb437a9cb8ad", "comment": "Malware payload (Formbook)", "value": "7e15366490c0c9db84d0722ea4b9785a77bfb9e0554d78022f6f957fe0bdac22cacdf97749cc36dad4b93445802dfeee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401792, "uuid": "3dd8265d-a4bb-484e-8baf-4a1f0391a7af", "value": "T11564232F7FEB187BE2549C700936B7787B3DF2C886D001AB47E45C791A650468B61F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401792, "uuid": "564ec2a6-5c53-4835-aa9c-7f17ed4eae16", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401792, "uuid": "c56357bc-77d3-4682-8d39-f7add17ff64e", "value": "6144:rGiHSc78V2eSQ532RRIlxK6DbTe2zjOVl5drzASv0SWqla:jSi8geuRS3eXprzASvRtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639401792, "uuid": "399a9114-1d93-4da0-892f-0d1100b7e7f1", "value": 311697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639401792, "uuid": "422fbc95-99ae-460f-aef4-9f83306436ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639401792, "uuid": "a76640cb-8c40-4d58-8bdf-b825093dd282", "value": "f03203d8608cb68b63fe5a4870f86578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3897305c-5bbb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639362020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639362020, "uuid": "29f99a84-9fb0-4f05-97e1-0fc2bb1ab40d", "comment": "Malware payload (Loki)", "value": "00b0c794df7621e441ba56b127322676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639362020, "uuid": "0fe2bf94-bc5f-4834-ba43-06ceef73816f", "comment": "Malware payload (Loki)", "value": "e3b2d2e89a8c75f7a1ac6f5f2ec28dd2895e116edd3a427d0eb8b281343f2641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639362020, "uuid": "192d5c40-ab8e-4578-9891-c070579a8584", "comment": "Malware payload (Loki)", "value": "ce40d7a8e3dd624560eba81976de1b21e4692c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639362020, "uuid": "d56b8651-d2a5-4e2e-9257-5a9df7b427f1", "comment": "Malware payload (Loki)", "value": "a93f11396981f95e08dea8394c5b95c7c178b94d3d2a1bba893d14813872e70976f2060a5d3ae654de5e38e6601aa385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639362020, "uuid": "b9ef5df0-a701-4310-98cc-27e8adb2f9bd", "value": "T169A423CF2DE19EBBF01332B29835FA55B3BFE6D845535B130B188D485450A86FA2B271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639362020, "uuid": "868d0e22-6834-4a05-b496-115126153606", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639362020, "uuid": "aec400c8-0809-49c8-9862-dcad6ceae791", "value": "6144:rGixjqQGbvw9JvgP5/Grz6UzcWrv1f4Ex8KaRi0cTkpkMsky8G/bvriCibyx25nQ:kQwvw9iP5/GDAkab9sky8WriCDAEqTlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639362020, "uuid": "39a525e7-7bc0-4b8d-993e-c13b0af1dd63", "value": 466526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639362020, "uuid": "02d0b643-c67f-44e1-aa9d-a29660ce6fc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639362020, "uuid": "e33bc4b5-2d06-4c8b-8323-9ba7840fe6e6", "value": "SOA Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d6ed8b-5c60-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639432993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432993, "uuid": "764f037f-ea3c-4c61-9a2d-494bb1d9a219", "comment": "Malware payload (DCRat)", "value": "69437e9f929781e17b71b875285513da", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432993, "uuid": "6eff6f87-e03c-445a-bf5f-de8a70e368fd", "comment": "Malware payload (DCRat)", "value": "e3d80fa916d4d44cdd4b69f23c7d7ea10aab02a1271738f0df1dbd282876c634", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432993, "uuid": "1cc08c3c-a3c4-4b6c-ae8c-11769cbdfd91", "comment": "Malware payload (DCRat)", "value": "da3b4d020abe5682f5453cebdedb9793b597736d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432993, "uuid": "83b633e7-6d7c-4379-8ae7-f6a08eb61e27", "comment": "Malware payload (DCRat)", "value": "25b1b8830d1109219a69261291bb449efa9603132c6334238ce912614d3a7e88f1fe4daacaa27e8acd5c5e137db59eb0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432993, "uuid": "3eef58b7-d543-49e0-82c0-60b7865b23d3", "value": "T161A4DF0453F48821E7F39F716CF649959ABBBEC72DB4D22D0680518D5EA6F01DA2073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432993, "uuid": "4a6ea98c-d493-47d7-b1be-db9bb941d7f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432993, "uuid": "4c40f6f0-c8a4-422c-bbe1-adeabe6e76ea", "value": "12288:HXn7dO5uHdYJLBu7gMEfB3jrhN7AYqHyn3VF3Np4eW:HLoQSMmd0HO3XdDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432993, "uuid": "55a15fe2-53ba-43c9-9a5a-32719b53b891", "value": 493600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432993, "uuid": "95ed756d-77c5-4ba3-8b0e-0e3bfc98ec7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432993, "uuid": "4a4142f1-80cf-4fab-95fe-2c6861dfbe7f", "value": "E3D80FA916D4D44CDD4B69F23C7D7EA10AAB02A127173.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f772af4b-5c4f-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425906, "uuid": "26e2c708-0f02-4cf9-aaa3-d0cec396ac8f", "comment": "Malware payload (RedLineStealer)", "value": "69e229d5e144e2eaeb0af509e2bacb62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425906, "uuid": "f9833655-1bf9-4a9a-b59e-c5d8a7c010fa", "comment": "Malware payload (RedLineStealer)", "value": "e47a33c8cc332c49db2358651487d9b529df38535126bdf9d6708e04175388d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425906, "uuid": "870e4159-f10c-43cf-975c-13f314070981", "comment": "Malware payload (RedLineStealer)", "value": "50bf3ba0b160e3e7d8e41f1e7e8579fb5fad7ab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425906, "uuid": "264730ed-7f59-4482-9099-2192db3e0b0f", "comment": "Malware payload (RedLineStealer)", "value": "7d121bad090d25c8e714358c452af99b4667cc2a90b319cdd712a19ab8788a86535488f2da621382b73f87d3b9f19d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425906, "uuid": "867fe27c-f30e-4066-8f49-10eb6026a5be", "value": "T1DF5533D193C86E2CD677043725047669A3842AB1EFD470CCD9AF1ACA18768BD7A1C3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425906, "uuid": "65529e5e-5164-480e-a63a-72b12663ce1d", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425906, "uuid": "efe86244-b1f3-45a5-8ecf-7a9add2fb9b4", "value": "24576:EGg6fkHTErzP5NkQF0Monwae2hXLhfC4gTy5AFuuWuhfkEaHNYK3Wi3PjZiSKxRC:EGtkzodGM0Mow1MJC4ge50z1fNaUS28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425906, "uuid": "0fcfff42-9cea-4d1b-b380-1905b0a7fc29", "value": 1359072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425906, "uuid": "86fcd03f-9416-4eb0-b6e0-c358111590ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425906, "uuid": "8178dfdc-21c9-44fd-ac3e-3e98600feaad", "value": "69e229d5e144e2eaeb0af509e2bacb62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15914d8-5c42-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639420312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420312, "uuid": "8199a717-0b0e-409c-8102-8f9765feff19", "comment": "Malware payload (Formbook)", "value": "bcf031e632c110b85e303984eb9fcecb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420312, "uuid": "cc396ba7-0fc7-49d7-8cf9-da41e4a38a75", "comment": "Malware payload (Formbook)", "value": "e4e365a3ceb7122723151e6b5fbb9199c1d82f5136ee1f966a87afef8169f89d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420312, "uuid": "6e323d6e-dd49-4031-b2b7-040ccc8abb06", "comment": "Malware payload (Formbook)", "value": "5c6ff36b334a394dceee2ef58840076759cc7600", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420312, "uuid": "9de8a20b-5f23-4f9e-a608-adcd25ffebbf", "comment": "Malware payload (Formbook)", "value": "313708a13f3bb61d49e75d3d92f507c162e5d0b8470b4678c816fee561a8e77f1699f3aa2feec0cfb1fa5c2eecfdfd61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420312, "uuid": "7e9a5b43-4edc-46a2-910e-895e65e9f835", "value": "T1CFA423CEB4C0B763D54513702672ABF46FFA51D642CD03174B94267ACEAE8A2012F5DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420312, "uuid": "72f52c72-0f50-41d7-b46d-a9ae16065c88", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420312, "uuid": "f8e47e52-910f-42a4-a9a1-2836f7c51b6d", "value": "12288:Cj3aTrCa7+uzmMcPo0hz+dIceoOdwVSt20jGWWgBFv/E:CjqTv71iMcw0haCcePwct20jGgbv/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639420312, "uuid": "22292693-d788-4cd1-bc10-930f5d78458a", "value": 474464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639420312, "uuid": "9a22fac1-2cca-45a1-a728-15cb75b3343b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420312, "uuid": "4e748c42-1cc8-41e9-afb6-f4b32a3ab72c", "value": "bcf031e632c110b85e303984eb9fcecb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcbb729-5c3e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639418404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418404, "uuid": "6729a501-8a77-4ac1-ab12-a60b17f54da5", "comment": "Malware payload", "value": "5a966a23be0388a3ee5be50074ce8a10", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418404, "uuid": "15ab81bb-f794-470e-8727-b64c87cc422a", "comment": "Malware payload", "value": "e6495eeb8424688cccece839b5260e32f2d0a5a28fbbdd8d3ed7ea6ab7985752", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418404, "uuid": "b073ab0d-3ff0-4abb-9114-a8de53f0f2c4", "comment": "Malware payload", "value": "c7d8d9ea626f4d770fb300c1fc9cf0d39a6b3d0f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639418404, "uuid": "24c09a01-f0db-4a64-9df9-6517725c00b0", "comment": "Malware payload", "value": "822657dee3e17bf5d38cd9ad6fdad87263b0c3f05561291a6b5898ad1cd1688ccf049cd561c46ad8a6b2f193ee2c3d9b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418404, "uuid": "7ca0d472-b200-4e0f-ad98-15a358243e98", "value": "T18ED53335572A90179B877B41A140B04FAE66F92B6D8C8AC235B8FF5413B9C3CAD25F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418404, "uuid": "9715c6e7-5e14-437b-a8e7-e696286192cf", "value": "49152:dhBNAn7CDzFA3nuD440DrSHgsQSu2NjJF3SZGqoeTWqM:Dkn7eZCM4PIgkuAjJ1ZgTBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639418404, "uuid": "48ffec0d-9acf-4b22-a50a-512172a91e87", "value": 2804858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639418404, "uuid": "2e77d234-d548-477f-b69d-0e5c390b980b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639418404, "uuid": "43aa6404-92dc-4cf4-9733-15377c0df20d", "value": "e6495eeb8424688cccece839b5260e32f2d0a5a28fbbdd8d3ed7ea6ab7985752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181875bf-5c5f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639432403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432403, "uuid": "cd5b77c0-5599-4475-b1b5-1948358f5997", "comment": "Malware payload", "value": "629694f475e6df2b6d9b3473d9ce3cce", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432403, "uuid": "34672608-58e8-4590-bbbb-59fd2895b4ae", "comment": "Malware payload", "value": "e6e5215d7124f962bf533e63c88b7c33fa216c99453d3f58474d1c3ed91c2ae8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432403, "uuid": "2120d7cd-6c25-4902-83c5-0da8ebf6430f", "comment": "Malware payload", "value": "38e8b6ff5e3e860d16c0df7b32c31303f8ab4f2a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432403, "uuid": "00f3badf-6f9a-4afe-a917-f8f1b513d857", "comment": "Malware payload", "value": "5f6671a1cdf24500ccd3cc422bd12aa12198354f4f5edd7c90cb901546c6059f70c12ad21988e6281f5a99be2a170692", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432403, "uuid": "a9b9e16f-be7f-4ab6-877e-4e924b54f97e", "value": "T1A363B389C30BD3AF656F28BFEC0A496313E50E26E9FD9085A3F8449E15BE51D64E014F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432403, "uuid": "a34ad420-1f4c-4e00-bed9-67de021d2b3b", "value": "1536:a3gD8uXqdmCsAtXTiiqDmdbXdrEzh9N2Nq:h8xd7XTPbtrEzENq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432403, "uuid": "fc8d5a4b-5444-4e7a-a151-aae1c84fe69e", "value": 70762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432403, "uuid": "7f24596d-9bde-4b18-b752-58a3df0900f1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432403, "uuid": "ee4d5774-512c-4f70-9bec-f7088b150393", "value": "0.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e44528-5bdf-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639377689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639377689, "uuid": "a4bbbcc9-eb3c-4d1b-a06d-8b28fed1137e", "comment": "Malware payload", "value": "6f76b740570b2d22d96c774e4b1bb208", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639377689, "uuid": "3535d2ff-c52e-4db8-90cf-6207f3d00cf2", "comment": "Malware payload", "value": "e7204285f671563cb515d9d5f4366e0a8a3ad7c098e95f1b66d5be4cc918583c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639377689, "uuid": "ea8e6f5f-c1ff-4d3d-b9d0-f9c975aa2e7d", "comment": "Malware payload", "value": "e84de89f11c0abf47ef38dca8e6b6230f7ac5fb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639377689, "uuid": "ea3be7d9-a532-49a0-a2f5-006f0c968f1c", "comment": "Malware payload", "value": "d49516ab79c7269865cce821b736f7b033b2e61ed342d83dc883ad288830f6038a74a2a17c6bb5bdce5b427496ecf01d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639377689, "uuid": "79c555a5-cd92-4c4a-bfe8-7efdd4f2998b", "value": "T181442262BDB72607D88715B208B06A41EC3FD416F740AE547A7FCD8399F65B190A33B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639377689, "uuid": "d54c9ff5-bb5e-48c2-8b4e-5015007abc7e", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639377689, "uuid": "f51dba7a-5dcb-4694-b74d-8ef53c5ef844", "value": "6144:4BABAdbouCA9dctS6HrFGDrbyyu6vzTr5dNKTToAH6s:4mB0OCW1gDpu6nrcVas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639377689, "uuid": "d7435b89-2ed3-4b0d-8fe8-64009489638d", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639377689, "uuid": "e051ac59-a169-4c60-96da-8b2bcee5eb69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639377689, "uuid": "2cdb5a37-a0c5-40c8-a6fc-94fd9929feed", "value": "6f76b740570b2d22d96c774e4b1bb208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa301a2-5bd5-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639373387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639373387, "uuid": "e260ef46-d905-41f7-be43-c9a5d150ffe3", "comment": "Malware payload (CoinMiner)", "value": "c717c47941c150f867ce6a62ed0d2d35", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639373387, "uuid": "bbb7b8d3-08a5-4875-bd73-854093a7d8fd", "comment": "Malware payload (CoinMiner)", "value": "e8b2a8d0c3444c53f143d0b4ba87c23dd1b58b03fd0a6b1bcd6e8358e57807f1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639373387, "uuid": "d2dceae7-b859-49e9-87d7-bb71f321e69a", "comment": "Malware payload (CoinMiner)", "value": "f568eb59fd37b2fe37db730292594d875d3a11e8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639373387, "uuid": "7e97650c-fb1c-43b4-804b-f10de722060f", "comment": "Malware payload (CoinMiner)", "value": "99e1c46ef3577059aeeda16313f4b4da754b67a83d60262bbbd2cf0accffd55fd94ef1086cc1567b32cad8aab9d25e78", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639373387, "uuid": "6764c52d-3570-4a96-a106-8bc968ec1565", "value": "T150866C1BF29350ECC57BC170865BA673F671F8190174BE7B2664EB342E22E90562EF24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639373387, "uuid": "b9755623-3402-4f74-975c-8cc75b98ebf3", "value": "0b9709c1ad172fbf7dc8ea7943281cb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639373387, "uuid": "de33d638-0ed0-45b9-a742-0ef6089bb6f7", "value": "98304:7f4ix3tX2mzKHmCTBk1XoHtLgF9o11clR73DArjRjjoHuLc2orGpV7bAUI9+dcGL:7AiLLcg2FiF1E+AsDm1y8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639373387, "uuid": "0c3baa7f-ab11-4ad3-99a1-d6d53fcfe133", "value": 8192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639373387, "uuid": "cd29891e-ab2b-48db-8626-d6c2c855f33e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639373387, "uuid": "46193fc0-d277-4b6a-87c7-62ba1355d0ce", "value": "xmrig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c99b553-5c61-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433458, "uuid": "c651e84d-c25f-44a1-b99c-fc3c4309dd82", "comment": "Malware payload", "value": "28d3e6763fd59164f9a87e463b16c8c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433458, "uuid": "5434b880-c9ce-4222-9257-33dc8f5097e9", "comment": "Malware payload", "value": "e90886c56cf07a89bc09789528d3b21bf2ea581b5d1f3317c51e356175af9e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433458, "uuid": "3153c3c0-6eb7-489d-9310-3bb4667ded5e", "comment": "Malware payload", "value": "6e6021227b2e5060300d71dd338d72639b2ed3c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433458, "uuid": "7dc4487c-c011-45d2-835b-155d9cedd436", "comment": "Malware payload", "value": "2b5d6a2163761527a043f6611508e28ccd83c435429e1665175dab71eea03481626b4742099e719feb138b8d8a9323ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433458, "uuid": "bccf7f53-eeed-472a-b4ef-cb1e862c910e", "value": "T186552307B230AB10F5F907FC91F0AA9143B49D0A1E22F7485DD671E69F36792D642A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433458, "uuid": "8b6f0f40-e255-493f-b8fb-4198c5952aa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433458, "uuid": "6c8d4497-ff49-4ffd-b35d-695dd4b6155a", "value": "24576:HxiQiN+Imlm4C/XLK56VTSDW7DALEbnhmdaSOejWhcvzbU7M9VZUDA/w:RLQ+Iwm4CfeMokn8d0cUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433458, "uuid": "df93ee44-0560-49d7-a0e2-6ed0b1c51393", "value": 1378304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433458, "uuid": "4dc1ad41-705e-4316-81b6-605fc82f2251", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433458, "uuid": "520dc69e-a220-43f1-92af-46aeff76b598", "value": "FAC20210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88dcfb1-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639415519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415519, "uuid": "e9d6c7e6-0da1-4177-a92c-7f7421d18904", "comment": "Malware payload (CoinMiner)", "value": "94a418a8612515d7abdaf12a495f69d1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415519, "uuid": "73af742a-a357-49d6-92fd-e311c836e374", "comment": "Malware payload (CoinMiner)", "value": "e959bb05b0f288bbc3cb6d7297c7d15249d5c55ca080c943258b296bb9179d62", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415519, "uuid": "739d66cb-311a-4635-abd6-142fb175d4a8", "comment": "Malware payload (CoinMiner)", "value": "f9d5f6808d5349e852bef833591ef7f68e1542ef", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415519, "uuid": "da0b4df7-fe36-4934-91c0-2f683997cc80", "comment": "Malware payload (CoinMiner)", "value": "c02bf50d140d218ef42e714d5e439e48ac626cdec7ebc9a1c04c9c9f954cc9368aa5cc83b0b714b0378a20c7a22cbcd3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415519, "uuid": "a28e4425-5bf3-46aa-a74f-0a3e488d3488", "value": "T102C4121F261494A1D88C8C30C9A78AB96E25FD52CD416A8FFAB47F4E3D367C0B11658F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415519, "uuid": "c3c2dd55-670d-4830-86ff-fc92ef4c7bc5", "value": "b78c7836a924f9a31372fe7f8bcc6142", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415519, "uuid": "c035ef09-f0aa-46de-97a0-e764c10b742f", "value": "12288:rg0kk4Mqqi4XuuJwtPslNP38wwio8hWs8qaOG7xw:E0qoRwtEz8wfo8LaOGdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415519, "uuid": "4c5d5e80-b328-4c98-a8d1-c8feaa768f55", "value": 562356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415519, "uuid": "2bbb1824-f800-4c92-8b3f-70920b629edf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415519, "uuid": "59b4477e-3b99-4e52-86d9-3112b6f744d5", "value": "94a418a8612515d7abdaf12a495f69d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef9e3a4-5bf1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639385519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639385519, "uuid": "ebf717e2-8e7c-477c-b034-3530f8ed1992", "comment": "Malware payload (Heodo)", "value": "169ac5faaae0d8eaae8b978c570505d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639385519, "uuid": "6e4c1f93-794a-451b-b650-e02a300c2d02", "comment": "Malware payload (Heodo)", "value": "e96352bf7eff95e521dfbac8120e28f0839a90a638da5e5fc14b200b7fae205e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639385519, "uuid": "92ebc5d0-0c74-4f0d-b215-c79e996465c9", "comment": "Malware payload (Heodo)", "value": "4eb920abd29091f19fc4e7fca9f63084e89aeb98", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639385519, "uuid": "375b0752-b17a-4e8e-ba14-99b39f95efd5", "comment": "Malware payload (Heodo)", "value": "20c224d4a120dab86dd6c44812ebb0fbc2849f89b6f0918957c72d9db1b414ec408c16c3ad6e1d6ea2be12164aad1ea8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639385519, "uuid": "824a9415-17c8-4c86-88cc-647cc0a846e9", "value": "T150648D11B683D072D5BE04307938CA96096DB9314FB4CAEBB7D41A3E4E742C19B36E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639385519, "uuid": "70e3e96b-b944-47cc-acf5-cffef46caab6", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639385519, "uuid": "b9781c40-e4f5-4145-b092-e74dc7765b1f", "value": "6144:+AriSO7B4gYcl/qjc5dQD8JCedcsqAOBCWOEt:+AriSOG9c0jc5mDQxqfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639385519, "uuid": "45d750fc-a766-42e4-bebd-bf41f4b702c0", "value": 323000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639385519, "uuid": "1fa5bf8b-6a07-48e9-8761-8e37622f494f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639385519, "uuid": "c8c91c7c-b9d9-4542-a6fd-9508ba5d42d1", "value": "emotet_exe_e5_e96352bf7eff95e521dfbac8120e28f0839a90a638da5e5fc14b200b7fae205e_2021-12-13__085155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98531c9-5be6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639380705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380705, "uuid": "98c290c0-f1f6-4111-87a0-6298636cb46f", "comment": "Malware payload (Formbook)", "value": "0f134cc4a3d6724c462f17075a7ab091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380705, "uuid": "5a8a01a8-7b1c-4860-b169-4f443006cc55", "comment": "Malware payload (Formbook)", "value": "e9c82121ca6522d3422309e88a3ef704853d2d170bf1dd969f54ebe1417089ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380705, "uuid": "5ac7715e-7d19-43bc-b60b-3c517a240d4d", "comment": "Malware payload (Formbook)", "value": "582df9975914aac7810cf4fcbde4ea702c7d989d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380705, "uuid": "0542655b-4a2d-4f9b-b82a-5d1b02a04671", "comment": "Malware payload (Formbook)", "value": "5ef90c968312a4fdd2fd6b60b3676cc86b9003f9872b993330feb14a9b1eae2598b3ac037e3cc4c0c4d97d24444a623b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380705, "uuid": "f8ffc886-1bf4-4089-84a5-922adf469c7a", "value": "T10A7423057DB095B6D53249302AB3F34FEB79C40046A20957C7542FABEE282A7DE172F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380705, "uuid": "1181d584-c1bb-489b-8c75-44d9692bb275", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380705, "uuid": "7a8a7e1b-7d9f-4d85-bd72-8c1a75785ec4", "value": "6144:rGiUOBIdS/EyHjRHNPpXOZhUkQlgCiVJZ82QmaFKYIbCcQtxrxCWUYA+AmvL29uv:IOcqVNPQZm7Xi/+VFKvGbtH/Amzmu+HQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639380705, "uuid": "d5e22496-6bec-4d15-a6a7-d6e3e895653e", "value": 364440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639380705, "uuid": "f4751bf4-aea6-41fa-9fae-0ee1bff1a374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380705, "uuid": "5e78b92c-adbf-448d-bc9b-01034f679c7a", "value": "Commercial invoice & Packing List_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30b71ee-5c60-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639433066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433066, "uuid": "362a7d42-2469-426c-a0fa-6feff01d631c", "comment": "Malware payload", "value": "237223624a830d98f65e22e7f1a818f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433066, "uuid": "c8877853-98e2-462f-ae01-a5fcdf71a708", "comment": "Malware payload", "value": "ea8a120af9a07051e827102be3cb0caf99e00f60a8f6c1f56fe4eb3c696c157b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433066, "uuid": "bde9f541-61a3-4a84-995d-a46ede6960de", "comment": "Malware payload", "value": "2a2e2c18ccf2f441f7b8002e3135e9a2e657e7ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639433066, "uuid": "514f4fd4-41d3-47cd-9615-cea8087214d9", "comment": "Malware payload", "value": "58bf08d1d2273fdca6c9e4411ed79f54c8146f760f269311623629dde1d42ba62d22edbff2afc0b8f8b35deeb8130872", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433066, "uuid": "60e1c67c-0f36-41b6-be07-fd7605c1057b", "value": "T1B035122A3BA4DE10C2BA5776C9EF901407FCB94A6413DB0E2EDC63DD48527A619027DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433066, "uuid": "f02516d0-2dfa-4ed0-8d3c-3dda667ce02f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433066, "uuid": "5a91626c-155a-4091-8c72-2d60d98d0594", "value": "24576:i/RAMTaH0KtM6DxsjrQ/PoUu9JvHdvDhZwUun37HMR6kMlpGG:8aH0KDDOZ9tVgIgDlpGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639433066, "uuid": "d5cc8dc8-ac09-4e96-b962-0b608c83d284", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639433066, "uuid": "ff03aabd-e26a-4d88-befc-a420a1b57c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639433066, "uuid": "10b16c27-99e0-428a-a920-9d325736a102", "value": "237223624a830d98f65e22e7f1a818f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224059e6-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639425978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425978, "uuid": "10b63e42-b196-4424-b072-c276c8905553", "comment": "Malware payload (RedLineStealer)", "value": "188106aaedede46e4e28aba977c97fe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425978, "uuid": "98578013-2d62-4955-895f-b49267ea6d05", "comment": "Malware payload (RedLineStealer)", "value": "ebdee10b1460109c846ab4cb0ba1bd4d746a7939369762be9228164cdcbc52a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425978, "uuid": "a56e55ed-b0a2-462c-b8dd-515e0b02d0c2", "comment": "Malware payload (RedLineStealer)", "value": "574d8ab8a923dd2e7977cd6d626f3ee3ac278bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425978, "uuid": "4e9fb896-4c8d-48d1-bb66-d2e181e8eca6", "comment": "Malware payload (RedLineStealer)", "value": "9b52d7041d7bba719b51f0c8687eabae86835f0dd5a5d1e62a6e1b799ebc305132d50784ad514caf2a366ab8a7263b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425978, "uuid": "165fe730-5a82-4710-889c-837b965312fb", "value": "T14E149DC276D1D472D6E2393094A0DBE44E7FF8A1DA64450B37B827EF6F722C05A29352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425978, "uuid": "e7a18252-0d5e-4104-a843-e78f04e5e866", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425978, "uuid": "10ac110a-a594-4463-af77-8856cff8826f", "value": "3072:irt0ues/rnCi100tNZ+9Xd75G+hsZVggjcGkNIVqIHzJgBA32:eX/TCiK079Rb7ITsq6zJ+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425978, "uuid": "5100e366-a328-40db-a5c0-a2ededcbf4d2", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425978, "uuid": "6057eefc-8a03-4b99-863f-1aac111981e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425978, "uuid": "b3619233-595f-4b37-956c-1943da54b38b", "value": "188106aaedede46e4e28aba977c97fe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41626dea-5bf8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639388234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388234, "uuid": "6eae7afc-df4e-47f1-9b32-9376d3e0d40a", "comment": "Malware payload (Formbook)", "value": "18447bf8c0d1729f8d12b6996389495d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388234, "uuid": "237a5018-da7a-421f-b973-c6c08c342198", "comment": "Malware payload (Formbook)", "value": "ec554399e485b8f2581a5d3f1823c58a9c220f07ae78a6f203ab1a0781d0671a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388234, "uuid": "f098ff95-52a4-4812-bd3e-c5267a93f0d9", "comment": "Malware payload (Formbook)", "value": "6a5585e45dd15d58a04e83b987b80031fa008da4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639388234, "uuid": "a26b5ed8-eae0-40e8-9dea-09729fef2d8b", "comment": "Malware payload (Formbook)", "value": "06e05e10d8988ce257d796fb552d82cdf1c74befca8c675ce16da8b18f879680e181ccd49fd72cf2a4f4b4d2c76f7967", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388234, "uuid": "22a3b827-e31d-4ad1-acf1-81838847e764", "value": "T1B76221ACC4B342D4CF85ABB82B2B9F49018C7A6DF7849532367C577527E5E3A901287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388234, "uuid": "6bf4c27e-578f-4f8e-bc66-3ffe9490c887", "value": "192:okg3uMLGJE3onq6l4hR7mWQoq+74GVtF/gbX1edyC2/yI5I4PpjKxA:Jg3NYn/KhR7io94GVtFScdyCI5Iajp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639388234, "uuid": "1bc4ddab-76fa-4484-93cf-ce7bc45edd27", "value": 15134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639388234, "uuid": "189d7422-8df1-46aa-8027-1d816e25cc7d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639388234, "uuid": "febd260e-576d-49c8-bef9-4ac629b78394", "value": "PAYMENTXINSTRUCTIONXCOPY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112dbad0-5c68-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639436257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436257, "uuid": "efb52df7-7928-4c6c-a958-de0c145bd741", "comment": "Malware payload (RedLineStealer)", "value": "82633f07c7b11ca0867ce7b903375fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436257, "uuid": "7cb175d5-73b2-45db-a545-95ba8e444b43", "comment": "Malware payload (RedLineStealer)", "value": "ed1fb3bab35ddba2bebd8adadbbc281b85ce7ca7c881a250cbee28dd9768be3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436257, "uuid": "6543ca1c-c40d-4b15-bb9f-82c293b2e1de", "comment": "Malware payload (RedLineStealer)", "value": "f41f46d736c3273fe1ce4ff3c25fd4a497f37e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639436257, "uuid": "564af3c9-1736-44f2-b20c-34241272c0ef", "comment": "Malware payload (RedLineStealer)", "value": "7224172ba05bf1adfad5bd4594da9d107268985f1d0b3bf2ba1350a8a6f0f800df860729c03cd89737ba7e49240d3374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436257, "uuid": "1a6fefa3-5f3a-4de2-9408-09d20b38358a", "value": "T18D244B1C7388EE36DB7C4435CFF4020DD3F6D896914BE75A95C034E92A9DBE5E602682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436257, "uuid": "a6179574-358d-4bdb-b763-2ac56b0b0400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436257, "uuid": "f2be0419-9d8b-4b89-8336-c0aab502f7f6", "value": "6144:uDfUm5CEY85lrZoWY3aCKG++VweoajCZu:SfUm5CE5nryWYaCKG++toaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639436257, "uuid": "81262db2-d62f-46cf-bc7e-2d327d98bb1b", "value": 223984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639436257, "uuid": "e59e879e-ea24-4596-940f-bad596202705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639436257, "uuid": "3b5986de-7af1-4620-9712-f701f64bcc93", "value": "82633f07c7b11ca0867ce7b903375fd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02329019-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639425924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425924, "uuid": "42aa5358-88aa-441c-ad6a-cd3bdfc31094", "comment": "Malware payload (njrat)", "value": "8927368f7fb56bcba1fe53c87a8b4bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425924, "uuid": "aae25201-6ea4-4c6a-8ac5-7912caa28fcf", "comment": "Malware payload (njrat)", "value": "ee80d066e4d3f7cb6facbdd6a7af6a80d119b162fb52fae0cef96956e3e131d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425924, "uuid": "9b2340ba-f9c6-4654-b7a3-2d9e2f2001c3", "comment": "Malware payload (njrat)", "value": "7cfc80d060904fa04305606da182b5342c99c396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425924, "uuid": "dd2a616d-80e4-4af0-a89e-9b918bf74cfb", "comment": "Malware payload (njrat)", "value": "f91718e8af8a15e1c0dd714848fc1865d4359ed738e3f553f1b70e92ca458d3cf99fc94962b26e520ac9473a81c764c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425924, "uuid": "92381b62-6b4a-425b-be0a-0d21d17a1c6c", "value": "T1879598B1144A967390AFC3A121D3518387E996D29B7284CD94824F3F0FEAD19750FBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425924, "uuid": "2f7b7f9d-9d10-46ee-80f2-114914a6b926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425924, "uuid": "8109b3bd-21d0-4d6b-96c1-c09249fc8845", "value": "3072:/uCT/FtHnQc/G/mv2O3kPeGP2PXP2ePuHVfePz22J0XYeP60PH+PdfKOuLbHXkOu:/5Tdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425924, "uuid": "8eda2cc1-b8c3-4d5b-8168-a0afe37ac545", "value": 1953280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425924, "uuid": "8863ed20-4ea4-4a50-b631-f446b4b3ab64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425924, "uuid": "662285ec-dc79-4ddf-aa0b-20a9a495f73b", "value": "7cfc80d060904fa04305606da182b5342c99c396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ddfa2f-5c52-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639427140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427140, "uuid": "31f688bd-ff8a-4c52-9a03-ba8bbbe38b06", "comment": "Malware payload (AgentTesla)", "value": "c5676e4d104f807eda35a53b72843dbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427140, "uuid": "c0d52ef2-c1d6-466c-8b45-93e0b188064b", "comment": "Malware payload (AgentTesla)", "value": "eeb80b6382a393344052a851dc26181aa728c18d09a4565f14829f5c23f852c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427140, "uuid": "2e062536-3c1e-43b5-9d64-cb6f41dae387", "comment": "Malware payload (AgentTesla)", "value": "3f60b2ee4fe5e0cf90a5762e272f854d7cd3463c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427140, "uuid": "7bcdbd7e-ce5b-4226-9609-0643efa95377", "comment": "Malware payload (AgentTesla)", "value": "994e7619cea5201bf1744bc8b8ebdf268922c3f65743caa17510402e1d229ee1bdabc99ab549a8698b05d365a07474c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427140, "uuid": "41485578-fcd0-439b-86b2-ee3c3523de5d", "value": "T14455236335B8C511C224A7F7CAC721A203B878A26261FBA96CF632FD65317F506419CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427140, "uuid": "e62b53d4-09d0-4c1a-9105-3a7c7302d8eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427140, "uuid": "4b0d16a9-7646-458f-b9d2-0f1b54e2de8b", "value": "24576:euaYdKyVc3B/Dl21hW7X/nxvkvvzH4N1yWpBMoeC3yO6Ihw3XiRQtoCK8:euaiKyVeZ21hWLnxvknzHyyLoqO6dT2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427140, "uuid": "0a8eb756-0fc2-41e8-b24a-ee73ea0cb4cf", "value": 1359360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427140, "uuid": "d170e832-7cf4-4309-836f-a6181a52d2e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427140, "uuid": "853b263a-ece4-4715-be10-97251c8781b4", "value": "c5676e4d104f807eda35a53b72843dbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea5a697-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639415288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415288, "uuid": "f72c295f-34cd-4c6b-a536-029e4c9ee175", "comment": "Malware payload", "value": "8a2ee372ecc4ed49a4c453b3b1f4ef96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415288, "uuid": "a16bb1e1-c7d1-478a-b595-9327709ce8c6", "comment": "Malware payload", "value": "eef5b9e18662f9953248ef97a4b2f131c9cc3ce64b8b0307f147b7442e0ad312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415288, "uuid": "e437b3be-3799-41f0-9147-da3ddada7135", "comment": "Malware payload", "value": "b030dbcb327601f0b746df258836f58c54a32f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415288, "uuid": "dcd8f81d-188c-4b8b-bf06-f709d93d40b4", "comment": "Malware payload", "value": "75baa09a4c2f04046a9bb65b2373a5185e7bf6ad421192de77933f036848381ec17bc15869edcea7a4da47f184b48a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415288, "uuid": "be368c35-3d7d-4a20-b03d-19a7cf2f3910", "value": "T1E2A302DF22E07405DD2A9C392F410802DB28EFB362F6CBEEEAD1C467772E2244D15199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415288, "uuid": "9f40bf54-c491-40e8-af29-59ac6286c25f", "value": "999fbee5ab195461bca2d1c6c66cd5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415288, "uuid": "4dd89ea3-ef3c-434b-b5e7-56d3483ccd4b", "value": "1536:JcQ0gCX7mF2BdtNZJggpkVxYM7uIeJ18xg1LJ+GqPyb3zQQbn2c3qmOnvwskkKIa:Ji7X3zOGkVbuVbDFk833qDnGevi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415288, "uuid": "e615485d-47bc-4125-b5dd-3448e6cb2525", "value": 99143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415288, "uuid": "24832603-f7a6-4350-af4f-58f5c7fd4867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415288, "uuid": "e16db201-2836-41ac-abf2-f30fdf325d48", "value": "8a2ee372ecc4ed49a4c453b3b1f4ef96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bbde8b-5c33-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639413746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413746, "uuid": "6b8bb02a-9031-48c7-be2c-96eb772242ae", "comment": "Malware payload (Formbook)", "value": "1aed13cd0bfee26e7686cd0fa7145b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413746, "uuid": "885d0e13-bef1-4f9f-9827-f7eed54eb5f2", "comment": "Malware payload (Formbook)", "value": "ef13ad897a51175cd6ab4b266a5792214853f595036156c766ba43a3a76537d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413746, "uuid": "6df9eca6-8566-4e0d-bdb5-84164e617759", "comment": "Malware payload (Formbook)", "value": "f07dfb8f1e0882c89e3450eab97acbd877c68b5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639413746, "uuid": "fdccb09a-98b7-4266-9989-bcce53ef402c", "comment": "Malware payload (Formbook)", "value": "4dc35b26e2fb6c208cdb5cc71a97d45f81593574b366b3b9cb04a052e81e0191bbdddc0ed1c844ae282fa61316a3455b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413746, "uuid": "035ca037-8b70-4ab8-a296-91f1ecafbfdf", "value": "T18E552346BBBCEA02C4385376C067BA450774ED2070A1EB4B7CD9BAD955B23E11A053EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413746, "uuid": "d18ae3fb-1635-47c4-91c6-e5d9ea0e2d69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413746, "uuid": "07d1d56b-ceeb-44af-9940-4aecfb1fede3", "value": "24576:YSwMBcM7SNuP/CBiTP+voc+5Gnnvr9G76mk5Nqm1aQh/7ddbMSk+f:MEcMFPrTYop8nvQ7lUIm1agsSk+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639413746, "uuid": "6a8a677f-cefa-4c34-b0da-e24d0bb394b4", "value": 1296384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639413746, "uuid": "34153696-736b-47ef-add0-e2234537d251", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639413746, "uuid": "9118a088-257e-4919-babd-c1e4d408fec5", "value": "JUSTIFICANTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f795b8e6-5c26-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639408297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408297, "uuid": "f6b4db37-9b2a-4800-beba-ef1371fe5ea4", "comment": "Malware payload (Formbook)", "value": "673a7ce098d2727d35f947a851fe991f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408297, "uuid": "e345bb04-cce4-48ed-9cf1-c5e95dce9829", "comment": "Malware payload (Formbook)", "value": "ef2fd2f5613dafce8f79eb4138965bd41613f62edd05be56d9529acdb058d2e9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408297, "uuid": "2dc0058a-c47e-465d-9cc8-5b1194eb95b4", "comment": "Malware payload (Formbook)", "value": "19cd1046d0113d7d43dde4b84dd7b2506beebcdc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408297, "uuid": "48a04bd5-45a8-4802-8458-6b803b9f8329", "comment": "Malware payload (Formbook)", "value": "828af93f4a8c8dbce37a27690815e1c15dd8c7d8d5f25c6f251be045668633a32f7f43dcf899c8da583e788d5a081164", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408297, "uuid": "1adb64b0-b5af-4bc8-9d10-e4042954f114", "value": "T193641200BFFF561FC5970B3A616FA61656ADCC3457670904BB4A7A0C23367C63A22E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408297, "uuid": "02f3333c-375e-4e56-973e-4a496650697a", "value": "6144:fItL7H0zM46F4POVq8kplxjhK0YeaBVADg6F3PhR+u:fcL7UzMHG2q8kplthlmVt6F3P6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408297, "uuid": "d805a5aa-e7e7-4877-b5f1-cd48ee9cd682", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408297, "uuid": "0c9dc9b7-d97f-4a17-84be-2a7e44b2ee3b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408297, "uuid": "c2bfa476-46fc-4c60-8376-05628f9b1161", "value": "JVC-MT103-BANK-DEPOSIT-SWIFT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d564a6ce-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639408669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408669, "uuid": "480e88ed-2963-4c94-9f20-7255276f0846", "comment": "Malware payload (Vjw0rm)", "value": "6d1f37247016404997f0aea71bf6d012", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408669, "uuid": "5c75fa69-fd99-41a2-8cc9-f3fdba5fab0a", "comment": "Malware payload (Vjw0rm)", "value": "f0df36fdbb9aa896e774335fdcaa9cb7f914682ee392117ab43a0c1d85d49a26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408669, "uuid": "eed96456-5c90-4b60-9f1d-09b3f8bfb582", "comment": "Malware payload (Vjw0rm)", "value": "13be69202507178c513345c60fbb111cb8f2ccc0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408669, "uuid": "43a3ec1a-e0f1-4a62-a49f-16524658d275", "comment": "Malware payload (Vjw0rm)", "value": "e4fac5e24520fab342369802ed7d0c27c746a21d325b9a7ee783e6d4af2e51527a5b4ceea4ca0c83fec4520ada8a3826", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408669, "uuid": "9dfcdee6-006e-4bcd-bff0-5750a07541b5", "value": "T187647D90FAD0257AAA8664E754EF670F23B8A15375019049F1D1F6302FFBFC0A61BE16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408669, "uuid": "ebdf4cd6-6538-4bb3-bc25-d861f72b82f8", "value": "6144:OaLfslZvvb4tNj0ncIQFZ2DWUohhuKQw5MgMaoXn:zp5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408669, "uuid": "9ad14e12-115f-42a2-9c2e-93d437691400", "value": 316975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408669, "uuid": "063236cb-1a1d-4dd6-bbab-2807e6d89ab0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408669, "uuid": "bc548601-4ace-4fe0-a81f-a8861cbb34b6", "value": "ORDER 211213AB.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e00981-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639425934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425934, "uuid": "54dbfb53-5cd1-443b-bee6-2827a068d687", "comment": "Malware payload (RaccoonStealer)", "value": "0b24fbcfbed6516dae6cc97e8459f13a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425934, "uuid": "e8c10069-914c-4bab-ab8b-afcd69c3184b", "comment": "Malware payload (RaccoonStealer)", "value": "f21a2fa48b72b3bf5876cc3ba39ded1e5891d32d403ef424407f1dc96cdddc65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425934, "uuid": "af3a4c2d-d107-489d-98b7-4eba6934c4c6", "comment": "Malware payload (RaccoonStealer)", "value": "7f1341dd37f153febb7028f6aae997524de39864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425934, "uuid": "9957d879-227c-4167-85d1-3747d852b067", "comment": "Malware payload (RaccoonStealer)", "value": "7e766ce7fd4c459ba10b0aac428ac70ba68ca41f0910ce02b9582b207128172381976110d85482d219d6fc7cf56cd6eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425934, "uuid": "8c3e2343-ad99-4881-bd9a-950730efb340", "value": "T1E0F63380DD65AD16CC153FF3F8B2EAD309EA598610665B362BC1188CF29BDC357C9392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425934, "uuid": "9f957b92-7f5c-4568-b933-f08b037e0d23", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425934, "uuid": "3913e533-170e-49c5-a7fe-d635d7950424", "value": "393216:JMELGt0KM7q+hKydWIYMPz/TWmhDMNWQTPtK3huS7Yj:JMEKt0KM7wxWz/TBoNWt3hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425934, "uuid": "c935f168-afcb-42ae-a08f-110ecd7369b4", "value": 16573704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425934, "uuid": "c9e30cac-9481-4abb-8945-85b639bd0d51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425934, "uuid": "98ccf2d4-dc0d-4d32-8d47-def0cec6a848", "value": "0b24fbcfbed6516dae6cc97e8459f13a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc61e1c-5c42-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639420305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420305, "uuid": "57b5c3b8-6681-4018-8efa-915f80054a06", "comment": "Malware payload (Formbook)", "value": "81166d6c236c735c7c2240ad902565b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420305, "uuid": "37760e26-08d3-410a-a794-c06aadf0b56d", "comment": "Malware payload (Formbook)", "value": "f26c1222f0961b3224ee32833c3b92a73a7117a680f0f3ac4ea6502b7eabb160", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420305, "uuid": "d780ea63-a1ef-42c9-a46a-96aef6730c79", "comment": "Malware payload (Formbook)", "value": "7a1a7d099c5cec836636d8d48f0274bfb83987a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639420305, "uuid": "3a7906b5-f93a-42c0-94b7-5e537adbb584", "comment": "Malware payload (Formbook)", "value": "f3f3c28f046fabc9c9f5eac2357bcd486b137a2fe45c1b51ccee3687fc9b53c34ea6f67f6736266b46eb9da84a1e5d35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420305, "uuid": "3ce20db1-e58d-4e6a-9adf-f325a1c1a215", "value": "T143F46B1132841B68F1FD9B759164440813F2BD17EB21FA6F3C987DCE3ABAAC78652712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420305, "uuid": "3f8c4ab4-f28f-443b-87ad-72fedf5276fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420305, "uuid": "2c1c7526-e6c8-4d09-9ed6-b0a4f40a3722", "value": "12288:+KC4C7JAoHyxHyeq0Ih/pv3Dy+etSG6+B:+KuA8insRfDydZNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639420305, "uuid": "da5f1707-d25f-4350-903a-582dfdbf90fb", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639420305, "uuid": "2afc8a38-91aa-4969-9668-35a4a8e6480e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639420305, "uuid": "6e55f1d5-aff4-4e33-96a4-86871c3c228e", "value": "81166d6c236c735c7c2240ad902565b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead020b9-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426314, "uuid": "6ec56961-2ffa-41fc-bd9a-441e6bf0ce1a", "comment": "Malware payload (RedLineStealer)", "value": "80bc1183c4d901de4fd1365eccd0f147", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426314, "uuid": "d69fc0f2-3853-4583-924f-c588bc238105", "comment": "Malware payload (RedLineStealer)", "value": "f2b68fa107745b515e611eee99231eab7e03e022b4ff8af2bfe3b779ffbf61c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426314, "uuid": "5ef2cfe2-2b70-48c0-abf1-c046bb0cc682", "comment": "Malware payload (RedLineStealer)", "value": "d725b0664493a90ff4538bdc5f98d6161748e501", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426314, "uuid": "0e5f19b0-090b-44b1-ab83-7534cc8664c6", "comment": "Malware payload (RedLineStealer)", "value": "7adb70a4ea9d848c80bbbab0d1b75ff674097bb7312e7472cabb5e0b62613b06dd72e3f5c43657edba153760c5a41305", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426314, "uuid": "e5f33e4f-3d6b-4863-af58-8d68d152c58f", "value": "T13315234BB6D11117F6FA1771597A1F5A963AEE11EB168E6F103723890F20B41C3A2F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426314, "uuid": "2334b3b5-e667-455f-8a6c-c88d7bbfb19a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426314, "uuid": "4cb5a7ec-a389-455d-88ac-309560894ed2", "value": "6144:ja+R/8xXfvU2GRWqum6SAmgUSttRIqeASIXsQCVx16/RIZnXnNQGeNeDhfgAJXzz:Oesy6NtXAVN8hWZJHVxrNjH3M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426314, "uuid": "aebd720d-cc62-482b-ad4d-4005c8ac13d6", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426314, "uuid": "eaf24117-965d-4dfd-a7b2-b898e962b202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426314, "uuid": "7a311e44-9488-49ce-a442-d0cc7ed1559c", "value": "80bc1183c4d901de4fd1365eccd0f147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f038a08e-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639386810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386810, "uuid": "d210178e-d05d-44a9-b115-03184019c59d", "comment": "Malware payload (Mirai)", "value": "bcbc638fd6825325e1fcd9b1384ca536", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386810, "uuid": "1a514881-72e6-48d4-8a27-880843e33953", "comment": "Malware payload (Mirai)", "value": "f2b8ffb6f9ef9bc19eb91193cf2873b9614703b53f2305e9aa92a3aa6484b775", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386810, "uuid": "7046e80f-7bf3-4cec-8c4f-47fdb879df44", "comment": "Malware payload (Mirai)", "value": "d8cbc9eafc437aa25f4cdccb21c6985bfec05aca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386810, "uuid": "2d0de01f-63e8-43a0-b3ba-f8078b35b54b", "comment": "Malware payload (Mirai)", "value": "69a1d8b6d4102081118c1017c875d34ef87fa51878b750814b802b9f55506d4f3bcd73159322db5066a813ecaeca08b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386810, "uuid": "607d075d-6df2-436e-be47-1b2f4e5b70c1", "value": "T1EDB31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386810, "uuid": "9492b9ff-f94a-4945-bb58-4528d6ba9f1b", "value": "3072:MSY+46m1qOzssXFPPKNy+AmkZrQAhPDCXFke:06mgOzJXFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386810, "uuid": "e11ce7bd-1285-498d-b9d0-48bbc7f2d82c", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386810, "uuid": "dda5caaf-f914-4320-8370-d989bb44b5dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386810, "uuid": "7b08b197-a99c-425b-babe-daba0c2d4309", "value": "bcbc638fd6825325e1fcd9b1384ca536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fa629b-5bff-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639391274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391274, "uuid": "a807ae25-ce44-4e8f-9f70-40ef057cd0fd", "comment": "Malware payload (Formbook)", "value": "8fccd3d8b4805b7c5e798263deaeb962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391274, "uuid": "fbabf49c-40b4-409b-b667-74b1a383c735", "comment": "Malware payload (Formbook)", "value": "f2e3630215bef9f83d1daee768451f8828f82ba8088258da3e01ae7b85a5af17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391274, "uuid": "7991dc22-5621-454f-be0e-7b1cc77f188e", "comment": "Malware payload (Formbook)", "value": "3d93b62c187903444f9a136a474727b6c9631ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639391274, "uuid": "dde5bf9a-3161-4a11-9e00-1e11d64a939e", "comment": "Malware payload (Formbook)", "value": "5e68386ffaabeb296adc3044e90490bb4437db4df133a864234b026b171580243300a93127ec7ab66a78d3806ad2ce07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391274, "uuid": "c7c4b1b9-5752-4bf3-9665-035cf12fce28", "value": "T12BA41236A9C49757F5938D78E56D3F2DF2FA8D8822205792CBDC3FB1E9F119242085A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391274, "uuid": "2959c49b-e5bd-4d7c-88e4-dbf33c449132", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391274, "uuid": "e0a0d84b-2521-4005-baa3-68293471c93e", "value": "12288:DKBRAtAlBs5UhtAVhDMtM1m0/dPBAs5dSt20PXmMU4/:DKBPlBs5UL2I6c0/dqEkt20P2fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639391274, "uuid": "5262519a-89cc-449e-bf4f-3a3e5a4ecc69", "value": 489294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639391274, "uuid": "8f10469f-7d24-4d31-8a19-4e52b6e4f0d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639391274, "uuid": "b0852c10-1240-41fe-86e9-f92bee75a754", "value": "KARTALSAN (OrderFF1197Q) dec1321,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0407423-5c5f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639432712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432712, "uuid": "3eb649f1-d349-4428-b5f1-354c24c17634", "comment": "Malware payload", "value": "cd3313df7efefd7f7f22385a7aecba43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432712, "uuid": "5da97f9a-882a-46d7-b513-3128e0cb2e3f", "comment": "Malware payload", "value": "f2eb59dce0ba82c2247584dcbc7f6482e7739421b210947227755c8077480e16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432712, "uuid": "72c500c1-e30f-43aa-8584-8590c05f995a", "comment": "Malware payload", "value": "12eeddb03be317572a09391ddf47644660137dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639432712, "uuid": "6b6e523e-9dbe-4e10-a042-f15322fab2e7", "comment": "Malware payload", "value": "4bf4266c69bb61678bdd0cf80a39f4a2d85182ac564db7412756f120183ec1cc32cd6433fea60057235d4ad85bc9655b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432712, "uuid": "a8df33a0-6585-41cf-9565-99d043df8770", "value": "T105057C1172841BA8F0FD9B799414440863F6BD16EB21FA4F3D953DCE36BAEC78A12712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432712, "uuid": "1c5fd929-9f92-438a-96f6-a0398925a645", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432712, "uuid": "25f78e80-5b7b-4d62-bea7-659b848f4712", "value": "12288:x+PC7JAoHyxHyWWvtL+xYsGlpnPYbk1LeP73eV:xA8i+tYcnAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639432712, "uuid": "2eb54cfc-03bd-4490-90ff-78435836a9dc", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639432712, "uuid": "0a6a298b-b528-41e6-a4f3-b412584fe78a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639432712, "uuid": "4fa09f6c-bc09-4860-a776-e11e85926260", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.6627.5504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec0d869-5c4f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639425918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425918, "uuid": "a3fef3a7-4db0-4471-bde8-37dbadbc186d", "comment": "Malware payload (Loki)", "value": "abb2534013892b17b41b42337b50d268", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425918, "uuid": "1b2c5407-6f1f-4f99-be7a-f283ebfb035a", "comment": "Malware payload (Loki)", "value": "f2f2ca0270f09f8dad3e9d83d691cc3de1dc0d14cd15faf133994bccc7d83b2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425918, "uuid": "2ff08c85-1389-4fac-82db-ad7a0fea0c3e", "comment": "Malware payload (Loki)", "value": "98e6107b0c2fe8f47f13a1dcd89346078affff5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639425918, "uuid": "350f8281-36a9-4458-85e5-d8a8aa9573ee", "comment": "Malware payload (Loki)", "value": "fbd1604f8fb8e662814f530050093cf2d6fe402f68773d7ee1ae348844cb4676e099f8dbfb29e8934dd5e3f57ec52f1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425918, "uuid": "2bbc826c-5ae2-4b41-bf98-6d5824aa773e", "value": "T1C1A4239DE6D18BABF4C08D7118B8673B63F2D54801D029776F619BFF1C63E9586A4034", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425918, "uuid": "2889c3a0-ee8d-45fe-be60-f5f9f4805070", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425918, "uuid": "8d563f3c-db72-4615-a9a8-52ceacab7cc0", "value": "12288:O1yfmYVuqIAZA2PBwCESl29JygFrZY0s5JfJcESPgg6ExAgjG:O9GZl1EQ6TFrZ5EJwY6xAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639425918, "uuid": "c2873404-8662-485d-966f-093d8a5d7dea", "value": 467661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639425918, "uuid": "5caa8ea1-34f3-42df-adaf-dfc9317fe1a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639425918, "uuid": "0793cc7e-0d50-4e23-8405-8ef3c5e7143f", "value": "abb2534013892b17b41b42337b50d268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1dfa5f-5c52-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639427202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427202, "uuid": "718aea9f-eed6-4872-951e-576f09061ec5", "comment": "Malware payload", "value": "5fb8ede2cd9f3aa1e7684ff1888a27fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427202, "uuid": "a6912a57-b8b1-4f5d-89cd-aed67516c766", "comment": "Malware payload", "value": "f3be908d94e3a77a02f0e483c24d5029fa67a25c50d25eb9fe132db5087f6c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427202, "uuid": "b126861b-d460-4fac-95d3-74e5d3273014", "comment": "Malware payload", "value": "22b1bb1ed26aa29313128a17d8ee53da56d4da4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639427202, "uuid": "352bb17a-f7b4-47ec-9884-5894ad998d61", "comment": "Malware payload", "value": "b90bb0a1b4cf06de411cded84a67b80f6e83ab0e2af4421ac0df4de66c9478784460f329f2ed20ec2b044981695ba522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427202, "uuid": "04573c82-d3aa-41fb-85f2-88dd5962a38f", "value": "T108F1C706B7E90337ECAE4B7A98B3471013B2E7154D13CB1E6CC8815E5CA371419A2BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427202, "uuid": "abb253d5-6bf5-4318-89ce-70c3c10e7872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427202, "uuid": "b90dfc0e-8ffd-4596-bf16-7ed1cd1c6fbb", "value": "96:iJOujlmu1B9ilJJMOfdkdqIKozt1ofhs5k6zNt:8LkJBGqI3oT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639427202, "uuid": "4c542571-601c-4840-bda2-de288b5e740d", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639427202, "uuid": "6de3b3d0-afc6-4a11-a6cd-91e445efdff8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639427202, "uuid": "1013f6ea-8106-426d-a867-108075534af6", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56876565-5c50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639426066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426066, "uuid": "a6b098ad-b4d4-4299-bfbf-fb2e4669f648", "comment": "Malware payload (RedLineStealer)", "value": "fc648f3693f8f968585332fa99766a83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426066, "uuid": "77cbc7c7-3438-4aae-9dd2-f8c2d9a3cf1f", "comment": "Malware payload (RedLineStealer)", "value": "f418a66d9ef0845b02267e562d1851530c59630af3c174200b662e90d66b5dce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426066, "uuid": "9f7cc3f4-fd18-412b-88b2-ec82865ba6b7", "comment": "Malware payload (RedLineStealer)", "value": "c5619fb1fdbd2873c0a041297602ab84909e0f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639426066, "uuid": "5474c7d9-a945-4e54-a618-c9262267f6e1", "comment": "Malware payload (RedLineStealer)", "value": "094bd82a94195594f2ba28b3e4fdc427350a038b8c6ec868071d2dabb8d34362646f2b6173ee27c054aabc01ebc8ea10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426066, "uuid": "afeaf3d8-90ef-4457-a7fb-d030ef1b33f7", "value": "T1F174E0D2B6E0D831C2A2693144319AD41E7BBC42F9F0859B37753B9FAF726C0766131A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426066, "uuid": "a1ffc714-2900-4633-b55e-555c831490d8", "value": "9a7d8deb9f5b4ee77055264204973361", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426066, "uuid": "bd29c0f5-8ed5-4ca7-ba70-868ec9102d3a", "value": "6144:n9L+bQpy8abDviHe09de9d8K+HqXrf4b7ITsqOo:9LJVkGHe0Pe9d8ZHqXrw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639426066, "uuid": "c31583c8-58bd-4e14-99f4-2322d548b2ce", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639426066, "uuid": "1505b6ce-d5ad-4a3a-beb3-19fcfcf7f1a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639426066, "uuid": "12e6c304-b997-46c9-b755-8f3f1fff533e", "value": "fc648f3693f8f968585332fa99766a83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecbed7e-5c3a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639416577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416577, "uuid": "beb908d4-3165-4acc-8a4f-0faf636ecccb", "comment": "Malware payload", "value": "603270db2e18a27983e7157ea17fff73", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416577, "uuid": "9dbe752a-82f4-4041-b3ae-692b0e7c9aa4", "comment": "Malware payload", "value": "f42a4cafa083af7442789798767ecd3e70a07a379bb9b59c5381766ca5a5040e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416577, "uuid": "cc08f60b-698e-4e7e-b538-bb199f267da7", "comment": "Malware payload", "value": "ca7e73cbcdc2ce02d39cd932d5160418b787c6f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639416577, "uuid": "4eeedf63-934c-442b-a717-fb206c8568f4", "comment": "Malware payload", "value": "50c8f7cdf05a525366c8a19b76dff3e61d347bf8272898a68fb248cb8982d8caf4466ad05ca02ae83db55a9c0435dc42", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416577, "uuid": "f361e522-47b7-4f5a-8e45-3f5f531de164", "value": "T15855AD5A72554DA8D9B7D17CC4438F47EAB074058370D6EB07A49AAE1F233E21E7EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416577, "uuid": "1e82b2f7-d194-4a44-a34f-734207657294", "value": "4ca54a6ae85170224dd88abf6fab85e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416577, "uuid": "dce94031-8e91-44f6-9ad2-cadeadeb580d", "value": "24576:dRA6sowB/ClOMz8vRo1ntOl6khOIz9KT+KcusA30OrvocMhFsahF4DN36:dRA6/wI1kRo1cgaHIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639416577, "uuid": "048d75f9-b135-4cdc-8966-6267f14abfd6", "value": 1404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639416577, "uuid": "b55324a6-0843-4b99-9a11-52dd552684a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639416577, "uuid": "a4456f1c-18bd-4557-8ef3-127c7e89bd17", "value": "603270db2e18a27983e7157ea17fff73.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913c7ad6-5c27-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639408555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408555, "uuid": "d5690564-e19d-4650-808d-88f0a2fb8a7e", "comment": "Malware payload (AgentTesla)", "value": "5d0a4d1be567d778aaee8f099be2f4f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408555, "uuid": "b9d6c4c4-2a05-4722-849d-7a98cdcfce14", "comment": "Malware payload (AgentTesla)", "value": "f42c5cb353f36e26961f9e2f033625b35abc21f40745369d92beee6edc8a7b95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408555, "uuid": "1933c780-0dab-46cf-bdef-194c8edf055d", "comment": "Malware payload (AgentTesla)", "value": "d1c69cac55ecb2a8dc8e2dbcd611fd2a8d26e4ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639408555, "uuid": "5a638aad-eda9-4818-983c-c7c8899b1e8b", "comment": "Malware payload (AgentTesla)", "value": "42e9813cb77bd4474e8e3e694725573fd319195ca2d136402a3bcc0203496d44935c4035e12408ef73cce3d2292754cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408555, "uuid": "b1742684-bc83-4820-82b8-13bbdd51fae0", "value": "T1F155330B3968CBDBCA78DFF848A4879207F098453E53FE244DDD30CB9925354A9526EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408555, "uuid": "9c428773-a442-4cbf-a895-2e05b8c089db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408555, "uuid": "33eb3a75-2587-4b70-ad7c-bb525940d252", "value": "24576:AjdWEsI/iJe3po196f0SsNlOHu8cTSqpL3eAybEnWflON2Ow9O:BEXZw96fPsNlOHHceqpL/ybCA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639408555, "uuid": "6c565ff8-7611-4648-8e34-eccd14289463", "value": 1313792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639408555, "uuid": "32a61067-36ed-4ec0-987f-91c193762745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639408555, "uuid": "357bd6e0-e443-44f4-98e1-3e8ce7df0628", "value": "Notification_TNT AWB_IMAGE CI_IMAGE from TNT AWB# 167095453.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4609ac9c-5c23-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639406711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639406711, "uuid": "4e587af4-3040-45e4-b6cb-144ecb7039cd", "comment": "Malware payload", "value": "6e1d94449b0ec945834b157e3896f76c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639406711, "uuid": "94ce8c7f-a9c6-46a5-8392-7fd19378d3dd", "comment": "Malware payload", "value": "f4fa0889ce512087907fcfad23245827846bf20849d75660042e399e62c9c0eb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639406711, "uuid": "51ff486c-ad67-473b-97b6-12d6355f9765", "comment": "Malware payload", "value": "99a4cc44275be2f0b35a248c94e8a745a180e8a4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639406711, "uuid": "e5231b83-5605-41d9-83a6-68d0824227f6", "comment": "Malware payload", "value": "60b76e46057b222fdf5d162bec1176a2516bb314d2b40f87c5af67c999e2eeaf3cc6e6fc8d7ef7fdc27c981e66a7b91f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639406711, "uuid": "c18ce5fa-8e4c-4912-9d6a-f0062a0751ac", "value": "T1D0E12B59427264A4DF2AB036C2441609B329B565138B2E13FB309CAD79FE79F8708238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639406711, "uuid": "7c1d7558-3bdb-458e-ab6c-bfb87999e069", "value": "192:tvFeNpOw0OV8vdQjmh6okXLxzYuYfc37sPt:t9eNpV8qmYokXFMuYfcLQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639406711, "uuid": "7664ed24-9306-4159-94cf-c70fc272cf1a", "value": 7177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639406711, "uuid": "fe74ab87-2b71-4c33-b132-de02a6a370ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639406711, "uuid": "35ef465e-bad3-4312-a6cd-a26621c017c4", "value": "PO_2021134_from_Raisman_Corp_52360.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9ff27d-5c1e-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639404843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639404843, "uuid": "165d9b60-8d3b-4b6d-b366-d40a3622269c", "comment": "Malware payload (AgentTesla)", "value": "813b953c9bcce168182188a55c26cb85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639404843, "uuid": "c3496cc0-29b3-4105-bc68-78965a373838", "comment": "Malware payload (AgentTesla)", "value": "f5351cf0d32d85c301d09fe225a4a4f38211cbb7c332e93218651f3b06a15208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639404843, "uuid": "7e515385-e9db-4c89-96ad-149e98b7a35f", "comment": "Malware payload (AgentTesla)", "value": "203823916eb54d6bd4240cf7ebf6945c5ac9ae06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639404843, "uuid": "50f2db0e-1729-4692-bdf4-14cd5c20201a", "comment": "Malware payload (AgentTesla)", "value": "4bd0309f1b2d0b30cdb070d557836d76d6a5ae853fb09151d1b6b8963582406bb81ef0ac24ad3191e6daf4d8e416fe09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639404843, "uuid": "ff637b63-8f5f-425d-b24b-5f873455f01c", "value": "T1EE2419166315D560CB5F417FC016821831B1D707972AE7CF1AA6D8FA2F822CEF92B9E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639404843, "uuid": "5024de09-eafe-48a8-9e78-d031c1564729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639404843, "uuid": "2a1425a9-506b-40aa-9e61-e9e067b65cb8", "value": "3072:J9WM1VTfp6JySfvD0gBGmUiIcEmZEybbSrIsixaI8aNrL+GmrDHJONrEUAVRn:J/0fvn1UJ0E4rJ/3mrDH+AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639404843, "uuid": "691905ac-b30d-4c3f-a5d5-855218fa87ab", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639404843, "uuid": "be2ac846-c4ea-4c99-8ba7-09c03538895c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639404843, "uuid": "ba8c6eb2-b6a8-49dd-8836-716af6cd964a", "value": "OomshaOlhWebLJEaTDudeXrVzUXdgWZbAlWCWEp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f188802-5c38-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639415853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415853, "uuid": "d8c7cac6-b1b4-4a34-9c1d-557f4b300dfe", "comment": "Malware payload (RedLineStealer)", "value": "52bfb6737cddd526440db9afea8c27ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415853, "uuid": "78d7b65b-8d23-4b91-af76-e85c29de4895", "comment": "Malware payload (RedLineStealer)", "value": "f5466925d877a564e58ea5204eb2f78fb3ae123b0561a9e6cfdf78d9173e30d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415853, "uuid": "b597aafb-b3a2-4d41-bb1e-b87331f7e2a0", "comment": "Malware payload (RedLineStealer)", "value": "4e3c02c916ef3da78a92b5ff80d9e324f849d6bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415853, "uuid": "691cad3b-5077-40b7-9b4d-47bf707a905d", "comment": "Malware payload (RedLineStealer)", "value": "8aed04b137b0a3456b2e7e1fc4d45c39ed061957da66cb19655098fe3bbbb1f1c87a05f6413e08afe2c74e930ddba510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415853, "uuid": "6e93a713-b392-47db-a7e0-d6f33b690a25", "value": "T1393501B176005ADCCD78CDF0457BA9B15B2BADFF89845C01A8E9F31B05E615630AE32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415853, "uuid": "f624a92e-3f30-4784-925d-7f1ae54abf81", "value": "407fc3943505f27c898ae308e6c4f2eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415853, "uuid": "f59b046e-ff88-40de-a7ab-52242534eeee", "value": "12288:NMouiR9XvIrX898I58tD6fr2UnwR1LGd6oz5Ym9YpNBwaurXC9BzLBPsA8OX66n9:Nrnv8dSwzydpem9YpNxsYBdN8OKaR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415853, "uuid": "034490c1-7359-4a1d-b8ed-b5ceaac8e317", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415853, "uuid": "5555576b-cb22-424e-94df-79921bc2fe8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415853, "uuid": "8c22cd1f-6bc4-4a27-ad90-76bf88302a9c", "value": "52bfb6737cddd526440db9afea8c27ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fedfd8-5c04-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639393505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393505, "uuid": "87b468a2-72d6-4fc4-bd3d-2e4d788e7ab2", "comment": "Malware payload (RedLineStealer)", "value": "0b35f65b4fd3568ddd315b347ff08163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393505, "uuid": "552f47ba-9343-4d2d-9f68-2e76ea7552f9", "comment": "Malware payload (RedLineStealer)", "value": "f570804b4021efcc2376cb10846bb39ba2c9c9c9684922f9a47f45d9f7d014a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393505, "uuid": "ec494bbd-326f-4e8d-ab0f-78bfcb803f43", "comment": "Malware payload (RedLineStealer)", "value": "a64b3e9cf510273ecbcdf8db05ff2cac28a6ebb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639393505, "uuid": "e56bd196-a9b9-4b8f-9592-1f8d3c6301ec", "comment": "Malware payload (RedLineStealer)", "value": "5f2b4b6be5804bfd1ba024042c37da5597cc87647ec8b6b30e8232b329afb0fd9073bdebd4af44cc7b8ac34e3cd739b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393505, "uuid": "7230f2ee-9d5a-4d45-bfd3-3ee28ea2fec8", "value": "T12B049ED176D2C471DEA37A304825ABE54E7BB871E934894B377416EE2F732C05A26323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393505, "uuid": "338c4701-db20-4ff5-a9ad-4bc3ba7c9f64", "value": "d1ea32d3f97aa7d1ecd37241773a117f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393505, "uuid": "93d7081c-984e-478e-af89-6903e0016cee", "value": "3072:yzD0kuGlw1TgaV1snf2M5cGmg6ghsZVggjcGkNIVqIC52:mllw9gaVvdvLb7ITsqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639393505, "uuid": "c16e0a0a-093c-4535-9c79-1fc19176b7f6", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639393505, "uuid": "c6c0f3ae-35c2-458d-972a-a66dae121c62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639393505, "uuid": "4108bcd4-33ea-4eeb-951f-c746eb991067", "value": "0b35f65b4fd3568ddd315b347ff08163.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69296fa0-5c1a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639402904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402904, "uuid": "ba8ae276-c20d-42a0-ad14-a47a94865875", "comment": "Malware payload (Formbook)", "value": "4f43f18b72e71fce5ec68780f072e3f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402904, "uuid": "c71b8a61-9d97-426f-9fcd-07a4772aed89", "comment": "Malware payload (Formbook)", "value": "f585f94bedb59e076a9dc4f48556b11d0ca83125766d58aa8b76a433f2a33c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402904, "uuid": "3458676a-24a7-45e2-8c9b-e2c688bd4494", "comment": "Malware payload (Formbook)", "value": "0cbc2b41ea17006a27d3cc1846061a62717dabf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639402904, "uuid": "3479cfd8-a2e9-47a7-9f05-4b4b179d524f", "comment": "Malware payload (Formbook)", "value": "3539bc02d75470acde5136587ab37cad3c91abc518bf5d12303a39d94c677aa272b8f9b2a781e6c3d3ab2755962d12ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402904, "uuid": "b7fba979-252f-4fec-8140-d8cac8025559", "value": "T1AF55234634DC8780DC7A4BF0AEA32D001774B212243AEA7D4CCE76D66F467C98656B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402904, "uuid": "358f1e18-00ce-4f4a-ba61-ae088c068e5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402904, "uuid": "7c7f4725-c51c-46f1-a18d-8f4f179a8964", "value": "24576:nlDGTkv4/f8uu0UPyAOF3s4HCketnQvA3z5F7Jpq6r:lyTlXU01AufsFVpq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639402904, "uuid": "0ed72dd6-90a9-49e4-8845-7305dc4634f8", "value": 1284608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639402904, "uuid": "7fa739d7-ea31-4a35-beda-eccc28270e26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639402904, "uuid": "97d50843-2c00-4a23-b7c2-c3e924f338fc", "value": "king.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a803735-5c37-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639415281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415281, "uuid": "ecdaa054-af63-468e-a74a-8e921234fac0", "comment": "Malware payload (RedLineStealer)", "value": "ad5108e56b32238e7cdf4d202135d8cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415281, "uuid": "4439e55b-9938-4b11-ac31-a148ab5febd5", "comment": "Malware payload (RedLineStealer)", "value": "f5c1f3adca50ee52c46c51e919338b04078f4eb9fc728df98eaaab0f862f2582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415281, "uuid": "8d6ae4ec-bada-4da3-83e2-6d08f20a3f89", "comment": "Malware payload (RedLineStealer)", "value": "23fa896c999cd1a83834efb660739ef3695ced2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639415281, "uuid": "7c97330e-db0d-4431-a370-7288c08e1952", "comment": "Malware payload (RedLineStealer)", "value": "fe9176c7ba900c192c486072ed76a7da852c41576323a962c136b3006313614d10c5dcde1a66c644539a87c0678ddeb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415281, "uuid": "ab193e2c-3552-46c1-a4ed-708ec1fdc6e9", "value": "T1EDD401CEB480C1B2E5A2BA71487196A55D7BBCE2FA61D50A32742BAE5F713C00D35337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415281, "uuid": "4e38f81b-147f-4122-9510-ab3a6d686d8b", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415281, "uuid": "40650325-6211-45c7-bb4b-285a1b257d98", "value": "12288:1/uQBjwmxrxsVE7+SnKQJy8OZljOq/FsgSMfqhxhmt2gv5mQ1pu7N:1/uQWmtaVs+SlJm/FrqhpSpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639415281, "uuid": "8a9a3dd0-6e40-491d-ac54-15eba7af0d36", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639415281, "uuid": "ab8460fc-538f-45e4-827f-250aaff0ed2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639415281, "uuid": "2835b1a8-6374-4842-9b2a-6f67d034ba0c", "value": "ad5108e56b32238e7cdf4d202135d8cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdb60e2-5bf5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639387232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387232, "uuid": "9fa40ed6-d9bc-4f77-ab2f-650cbe2668f2", "comment": "Malware payload (Formbook)", "value": "1e737dd92af48a779d2b9b394017603a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387232, "uuid": "3b517425-caa9-4f65-b17d-c19765ab465d", "comment": "Malware payload (Formbook)", "value": "f5e7af62bec34825a548b4d5f39f65efc22905c4806efa6d35e1e0d4b02dfef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387232, "uuid": "c2af1ca2-d147-4640-a9df-dd40fc0fa6e0", "comment": "Malware payload (Formbook)", "value": "f22a3534913d994fb5c05cef3a6b621b5982fafd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639387232, "uuid": "d1e7b4e1-1fc7-468c-8b0d-ec0d1a9e5d17", "comment": "Malware payload (Formbook)", "value": "7b80b2fa2f728c3e585e87a5dae682c202e0fdf7c15ace346709460f1bae88f3bc8f94755a77e04cbdcb4a455ffc7445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387232, "uuid": "07f2f3b1-1d30-48f9-b4dd-e1e6a87c0c60", "value": "T1A555125973A88D50E16E0BB991B1C2308375BE10AC16D31F7AD93DAF7E73B908A05B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387232, "uuid": "e000cc40-58bf-4749-9beb-82bd786a2a12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387232, "uuid": "81c3b9b2-8590-43e2-9b10-590024e7462a", "value": "24576:rfevr+SwcesEtwskZ8GfBkHY2b/5o20KvLE9Dp+4trvNddIpXOHtEga:rfeCSJataz6H15f9vLKpvvhIhOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639387232, "uuid": "5cf927fe-abca-47a1-ba9d-6d9c364f3dd4", "value": 1339904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639387232, "uuid": "cdec49ee-62e6-43d0-a2e5-6a5fcd1d9d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639387232, "uuid": "1a2ec223-1e80-47fe-afca-b717f93e8e4f", "value": "Statement of Account-Invoices Overdue.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21b2022-5bac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355809, "uuid": "f900771f-b09c-48b6-b96b-b5036951d287", "comment": "Malware payload (RedLineStealer)", "value": "702db2fd777d09bed481a2bda21f3a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355809, "uuid": "60f6baba-1ac5-47c9-8ead-3824a7ac40d7", "comment": "Malware payload (RedLineStealer)", "value": "f6252db276c85858dd3e4a8c83b02e134434421e1c92f2fb06f7ce9588326e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355809, "uuid": "08787245-6a21-422d-89dc-81096741dbb9", "comment": "Malware payload (RedLineStealer)", "value": "7a9036ea3d5e2a3f3cafaf7f685cc47c2f2e4a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355809, "uuid": "7a1fb9ca-9785-412d-b0c5-1eed42e82264", "comment": "Malware payload (RedLineStealer)", "value": "59209a9c931e23cc28fae5ecb9225fdea8d718378539a536762a188e10b62518fef0496dcb6b803eb3c8581f32dfef44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355809, "uuid": "57bfe597-ec90-4998-84fb-87122d41067a", "value": "T1F164E1C276E08572C5A23D305C6DBB940E7BBC62FA60C58B37781B9E5FA27C15626313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355809, "uuid": "1626f8db-8d52-4e7d-a4a0-585000cffa56", "value": "307bfa2331726fa806b2240a5641cf4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355809, "uuid": "237be98e-beca-4f93-880f-958e0b66ac76", "value": "6144:MZwEEqWYfM/nBS3lCbArdvZdwZTZQdmsx+iwZJ02xOtPXgp7zDXb7ITsqs:KwZqRfMvBWvdvCTZQTAv82ga7zDL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355809, "uuid": "b691136f-1068-4399-be92-c52da77affe3", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355809, "uuid": "66a924c6-8431-4bf6-abe5-48062702405f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355809, "uuid": "016ea8be-89ee-450c-962b-021dfbb6a887", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.8282.13759.13382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e063b9-5c30-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639412220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412220, "uuid": "46b63f44-29f9-43e4-99bc-5a503bada6e2", "comment": "Malware payload (Formbook)", "value": "210e05c63fb4fbc349c5a3b6c19ff0d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412220, "uuid": "be19fc62-9460-471a-8692-99c7e3a9761d", "comment": "Malware payload (Formbook)", "value": "f80774cd7c699a392d2824b7b645a95fa0864d5a73c867999b0c5640d3011aa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412220, "uuid": "2fd2303b-f787-4a93-ae83-f294ae9e3f2e", "comment": "Malware payload (Formbook)", "value": "6d8302661b4a2ae9b124cd208eea837f9f861465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639412220, "uuid": "716c2994-5aae-404b-805f-c3e764f3e881", "comment": "Malware payload (Formbook)", "value": "967c14ceca0b99df35e762dc3267fdf7726d8669f1274a638151e0d57c8970b63779df07ce63bd3b5bd391c0befe9501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412220, "uuid": "cb72a0e7-1721-4de3-a912-049d2b7a1020", "value": "T173552393B580C615C93D77F28CC64A041379BD3962E0DA9E3CEE35AA36B53D70901ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412220, "uuid": "6ab7eb3d-aff1-4e41-99b4-24fee9f17b81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412220, "uuid": "5521aecb-f69d-4c18-8240-d3a7a4282804", "value": "24576:esLB5rF5VyF3noX3P4VBUqc+YhX3dXZkSHmcdiZNimglK4k9:llxNyF2/bhlZkfcQ7imgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639412220, "uuid": "a9e62ae2-d091-4ec2-ac4c-94e82f07799d", "value": 1304576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639412220, "uuid": "9031f2c3-fa76-4863-83ac-327abc69dd3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639412220, "uuid": "84e7844e-fef7-4d7c-b4e6-2007446a9232", "value": "PAGO DE IMPUESTOS FACTURA LUNES 13 DE DICIEMBRE DE 2021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700e29e1-5c34-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639414082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414082, "uuid": "bcc26fa7-ee1f-4eb7-804b-346717f41499", "comment": "Malware payload (njrat)", "value": "60cbf379417e56390753d9c9482b6cdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414082, "uuid": "4536a564-4921-4f1b-9ee3-2393d2da4448", "comment": "Malware payload (njrat)", "value": "f8273bb883ff7a73e822a067d5459f0c0340d6d1615d4adee46ef12dd673b77b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414082, "uuid": "6a3b679d-67c3-4efe-8cd3-a5b7e22156aa", "comment": "Malware payload (njrat)", "value": "33e882b9261c7a286d94490846e1ffa26568f28e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639414082, "uuid": "0bf42c01-c5f3-4b09-8dee-54392ea2d3cd", "comment": "Malware payload (njrat)", "value": "3575a5b137450e436530e0ab4f7971bc8bad7c7db129bb4d52aa49358cb00bcc3ee0e37bb79fa4b5221b68e7e5775310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414082, "uuid": "5b02ed31-7bcb-42f1-a72c-e38a5ccb6cda", "value": "T16CE20AADFBE64466D2BC0AB50571950013B4E103E523F77E4ECA24962B6B3D84B88DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414082, "uuid": "7746d1c2-c3aa-4132-9a43-2afdd1c0f4d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414082, "uuid": "52fd05b9-3e4e-4629-8d3d-26dd36353ca8", "value": "768:FFG5TP1/plIzxTCfVYAvN1Zvy/QmIDUu0ti8Xj:Sb1ay/YQVk7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639414082, "uuid": "0212d4ef-38ae-4456-bd5d-56921f1f21a9", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639414082, "uuid": "5d788779-f679-4f33-892d-2eedc557c863", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639414082, "uuid": "7112c6ef-794c-4a85-bfc9-92fdd83c0237", "value": "60cbf379417e56390753d9c9482b6cdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db61846f-5c12-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639399660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399660, "uuid": "363c3d48-7f4e-4af5-a96a-db0b694c3e13", "comment": "Malware payload (ArkeiStealer)", "value": "2827f97b0db919c3c6f3c64953ccc4c8", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399660, "uuid": "cfc48160-1cc2-46ed-bb7a-eb2c0e81c604", "comment": "Malware payload (ArkeiStealer)", "value": "f84bea2aa311304b341da66a0b0491f537ecd30c2d7298326686b0ffc9a64435", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399660, "uuid": "41aaea00-f577-4d04-9480-5ea35b9328ba", "comment": "Malware payload (ArkeiStealer)", "value": "ab1ea1a9adc7c4016100d5c0c0fa82f013f7cc5c", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639399660, "uuid": "ba62005e-b38e-416c-9933-6ace8972ad0b", "comment": "Malware payload (ArkeiStealer)", "value": "79bf3bd21785ef03adcc688b5cd4c4bd2adb0fa1217a4f234cebbaef4c7475e9cac721c643b9428de4b0e9cc05486bfe", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399660, "uuid": "bb8767a5-afcb-4acd-96f9-14942b2c1588", "value": "T199F6335D4D602F038F81A5FB8BED9051C3C9735E52D2A28F5600ADCA9EF8C6B7D44B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399660, "uuid": "25aea2b2-602c-472f-a4fe-0378a594a66d", "value": "393216:BktQNlv+Mt2K1nNfcMiHXooR5lu3bjMkfDd0Fn+szA7Ytp:atY7PniX3PR5lu3PLZ013Ltp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639399660, "uuid": "4ccfd53a-6915-4b2c-a414-0d63840b444b", "value": 16427656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639399660, "uuid": "d3b7b908-4493-47ec-9e1b-9393ed8b33c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639399660, "uuid": "85344fd6-248b-412c-9bed-1b0541ffdf7e", "value": "PASSWORD_IS_324325____ScreenHunter-Pr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c9f079-5bf4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639386703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386703, "uuid": "d9e976d4-a3d8-4b17-82a6-0428dca2e5d1", "comment": "Malware payload", "value": "3bddac52d570a956b4229d85795a0dc7", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386703, "uuid": "08084abf-f569-4930-96f5-29460e7f278c", "comment": "Malware payload", "value": "f955df810b77345797cb5e437c7224c8bbcfa9f038254d3feca17a510c96073e", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386703, "uuid": "86957525-4cb4-4307-ba38-7a8241f92268", "comment": "Malware payload", "value": "f37daa04e08607db0385dd54093499fbf9e4ab80", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639386703, "uuid": "9a562cf0-0861-421e-be85-cc0c8e483b24", "comment": "Malware payload", "value": "8653770f4eb576d5b467f5778fbb2d96333ed3d03d18beeb30f0b79e1705f2ed521f00acd2cb46fdbf3766cbc4a6d3c1", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386703, "uuid": "3c33bdad-b07f-4ae5-97e9-4cafb796c76a", "value": "T17584231A75F073F16C638A0DE330A56BE64096426D12A51377D23E3632F9F50A862FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386703, "uuid": "a90455bc-6048-4c2d-9a28-2a680e0821dd", "value": "6144:HBgVvxaA6Q+bPDOHBTwi5eDGjOQTs0XMbowwgyd2KinlxROK08w1zYAIXMLoOvwd:yanzj6HB51jzcyd2BjIK058UwGlsZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639386703, "uuid": "daeee5fb-d28b-4466-b8ba-6c31034a1493", "value": 404683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639386703, "uuid": "897a71e6-7123-4ab2-9d0b-bfbe43c24f17", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639386703, "uuid": "53399538-ea05-4fc2-a8e0-6002536ad803", "value": "TT SWIFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fc1f20-5c13-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639400080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400080, "uuid": "ee524d37-d0af-4f05-b47e-95e191c7d614", "comment": "Malware payload (Mirai)", "value": "872102a9f7e4c6934865663980bd7284", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400080, "uuid": "d21577c4-d603-4d14-96ac-990baa2a0497", "comment": "Malware payload (Mirai)", "value": "f97b7879d2a599fa6a33a9c95658f9f482ec5840f780add0a8c1db1344a8b331", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400080, "uuid": "ed2f5cb2-8e99-4119-b9a2-13b563edd7de", "comment": "Malware payload (Mirai)", "value": "c54d11aa401fd26bfe87178de64b0b919da1252b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639400080, "uuid": "8e6fe8e5-718c-45ac-b8fd-fcab47cde04e", "comment": "Malware payload (Mirai)", "value": "43c630facc466e235ce510449dfd8876819ac611f93db00fb92eaaa211bcc7e3ee0a7adeded4500637479b86e8e32f8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400080, "uuid": "505bbf8d-be72-4a72-b0a2-fd240e07f7f7", "value": "T1B7A38EE4A8095E7CFC97D6F9C1264F08B92162054FA30F1BE2A6FC977D731989E0AD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400080, "uuid": "e019f98b-fa2a-4001-94ed-67802dd26028", "value": "1536:9U+Ipv5yK0CTvrjEJFXAGRWmWuhSbyeVNd8T3Gxws9rkEcgrfXedT8u+MD:9r3CTvrjE3XPRWmLhh48EwUIMXIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639400080, "uuid": "31a79e15-ad06-422e-b780-434b2bbf993d", "value": 102924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639400080, "uuid": "3f4ba152-b68b-462e-8af0-f8c68c4845ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639400080, "uuid": "454bdf86-c5b0-4154-840a-71a5515299aa", "value": "872102a9f7e4c6934865663980bd7284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b87c48-5bab-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639355060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355060, "uuid": "3ee67917-91ec-4b45-8c7f-545569932229", "comment": "Malware payload (RedLineStealer)", "value": "18ab7d343527b93c3b3d6f665e29889a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355060, "uuid": "52a89890-7d7b-48e9-902f-ca5963bb63f4", "comment": "Malware payload (RedLineStealer)", "value": "fc65655ded99c5b53ab9acc5b46a2fbc9a81b6ef7209420b82cc80d8f4189f1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355060, "uuid": "b8ead7e4-4848-4da8-95a3-4a3c8fbdb6da", "comment": "Malware payload (RedLineStealer)", "value": "6a1385def06f8107b234877912c8e9a4018896e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639355060, "uuid": "ef8efe20-fe30-43f3-8adc-6331740cb5e6", "comment": "Malware payload (RedLineStealer)", "value": "3f49e6a9d7a13445acc4607c1b1c1b938df22615e17c7ada23c3202a57f0246950386081044901fd2248b8a693a674c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355060, "uuid": "450d8fb2-5440-44e6-ad39-74bec1b0e93d", "value": "T189B3195037C8DA08E6FE0E74BCB0515883F4F5536412D74F6EC564EE2E62B81AA53AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355060, "uuid": "3f150e33-303f-4334-96e7-d4cf6744613c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355060, "uuid": "4c105d79-d39d-46b2-b7fc-ee680f0ae3b0", "value": "1536:FWZ7bmhhCHXHm8ktlOtbf4Lydjoq7kGNqJHCMqGbZAKzn0jMcbnUf9G00xF:FWZHm7C3HmDOtrvSqoG44+XS58U3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639355060, "uuid": "3fa07028-9076-473a-ba06-af3c2217ac94", "value": 107760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639355060, "uuid": "1ddcb6f5-c1b4-40e8-a993-ae4122649f3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639355060, "uuid": "61b74c45-e03d-45dd-a632-66bbf5911ef3", "value": "18ab7d343527b93c3b3d6f665e29889a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc1f9e2-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407740, "uuid": "1e9e90a7-3d76-4eee-841d-fef1a22a4387", "comment": "Malware payload (SnakeKeylogger)", "value": "e6b88c68ec4ff8eeb592eacbadf9a46f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407740, "uuid": "bfbd3b20-d8ff-47c0-aeba-f8515d11fe23", "comment": "Malware payload (SnakeKeylogger)", "value": "fd8e848ff0a25ecea72dd78f9d21554abed7560d9c2501c9d8837c0aaca2fc0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407740, "uuid": "98a4ad45-87a4-46ce-acf4-49da918799e5", "comment": "Malware payload (SnakeKeylogger)", "value": "0f6ded52fad3a8383d024a9cc1997ca38e160566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407740, "uuid": "0a15daac-facb-42df-85f9-5e402c92e851", "comment": "Malware payload (SnakeKeylogger)", "value": "045d95394b070de250aa63381b768e3c6cce3a46f9cd0637ff2637daab6f2552a0318130584926f531628bda7ec21eeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407740, "uuid": "d1b0e02b-e461-47ca-a5ce-f7e6d673f2a0", "value": "T1BB45230B3AD0A38BC03E53F51624676247F69E437466E9594EC930FCA8967C94F80EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407740, "uuid": "f314d79d-705c-4c54-bdf8-37719c731455", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407740, "uuid": "694f706c-2003-43df-bfed-7a167b02748b", "value": "24576:1/Ujv2+u403exP2hXlxu+5cq79k46zWQhrhNFWSooHGYZfR1lv9vW33JpaeoGG:i72Rtjfu+Cq79k4iHrhvWrYhlFMhoGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407740, "uuid": "0165191e-8f00-4735-9158-902dd33ace8e", "value": 1253888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407740, "uuid": "3488c58d-dd6b-4779-998a-e0ca0a74130d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407740, "uuid": "62d23570-bd0f-4ffb-8ed2-ff876be7d674", "value": "e6b88c68ec4ff8eeb592eacbadf9a46f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c677e001-5be6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639380727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380727, "uuid": "672872ea-5d5b-4fa3-b742-e0172f47c76e", "comment": "Malware payload (Formbook)", "value": "36a1ae66210d7fbee1cc07a06722ee3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380727, "uuid": "20584389-8b4b-4440-a807-a33b8d9ab533", "comment": "Malware payload (Formbook)", "value": "fd8f8402bcc0ab9c896433464d13e11d1f519f064496280d493a55fda86a5c23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380727, "uuid": "69a0dd0b-5cae-46d1-b147-5b868292dabb", "comment": "Malware payload (Formbook)", "value": "543e258e844c06a0bbfd1469ca3a4f9711097544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639380727, "uuid": "89e6e962-96ad-46c1-a3d4-daa8b3471d08", "comment": "Malware payload (Formbook)", "value": "a7cd2619d505d9e6892607fd1ce343afa9212c4feb3bfc9c96f7318d3328f491264590035d20b7a2149ca912ccce4eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380727, "uuid": "cd3e13ad-93ad-48db-bb2d-49a52231f818", "value": "T13DA4E073B40079E1E8FED1B2D86E1A3F79279DFF5280164103F627264CB1032A7AE55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380727, "uuid": "a33bcc5c-f68d-48eb-b4ed-b550cf5b292a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380727, "uuid": "34ecd1c9-e218-4a72-a866-690611233ac0", "value": "6144:RGi0ARiEjPrn0oBc9TzOqfc/SOKgrcbvKnCGamvLYK1hd88hE2dkl/Sj9GC00Eb:riEjTbUfc/SO/wbvKCg1hrE23GCUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639380727, "uuid": "6ff605b6-c39c-4737-b05c-28247f2b1e1f", "value": 478726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639380727, "uuid": "5235e21d-f8c3-4848-ac97-f0938d16d40f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639380727, "uuid": "7bd0a1f9-9918-4349-9b79-e8bd8e20b2b7", "value": "Salary Receipt_27845 pdf (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86280db-5c25-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639407869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407869, "uuid": "7f2a0c23-93a2-433c-8051-a6f3e32d33e7", "comment": "Malware payload (SnakeKeylogger)", "value": "68acbf19d48fc07b3ae0bec9183cc662", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407869, "uuid": "1e6e9e41-2b54-494c-b531-5f8314feceb7", "comment": "Malware payload (SnakeKeylogger)", "value": "fea50385a06492100a8c1d0b1c9ec4cdcfe82d8958cb07d4095d1ee1cc08d4b1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407869, "uuid": "cf3d934c-2d20-4c50-9079-4330d785ebf8", "comment": "Malware payload (SnakeKeylogger)", "value": "b8b125ed27246ace50a088d1948d27b00ccfbdb2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639407869, "uuid": "f07c6a47-8220-491e-8b0f-1f16dfa82cf3", "comment": "Malware payload (SnakeKeylogger)", "value": "47cb04ecbb52518e65488018a1aa8329b610f4386ccce97535e639921984a670022fca79e1a9a8ba7f535a2b7216ee32", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407869, "uuid": "5caab1d6-2212-41c0-b82e-33e865a63cf9", "value": "T13755122823958919E06F07B89471D130C334BE41A922D30E6EE87EEFBE737A15E19757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407869, "uuid": "338e7771-0f99-4872-a776-ec795e47109b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407869, "uuid": "c37017e3-03a2-4dc6-adc7-a10dbf680a0e", "value": "24576:QYQZ81W0LoR4HZYrCVa70gw6WUCAC2nzIdIwPNMud+XOHtEga:Q/W1W0LoRuZYmVa7tCACYHudyOyga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639407869, "uuid": "ca64b047-797d-45cd-b309-5eac9a76a8c5", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639407869, "uuid": "66a0c326-a96b-444a-b3b8-1286b3a951ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639407869, "uuid": "181176c4-4526-4141-b9c9-859c8be00dda", "value": "DHL DOC 74653898.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a44f28-5bce-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639370409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639370409, "uuid": "de015be3-5a1c-45fc-9e21-84ad6b1567cb", "comment": "Malware payload (RedLineStealer)", "value": "e1d24b9f3988fa959c28d5b6c71a15d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639370409, "uuid": "76d6e8c1-646e-43d9-b054-37a64d1cb8f1", "comment": "Malware payload (RedLineStealer)", "value": "ff77b3faead625a06b88799a3c68d56f60a4bece30c70c37cdfd5591b283976e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639370409, "uuid": "25aad055-1c8d-407b-8ed6-14e569fcd24f", "comment": "Malware payload (RedLineStealer)", "value": "ca567bc616c72bf4b6110bc8c02ecfe759434434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639370409, "uuid": "004b3a36-5685-47c2-a26a-bde20c1f329d", "comment": "Malware payload (RedLineStealer)", "value": "535db65ebe8c0f93dafc000f259b31fd7c546927f5863ae7f519ad1841d14c55d73ab7bc75fbe0eba568764b294e345d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639370409, "uuid": "e4445833-f80f-4de6-a43e-1a00c2e72b93", "value": "T1D664E1C175A0C871C5A36935A439CBED4D7FB960EB20808B77742BAF2F72BC15A21752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639370409, "uuid": "90fe42c1-5238-40fe-bfe4-18fd08244f25", "value": "7f4d3b921ad5f29f447de130848647e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639370409, "uuid": "8e602601-c6e8-4c26-94a4-5a52ff59c8fc", "value": "6144:ch7nyppNmwPa5bRPUKzr9MFjhuQ/zHmudb7ITsq13tB2T:cRnytmsibRPBMv37mm7k3/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639370409, "uuid": "911c9269-c67a-4ffe-bd8c-cc5634668c45", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639370409, "uuid": "10841a1d-4589-40c0-a279-7044479b4021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639370409, "uuid": "4b42a3ca-3542-40dc-bcd9-ac9a9e45d4ad", "value": "ff77b3faead625a06b88799a3c68d56f60a4bece30c70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }