{ "Event": { "published": true, "date": "2023-11-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-29", "timestamp": 1701302581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fdd5fe3e-d0bc-4cd2-857e-1f6984c00a6a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8eb30c3-8f06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701296926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701296926, "uuid": "a5154b4a-66ea-4129-b7c9-5c7046eeda15", "comment": "Malware payload", "value": "0e763512095abc4616f81cf4631b9b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701296926, "uuid": "c395866e-37b6-49d5-879b-9e90f2fdc2ac", "comment": "Malware payload", "value": "015a6855e016e07ee1525bfb6510050443ad5482039143f4986c0e2ab8638343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701296926, "uuid": "929e6e70-eb92-43d8-9cf2-12df718f75c1", "comment": "Malware payload", "value": "41125a07bfa80ec024951a0ee8455479894216e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701296926, "uuid": "4a3793b2-4366-418c-98fc-ba1eece8ac2f", "comment": "Malware payload", "value": "4957a4b0a3f641784436eb4369be594451b9301ecbfea1de834d314fc93ab9d962703e19153d4bd0ebce63a9cf903ee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701296926, "uuid": "9029bfbf-437f-4a4c-bf88-a57e5ca81394", "value": "T1C9F61A03E8DA1095C4EAE1B489214261FA707C5C1B7977DB2B61F7B42B327F05EBA790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701296926, "uuid": "41e5e707-cd7c-44d1-bb41-964ca3b774ef", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701296926, "uuid": "d38904df-6b45-4143-9411-9db14c84e526", "value": "98304:d+SFF9LyHYNOqXErnIo4NG2QKmEfPdTrw/EA7NERbUyWDXr/n6:d+cByQOIYT4jQKLdTrw/EJRbUyy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701296926, "uuid": "9b19769d-c081-414f-97d3-94e1de2be89e", "value": 15706112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701296926, "uuid": "ec71ae06-17ee-4e13-b987-bdedda5298b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701296926, "uuid": "c18b9dfe-c676-44d6-a37f-17560527b04d", "value": "LEGISLATIVE_COUSIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d17cfb-8eed-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701285935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701285935, "uuid": "0dc5747a-c427-4f08-9355-3eb622ea382d", "comment": "Malware payload", "value": "a6e7c231a699d4efe85080ce5fb36dfb", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701285935, "uuid": "7b06af91-837f-4e40-b432-8383dd58259e", "comment": "Malware payload", "value": "01c5836655c6a4212676c78ec96c0ac6b778a411e61a2da1f545eba8f784e980", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701285935, "uuid": "93808139-af75-43ce-b307-c4e160ad3c6c", "comment": "Malware payload", "value": "461e4e6e8240cc43f4c19dc3dbb365575e06e259", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701285935, "uuid": "b476d54d-7198-4195-8841-381684950551", "comment": "Malware payload", "value": "e33fdb1a09fa25acaeba77ed2c95dfd46db6b7f2e24d1051a7a35a86cc5dcfb80ee839e7329c292c75939ac599e82673", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701285935, "uuid": "18208226-2191-4d77-840e-00c74cab892f", "value": "T16A8412175A344070D1629779D9F29CA1D7B2BC0083B24E8F93A4479E9F96BD21D383F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701285935, "uuid": "43bf5424-7d50-4fba-b078-98affc870b4e", "value": "14d60ef38feab6a732ffa1ea5b6e8b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701285935, "uuid": "157ec8cf-1832-4dbb-a9a8-b87cad132252", "value": "6144:KCWThGl6FHGKg706IvaRaWH0cxUKK72FjCPekqOnxWMVKc8hH0W83T4mAYUndH:BR6FH+7RI8aWlxU7ClCBxWM0c8hHI2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701285935, "uuid": "c42fada7-9c81-45cc-8aed-8d95767a9dd9", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701285935, "uuid": "3506c848-9f4f-40e8-9c1c-de2e467fcec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701285935, "uuid": "af7208dc-a65e-43a6-be34-2b5b6bd7db7d", "value": "preinstall.db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19395f28-8e97-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701249010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249010, "uuid": "ce31966a-f623-4a24-a32b-cb83eb8e8656", "comment": "Malware payload (Formbook)", "value": "20ad857e0b3900fe11f37dcc82102873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249010, "uuid": "9d41b90b-7343-4b5a-a911-9b8b5ecf7cdb", "comment": "Malware payload (Formbook)", "value": "039b199524db48c95e7f5a298cbab2eaae8b36677c809a8b0ec6392428d58dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249010, "uuid": "77c345db-4025-4692-a56e-b9dcdb76c9e8", "comment": "Malware payload (Formbook)", "value": "b8c27ad309fa20c5bf26d54bfdd7cf6690b0eb83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249010, "uuid": "093d9f59-d21f-4f45-97cf-2859cee71a8c", "comment": "Malware payload (Formbook)", "value": "7404494b68cd0d4ef553e7280d60c17f5df60aac8916e9e1c2d45bdc42a2e9eb8f3019e22f5c31d7345c2f28a9bffda6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249010, "uuid": "4e96459d-db0a-449f-a113-40030f4dd0c5", "value": "T18FE4128875D88767FD791BF65472C8B003327E626572D68D38DA3CEF36A7B404A02A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249010, "uuid": "81ee100a-e9e0-490f-aaed-9bc5116f1f03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249010, "uuid": "cec46b40-af7b-4ab7-813b-e94b46122e62", "value": "12288:V5copox4V7/Mr+a7lIcRlMthAr1ijJl93lTmBKzFDKgr07ItELt:YeA+UsSWJlxlTmBqFPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249010, "uuid": "10a2bc77-2b49-4217-adfd-baf2379ada21", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249010, "uuid": "9dfff533-8dd3-4ed2-8f67-a8f430e8ad90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249010, "uuid": "e2b8ca8c-9a0c-4a76-8d72-55b3155124fd", "value": "FedEx Receipt_ AWB# 110223551677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a44dad8-8e67-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1701228611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701228611, "uuid": "b5641a08-5a37-42ab-93f4-ce25b4e88e05", "comment": "Malware payload (Loki)", "value": "bf56f6a3a273a8c74b9b03de2300719d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701228611, "uuid": "fff785a4-e26d-4b6a-983f-4133ad1304b8", "comment": "Malware payload (Loki)", "value": "064436bae6b72769b71f9fc0c5237c473caadc0edea0fc94e8413189fbcf250d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701228611, "uuid": "3353fc9d-e6b8-4d8f-b4e8-896b744fb189", "comment": "Malware payload (Loki)", "value": "0f3b2282a6ab2b9e6191e5617b57fb44e177298e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701228611, "uuid": "1b9297aa-2f36-481a-913f-5224e05fac5a", "comment": "Malware payload (Loki)", "value": "2dd2d284995d44dd25293ae8ad943a767802e94e3478043aa957f17ae6bedc7877fdf3d3c0a0c0e1120c2f866e3ea8b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701228611, "uuid": "daf991d6-7fb1-4a99-ac05-c0dc2f954bda", "value": "T175C4128872EC4762DD7C13B5A131D4B103B2BE266572EB1E2CE65CEF7A637010611B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701228611, "uuid": "7f09af7d-2944-41fe-bfaa-3dadaa981345", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701228611, "uuid": "fd1380fe-f935-412c-b9b8-43947bc73a6f", "value": "12288:hAhcopox4YxFqNmLQyoRPQ1Zf/fzwyy1T2mED5VlGp2qBB:Pe8ODFlQ1Zf/ZygtblGp2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701228611, "uuid": "489d582f-fcb5-4997-a67b-1e882859ffcd", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701228611, "uuid": "834315f2-1eea-484c-9598-d250632ad0a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701228611, "uuid": "e65dd1ed-f4a0-4aea-8b83-6c56e86d93c1", "value": "20231128BAON29xxxxx72515.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63c1613-8ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701272145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272145, "uuid": "b816bd53-65a2-43db-8ddf-5deb589be073", "comment": "Malware payload (DCRat)", "value": "ab2dedf2c3f4a999c6aea269ee3cd0c9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272145, "uuid": "36db0110-0454-49b0-8682-d35b40f12ce4", "comment": "Malware payload (DCRat)", "value": "06c5043de5a30a81b57f1afdd651d8d8dcafa12a548bf22c129fc0ab1559a6d9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272145, "uuid": "5296c884-0558-407d-bfa1-2e8277a68bfe", "comment": "Malware payload (DCRat)", "value": "2ae7be97b1f65cdd93349e7cd1cff647d554df96", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272145, "uuid": "06c38a43-f659-43d6-b5e7-abcfc9540b3e", "comment": "Malware payload (DCRat)", "value": "f87b38c634d2702842d607ba7e2fbcd57fd12a99813ba05934800e57f915b9d219350494c838e3ca47e3fae336532c7d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272145, "uuid": "ada6b0b3-9480-4aea-a91f-b9a84804fb35", "value": "T119F5E0023E44CA02F0191733C2EF49889BB49D5176A6E71B7DBA376D25123A73D0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272145, "uuid": "805f1a95-5a68-414c-8a81-0592eea18623", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272145, "uuid": "095ac326-6e1a-43c5-b0fc-f8409bde8721", "value": "98304:rILd36QiuzVekS/pnQWLmFTqrXlwrpRV:rM36QiiSBQWShOXsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701272145, "uuid": "412f72fe-3e46-4e47-a6a8-d79454635dad", "value": 3486720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701272145, "uuid": "f1ffd858-db3c-4918-bcf8-7243b6381d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272145, "uuid": "af4b633c-7a98-4473-bfda-84cdcb61c918", "value": "ab2dedf2c3f4a999c6aea269ee3cd0c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e1f039-8e6e-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701231417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231417, "uuid": "8627d197-9ac4-4879-bd02-df5604341c76", "comment": "Malware payload (SnakeKeylogger)", "value": "1b4fff675df6cd7b8256b9530d9f2da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231417, "uuid": "6da6958a-abb4-44e4-968e-5598da23202b", "comment": "Malware payload (SnakeKeylogger)", "value": "095874a28fb610214b5f0e2cb00246f160d6dfd3eaf8c8a033226e4266668374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231417, "uuid": "6d12587e-5f64-44a5-8904-570a5a946dbc", "comment": "Malware payload (SnakeKeylogger)", "value": "00e4ceab35ba0ef12a44f560ede6a61d4206619c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231417, "uuid": "518671da-f0fc-4e68-ad6d-468b048456fa", "comment": "Malware payload (SnakeKeylogger)", "value": "dcf79d41629427df0677bd974505a293a1e316509b542728037c21c883cf8d3bc2f4a0d464bd98a1d1153d34b1a6b63d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231417, "uuid": "198bc68a-6d52-4838-b571-4c3416ba1432", "value": "T1B1C41286B2AC8715CC7CABB64925DAB143727E7209B1D35E3DD23CEB392B7120642713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231417, "uuid": "33aa8dbd-d761-4389-a088-b3250a5ab167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231417, "uuid": "c0062c2f-68c3-4f90-bd80-a4a48bed0676", "value": "12288:YSncopox4xI1R3r65/aqqLWmeEs2KF36rS3rpf4w6aOmdx:YeF8Fr6b4WmeYuB4w6Rmdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231417, "uuid": "b9096b2a-e197-4cc1-b523-31c4b256f916", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231417, "uuid": "a88bfaef-f9b6-4c5c-833a-c44fa1494b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231417, "uuid": "f33bf055-4f78-4af8-ac3d-9ab90da75069", "value": "SecuriteInfo.com.Win32.PWSX-gen.7145.3884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf49227-8e91-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701246440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701246440, "uuid": "0a267630-46e0-4190-8007-674325640d1e", "comment": "Malware payload (AgentTesla)", "value": "1ce372aa0c28e367576feba6335b5031", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701246440, "uuid": "7b591375-fa8f-4ec0-acac-214c8ce130bd", "comment": "Malware payload (AgentTesla)", "value": "0ae0a39cfcd0aa61faf5661249733d575b0f2fbb2de99b6bb6d067d35f530bdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701246440, "uuid": "f9fba3cb-96da-4ea8-9093-b0a426091667", "comment": "Malware payload (AgentTesla)", "value": "f4e069b2ab928d8efd4f3be73bede2a4d5923273", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701246440, "uuid": "d071404d-cd96-4769-957d-d9fd1ffe724c", "comment": "Malware payload (AgentTesla)", "value": "605d87d39b1e5675eb51ed2ba4ecfe18b8eb26baa511ddf0be4d5e7e0fee1641f0001070e14fcb6007a0560589998f02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701246440, "uuid": "7a225201-382f-4409-9978-dd1863ad8ea1", "value": "T10415CE81EA4495A2DC18AB75AA32CC7452337DBDA874E55D28DE3D373BFB3971022063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701246440, "uuid": "5cd0d838-407d-40aa-b6a1-6573e23953bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701246440, "uuid": "138a7236-b12d-4944-8cbe-f733d988edfa", "value": "12288:I1copox4dd8WBMZ5oGgh4Hx/PBNitrZw5EtkZjgrsgrGZ+sP7r9r/+pppppppppT:9eZdBiZa56Hl/iU52SjgFaZ+s1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701246440, "uuid": "d0130576-a2e7-4e6a-ba12-0b4d6f6d7a60", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701246440, "uuid": "970037d3-95b9-4d38-9cb4-b3a924442c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701246440, "uuid": "e38f9067-4a55-43ec-9010-936fe7b93517", "value": "SecuriteInfo.com.Trojan.MulDropNET.68.10569.22510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e422857c-8ea7-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701256223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256223, "uuid": "3a123f3c-c1d2-407c-96fd-70f6c15a4f0a", "comment": "Malware payload (Formbook)", "value": "f0306d2aace3cc2d0f84d6f74d7b3ec9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256223, "uuid": "76097e50-34da-435b-adb1-b098177dcdd5", "comment": "Malware payload (Formbook)", "value": "0b26e2e5ef42fef31100e87c15550b8bea987f209ce702d00042d67719007ab8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256223, "uuid": "196883f5-ac89-4ceb-b54f-191c35f2cfb0", "comment": "Malware payload (Formbook)", "value": "38726baaf276fed303a660a54cee275ebcc18479", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256223, "uuid": "84c08168-68ea-46a6-9ae1-b790d5f72384", "comment": "Malware payload (Formbook)", "value": "e0bf91e358181f35f1dc237fd0574c8ffacbb8f65c7f691b43f092af228b440701824f5a80318a85db5d63660a409aaa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256223, "uuid": "444f7071-5599-4309-b88a-3b58593ebcf4", "value": "T16E7423C8C32ABD6D32C7022C5B41A5CEF7300C67BD86A4A742A94D9D61F15DF460DFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256223, "uuid": "b63ffba0-fee0-415f-99e8-f84c9c98dfd5", "value": "6144:db/QlXxv9N06edU5+0eFFO8pP93lUJfivge8PoAeDv/Y5bj789mfptgUrz+gcf:d0ZW62U5/epl3lUJ2g7Pjsv/Y5fptNre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701256223, "uuid": "a6d33bf2-b4e1-4b98-9e57-29306b7d58f0", "value": 364964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701256223, "uuid": "59e55c9e-7dfe-4005-8e00-faebe98c7659", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256223, "uuid": "a93c8300-6e18-4037-bda8-24e40b1eb42e", "value": "SWIFT MT103 PDF.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1df0f17-8e93-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701247522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247522, "uuid": "4baa795f-5c02-44d3-9107-ca0789bcf0d5", "comment": "Malware payload", "value": "a152b9f24a4bd5ab621ca3d5516aeb19", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247522, "uuid": "2fb8e13c-e9c2-4695-bac1-3cdfbb6aa7c6", "comment": "Malware payload", "value": "0d386a97d8bb9b552ec6f5b846e5d5782e8e1961d6b5f20ecfbe0c6f1ce4f692", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247522, "uuid": "b2466f71-cae3-4881-9db7-e2736635a4f6", "comment": "Malware payload", "value": "2ed903b75a123bf1586828e8c9d1e1d7302526dd", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247522, "uuid": "287cf0f4-11ac-42f9-9723-2cb05b7b5f51", "comment": "Malware payload", "value": "bc04e3534668de418d8c8d395bc6ed3b5518a63e4e3a9fef41961b5198f6b84ee57a096c9c9235f85bde95d81d50e89b", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247522, "uuid": "e57572c9-2d90-45a6-9adc-4115fcbd1ae8", "value": "T16761CF932151B8E9414283BF3D4966FA807FC224964A6044FB8C4F9DF9DDE633A8D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247522, "uuid": "2466ebf4-07ee-429a-b739-ea89c59f6962", "value": "96:2Gt82X/fuSChFNgQfBZL0H+mAiBrVMKqL:pzXsFwH+mAiBrVJqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701247522, "uuid": "d1d6a566-8505-4542-8ea4-68e83e221518", "value": 3217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701247522, "uuid": "0972a25e-ec30-48c8-b2e0-faf6a23dab93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247522, "uuid": "51763d30-9cf7-4002-b7f4-b30dc99107dc", "value": "AdhVs9SS.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761d0ee3-8e76-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701234993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234993, "uuid": "72b0bb4d-f743-45a1-9684-ba9e4a964e09", "comment": "Malware payload (AgentTesla)", "value": "698b4f0aca0ab831ded8acebdcb3dd95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234993, "uuid": "67e19264-3a83-42c5-ab37-9f88a5ead15a", "comment": "Malware payload (AgentTesla)", "value": "0ea25526eae6b19047d2f5eb0d9e7ff9d33d6db327cd35d8da2b6662762b424d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234993, "uuid": "05edcc27-e0d7-4d5f-ae3b-fc8e25943048", "comment": "Malware payload (AgentTesla)", "value": "057fc7b4d0135d14851e06b1dfdb2f7ebce6eea9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234993, "uuid": "9faa3239-5daa-452c-a8fc-8b5355f8bcd2", "comment": "Malware payload (AgentTesla)", "value": "d33cc99b7d194f05a544158e4b7e1b4417198f7e58f25005f9004218201f69c8d1f0e136818c9a6986bd1e7bb465844b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234993, "uuid": "23516976-6ae1-4915-ac1c-4af2a3946538", "value": "T1DFE4124573AC8636DDB807F56A61C4712378BE262672EA8E2CD26CEB3D237050F41B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234993, "uuid": "0818b407-2dee-4fad-bf0f-85ee297b059e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234993, "uuid": "a16a92bb-0aa5-4f63-8ca1-9b787b111ec5", "value": "12288:YNCCCCCCC8CpCPCCsCCCcopox4N2uxWHReoAovpKfhtQpCCqugPsADTu7I6gRZOF:8CCCCCCC8CpCPCCsCCZeZ2a+RpKfvQpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701234993, "uuid": "a54fe877-5fa9-46cb-9eed-1dee64c4af10", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701234993, "uuid": "b3fe1119-954d-41e5-8643-7fe14d026361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234993, "uuid": "c6de6a32-1149-4d1b-a3d4-2b7173462bfc", "value": "SecuriteInfo.com.Win32.PWSX-gen.22285.11204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259bfde5-8eac-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701258051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258051, "uuid": "ffb16c54-1cda-41a2-a6c6-06fdeced1261", "comment": "Malware payload (AgentTesla)", "value": "857b39eae01da627e3448f6cfe90c8cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258051, "uuid": "47753bef-5779-4ba9-b75d-33a8aa62da9a", "comment": "Malware payload (AgentTesla)", "value": "0f930eb7617cf73c7296bcd982ac6eacc7cfbbf20626743032f0b8474f96d37f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258051, "uuid": "b0c0f354-8e51-4bc7-a5ce-c17db6348dd6", "comment": "Malware payload (AgentTesla)", "value": "2c7d693c22f4c295fd75e9f7bfc0406f2bfbc310", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258051, "uuid": "9e7a29b9-6627-4546-bafd-2e3af7730e7c", "comment": "Malware payload (AgentTesla)", "value": "33588344b18a7bca3d895b24de07f6766e404881098266d496cb9a395211b42061d39fcfa49574194ec7d346a9706e43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258051, "uuid": "a2dbf759-ca3a-4fe3-98fa-596d75e9d496", "value": "T178A423A2975849259E5A83C9E0E719CD4F416C27347C6847F28EAD8CA3D033E64DF46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258051, "uuid": "4e8d89a0-ac73-4d10-9359-2aa4e9181681", "value": "12288:CvQ6XbJd79WcaWiykDyJUc7wJzxN7cE6IEwZU7eqt:cfrPxs0MZHoE6JuU7xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258051, "uuid": "f963a63c-ae4f-43d2-a6ee-92a38125e7bf", "value": 488736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258051, "uuid": "bcc36917-a96d-47a5-88d0-09a3fe713bbb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258051, "uuid": "c289269e-4a16-43b4-bfff-d94a46d527b5", "value": "SOA 9311062740XXXXXX.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092c0213-8ea1-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701253278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253278, "uuid": "3e241aea-9c5d-4ed1-be31-af1a307cdcc1", "comment": "Malware payload (Formbook)", "value": "55b471fcf13e81f86c3fb30f6c3ca5b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253278, "uuid": "aeaf7f2f-c974-49b4-a12a-f39b894b38d5", "comment": "Malware payload (Formbook)", "value": "102a0a0522f32d9f9bce6b9817ce6c927a663e6aabfb2cf5356400aec0057777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253278, "uuid": "019076a8-bce9-41a7-8dbc-4bc8c216ca78", "comment": "Malware payload (Formbook)", "value": "86332751dc40d091cc0b65d8538e9871d26eeba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253278, "uuid": "3e5d3943-4ab2-42e5-b4f5-d64d111b1bd6", "comment": "Malware payload (Formbook)", "value": "4553a715fe02f26ec27063637be1d6cd96f0e8306a647f50efd0a5e5a2fc777ac89f68256147f865a8169002a4a511f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253278, "uuid": "4b512ed8-5ad0-4d6a-88ba-880e959b87e6", "value": "T1E6F4D0823148DCDAE05328F258AFD57061787D9F8165C60D3B83BB2AA5E7353349B78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253278, "uuid": "44df7c18-4675-455b-a01f-476274e769e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253278, "uuid": "1a324694-de2f-43ea-8a7c-2e85ec60470b", "value": "12288:EoCVGU/XacEI70Frui+P6Aiqfaz5be9IYU0UzPSiiaONwndSiJ80K:tCVGCEI7jiH6fKb13r9irNOdd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701253278, "uuid": "5bbec210-59f2-415f-8ec7-0d56afd7f29a", "value": 781872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701253278, "uuid": "832332f6-61fd-4edf-8a82-6bc6f2351126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253278, "uuid": "d762dc1f-f8b5-4634-bcec-00516ce78550", "value": "3530568 M4 - Orders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d88004-8ece-11ee-8907-42010a9c0042", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1701272995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272995, "uuid": "d7f07079-58b0-4b82-aadd-7a8664ca48ba", "comment": "Malware payload (Rhadamanthys)", "value": "f042063023fe12546bc13c87ba5bfa25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272995, "uuid": "fd73f6df-ed01-4d65-9447-8c955bdf0a20", "comment": "Malware payload (Rhadamanthys)", "value": "12e4124bf790bced8b0cff6506511bc15e8b65fd31fc2f13697ce899f6ad9b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272995, "uuid": "6663cff9-5399-47ea-bc2c-4763140a5774", "comment": "Malware payload (Rhadamanthys)", "value": "650d23339aac99447796344248328e7743c9628c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272995, "uuid": "5bd94da0-2d8d-4fe7-bc52-47db58d473a7", "comment": "Malware payload (Rhadamanthys)", "value": "7e26611e97226736c2691337a2b339090e21bf00a6b6225dd2c2f8dabac958dbe049d4266dd0a3db5b332ae0fae97673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272995, "uuid": "7549d446-660f-4c14-8db4-2e1559695a36", "value": "T1F5B522907AE184B2C4D22771D862B33477783E5C9B304ADB63A0B5EE763358056366FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272995, "uuid": "9d92c270-c5b5-4761-ad03-35fb25379f18", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272995, "uuid": "fd733c68-37d5-4f29-acc0-9a416b8ec483", "value": "49152:kBOZ365pLzhdPr+pAP19MyuJOxdkYM+pLzhdPr+pQ:uBpH/L9MylrfM+pH/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701272995, "uuid": "c8fcd668-5bcc-4a4c-9fe1-c607805c85cf", "value": 2438096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701272995, "uuid": "3904dab5-e804-47c1-82cc-95ba8296f4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272995, "uuid": "85a052c9-6a2c-40a3-950e-30171fdff530", "value": "MSTeams.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efab34d-8e97-11ee-8907-42010a9c0042", "comment": "Malware payload (Bitter)", "timestamp": 1701249127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249127, "uuid": "49f27f98-8969-4cc7-b37a-3a87ac936952", "comment": "Malware payload (Bitter)", "value": "35639088a2406aa9e22fa8c03e989983", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249127, "uuid": "de42b4f6-7aa0-4eb7-9e4e-61606a11b13f", "comment": "Malware payload (Bitter)", "value": "132098213b5923463611e6fc77bfce0cfad3d727566ce0e87e9723456c698ae6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249127, "uuid": "784e43e2-1c64-49a4-aeb8-df3c0f5cfa8a", "comment": "Malware payload (Bitter)", "value": "ceabacacb2714e0101870765c728d5255584cd14", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249127, "uuid": "a13ba1eb-7fd4-4612-b2aa-e4e86ca07b40", "comment": "Malware payload (Bitter)", "value": "d1e2c9fa6dc70eae864f9db61a84327fbdd09382216cdd665d26af0c1b010e1197b47d9cf2dbc341f8bdea4f5c63b513", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249127, "uuid": "74622bfa-1377-481a-bc54-3d01fce62ffa", "value": "T1BDA3A402A7024060F34827B11899EEA792AA7D7857A4F5DFF7643D3929B12D3DD3324E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249127, "uuid": "68e5b3b1-9b38-4a9d-9d77-1d1f4c2b78b6", "value": "14b989c966f4789fd75be64eacaef9dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249127, "uuid": "dde8871a-c1bd-43c1-a032-157dc2aa8c91", "value": "1536:QMMaTrXLZluEygsqDlsT/GBQJ6d0nqnQs8gHfShOLR7JxREZ:QwrFrvBDlsHU0nzg/4OLR7rOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249127, "uuid": "b7fa7759-f8c7-46d8-824a-2238f19f027d", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249127, "uuid": "790e977c-e3ca-4a5f-8b76-63a8e479f906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249127, "uuid": "77825eec-5936-493b-87b3-1afa1efa9dd2", "value": "samvsc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7729a91-8e77-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701235532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701235532, "uuid": "2b196ffe-d95b-4a9a-930b-127468005380", "comment": "Malware payload (LummaStealer)", "value": "14125442334d4296668b2f0ac9423dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701235532, "uuid": "7011dd1d-7731-472e-ad6f-b97c4b083233", "comment": "Malware payload (LummaStealer)", "value": "13c128bbab60f67ce53c85c22cbef4dcd3dcd6445a7d2592ba640a7fd262fce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701235532, "uuid": "599f66de-2524-4774-9cce-aa0fe9deedcf", "comment": "Malware payload (LummaStealer)", "value": "9f8b4101e5fce5d368b72283ef022e394e812091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701235532, "uuid": "0e1de729-5f9c-4a0f-81c5-509459a4b5ea", "comment": "Malware payload (LummaStealer)", "value": "6d73dca61c398126ef8a33251c090a3b7df6510e2147032fc646fd627a7011e04ab2b688a97129e085413461f9b80827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701235532, "uuid": "0b7cd90a-23f8-4348-8d4d-1891aa437929", "value": "T10803D08344796A18CA15BE36011188E2F6D5B394F6582101F7CC9CFBBF2E784E75BA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701235532, "uuid": "677ba830-e253-49d4-9d96-a17ff10c83cf", "value": "768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701235532, "uuid": "90fc74cf-6b5a-4c23-a58a-4fe5478c696c", "value": 38568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701235532, "uuid": "e8f83a08-7ee9-43e7-9575-8f35d36bdc54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701235532, "uuid": "7f68c2c0-09a8-469d-9b67-e8097db797fe", "value": "14125442334d4296668b2f0ac9423dd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b528d14-8ecb-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701271536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271536, "uuid": "57cb038e-2130-4d22-afd8-5611c73abeff", "comment": "Malware payload (GuLoader)", "value": "c4efbb06dde6bc962e92516700aa88b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271536, "uuid": "66086d73-65b4-48ce-87bf-4a48ff5e3cd8", "comment": "Malware payload (GuLoader)", "value": "16b42412c404b58f839ab2807f21491f4f93d220202441a097b905ef28099a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271536, "uuid": "3efe1af8-7b7a-42fc-9e76-6589f116cb3d", "comment": "Malware payload (GuLoader)", "value": "92d7b7e18c5c42d70868094877ab7848fd3d7ae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271536, "uuid": "ab071070-4656-4a82-869d-7bc49cecf52d", "comment": "Malware payload (GuLoader)", "value": "0a0ec85dcf6b8198af6ef1cabc9ea7651b39467244ab1edfd8e1cfe9ae377219af0b4788de46e3db1a8281fd7461e67c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271536, "uuid": "6a7cf0b4-b844-497d-ae84-6f910dc8215a", "value": "T177C4021D2368C40FF382C97C543AEA9E967DC5019C257A423BE32EDCEDE76966C1610B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271536, "uuid": "000ff372-c204-4f25-8963-412b299393a4", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271536, "uuid": "c4cdbc18-28d5-49da-9fdf-b0e997c93dcd", "value": "12288:5c77o6INS5tYUv9xuBdm17zOckylak7iI/dKX0HO+:5hlAUO94BCKdOT73dy0HO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701271536, "uuid": "2814f0d1-b29c-460e-8cf6-14e0c65a6a77", "value": 582056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701271536, "uuid": "afbb2932-841a-4582-82af-6c531fb061bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271536, "uuid": "575c3f0d-89a5-4d5c-a44d-82a8b28e23c3", "value": "SecuriteInfo.com.Win32.Evo-gen.25090.7913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91fdafb-8ea7-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701256231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256231, "uuid": "0613c419-6fb5-40a6-8b84-9b0386e3b326", "comment": "Malware payload (Formbook)", "value": "d69544675f67e6d76debd069c9c94f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256231, "uuid": "3bb8b35f-de7b-42a9-9fcd-b1ea9bc74de1", "comment": "Malware payload (Formbook)", "value": "1706343fa1e062d467f9b599776e7db4507a58d605122ccfaed8faa4f5278c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256231, "uuid": "f64bf078-290c-4c9a-a247-f7cc60defb4d", "comment": "Malware payload (Formbook)", "value": "7eda665241cc31ffa98acc716b486abd35b9d09b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256231, "uuid": "e9b3759e-1293-4adb-82a5-c34a9308d6ad", "comment": "Malware payload (Formbook)", "value": "fd06a8aa6f818215563d5284a0f93fc7de174584515a5f602109e6b0d710594fbc1ff6224fbcc5eae5c21b6b9e2ccc24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256231, "uuid": "fe38b996-3ea7-45fb-ad99-02a62091e038", "value": "T1C6B428C3F444348DF8DE827BBADA8E26E1D61D4E1D43190192713F51BFAE98293C496E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256231, "uuid": "a6951538-98e5-47e8-9d37-665977fb9ca4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256231, "uuid": "59631681-c2de-4c41-915b-16c8cab3e8e4", "value": "6144:oBlL/fRcSF9xH6XLZpUsn9Dt6YoOzs3aYUUNO8IYq+w7dZfE:a1CSgvrTZoOIqFoO8IYjwxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701256231, "uuid": "19641547-784e-4609-b2c6-0d94a960127a", "value": 513966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701256231, "uuid": "09d50cb6-d3c8-4b55-b36f-5722127319c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256231, "uuid": "0676e14b-279d-4004-a174-b040ac1a9527", "value": "SWIFT MT103 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a975e0-8ea7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701255848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255848, "uuid": "21acf0c9-1e9a-48d9-987c-821bcf0a3e9e", "comment": "Malware payload (AgentTesla)", "value": "d4e51ee4820496cb94e7954802b3d3bc", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255848, "uuid": "e7c2e029-235d-492e-b1de-3c19d8c6a387", "comment": "Malware payload (AgentTesla)", "value": "17966af1f02c764647a59c376079843bf4313bcd8580583a0a285ebaa53f553c", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255848, "uuid": "0dad11a6-436b-4e70-9634-03d3c9b12a6a", "comment": "Malware payload (AgentTesla)", "value": "02ad2be4a67ec7f806807190ea7523eaa6f81804", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255848, "uuid": "50ac45b1-cc7e-4ae4-999f-9132eb726b46", "comment": "Malware payload (AgentTesla)", "value": "3d98f2ce66c706755bea1f15aea9a1ff145b467f0d81313fa2afb40c01c926191fbf53d5dfddd0d4509bde80da2a8e02", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255848, "uuid": "9c41be9e-8b2d-4c74-9cf1-292ef353ac89", "value": "T165E4128139D99E27C66F25F828BA640113F7849A7D95F7CA6DC1F0CA5AE1FE0030169F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255848, "uuid": "07e078d7-6862-40ac-bdce-c96ced88fde5", "value": "12288:mh6pQmbCp92iNWgkjYa9U5NKl6Bngsvjzzpb6LDurVFk1ggb:ml1TkjtU50mbzF+/8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701255848, "uuid": "50ac1840-7235-4ba4-9fc6-343277e9b7a8", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701255848, "uuid": "469696f9-f49d-497d-9216-b71a70c23b9c", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255848, "uuid": "67bf1eb1-dd16-49c7-863a-bb70ae28def4", "value": "Image005(11-28-15-44-58).jpg.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc999fd7-8ef6-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701290140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290140, "uuid": "4b49d805-7ebd-4a6c-940f-fad4c77c40e3", "comment": "Malware payload (RedLineStealer)", "value": "2982a293b8fec4c6a011294ec3a0dcaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290140, "uuid": "35d83294-b2f4-49af-9481-c78e60bdee8f", "comment": "Malware payload (RedLineStealer)", "value": "195dd99206038749d91be4b7d7446266abb31e0e5dd695eb5bd908e04eb20331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290140, "uuid": "7ef29fbc-bc3e-4d67-85d1-b96c4eaceedd", "comment": "Malware payload (RedLineStealer)", "value": "99d629618324567227de8babc906919d520700a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290140, "uuid": "8ca164eb-9a1b-4d1b-a2ec-bf73fe86be9b", "comment": "Malware payload (RedLineStealer)", "value": "69789ec617965b17590591d5db6fd5ee8c49edeac4cc128f24b459e840c54460dc66128dba793beab36fa283e7c8109a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290140, "uuid": "1215f847-7b9e-4f46-bc73-0b14953c73e6", "value": "T12B03D08344796A18CA15BE36011188E2F6D5B394F6582101F7CC9CFBBF2E784E75BA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290140, "uuid": "4874fd3d-3ee9-4ea6-93cd-9270cd67a747", "value": "768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701290140, "uuid": "201731b0-00c5-402d-a63a-e1b6c625ea28", "value": 38357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701290140, "uuid": "1c6dcf34-0504-4ca0-a4f1-43b10dcf270c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290140, "uuid": "4d108a60-6947-4042-b597-9a595c35fa1d", "value": "2982a293b8fec4c6a011294ec3a0dcaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdc5e7f-8e78-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701235836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701235836, "uuid": "00ef59d2-c95b-46f0-b33b-21a3a3a63f6e", "comment": "Malware payload (RiseProStealer)", "value": "70dacb108d23e83d818c5006da2eae9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701235836, "uuid": "9f601741-02fd-41aa-bd51-c33a4d524b6a", "comment": "Malware payload (RiseProStealer)", "value": "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701235836, "uuid": "4839e46f-14b9-4785-997b-663d36abfb37", "comment": "Malware payload (RiseProStealer)", "value": "3bb5afdb9cc2aa069cd944192bd1740f939c0a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701235836, "uuid": "203e7a5d-7fca-4970-aa4a-f0683bf443dd", "comment": "Malware payload (RiseProStealer)", "value": "09925e064c8dbf0158949452853b9b9e421746d2fd4076753aa09f664a7d2cbeaab2eb5acb7f6c39824ecefe81e7daed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701235836, "uuid": "16900bfc-6c60-4d06-86ac-d7e26d9f8594", "value": "T150953303D7E9D031DBF5273058BB07E31E367C91FDB4536B2669E9894821AA458B232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701235836, "uuid": "e7b9c825-3b9f-4bd1-9351-425ce54fb241", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701235836, "uuid": "f5ca1104-5758-4e91-bc32-75ecd146cde7", "value": "49152:J42unm8qgWinFJdXSJY6d5Fv7T1/VYC23HzhyRsNm:u2um8qgWinyjvT23NyRim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701235836, "uuid": "60a982c8-ca6c-4e2a-8993-1a52cb1bff28", "value": 2024448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701235836, "uuid": "928c616a-47b8-482b-b917-0baa9edea4ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701235836, "uuid": "e65c1f0b-dfa1-4eaf-89fa-ce237dabe037", "value": "70dacb108d23e83d818c5006da2eae9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e6c96e-8ede-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1701279583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279583, "uuid": "4093a54a-8a20-49d0-9d87-05d9096cc2b7", "comment": "Malware payload (Loki)", "value": "3e2fcb2c4d29abc90ba955d2317860a4", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279583, "uuid": "de2becb3-2974-4534-8a94-8c590f860c45", "comment": "Malware payload (Loki)", "value": "1ae1a7062bb864bb4211c4543bc493d8b6fcf827ea9d797831a75ea46914ed5b", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279583, "uuid": "9f1db501-7810-4658-98bb-011bdab495c5", "comment": "Malware payload (Loki)", "value": "79771fc10b0e20fa01357a1fd9aa68dad0e6ef6f", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279583, "uuid": "c73b3519-b771-476a-bac6-696b16571b04", "comment": "Malware payload (Loki)", "value": "be30c1169b0eb1d572c9de87e6d29592aaae28dc96910716959a6d06dbe7833ef8ad34f3d06f990d0deab2172ebb7c44", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279583, "uuid": "9d0e9bf7-7d9c-468c-8b36-dcb20f7fc5fc", "value": "T1850533B8698AC8DE6D612BC10B707333C1C71446A67CBA71FC8E7143DA479CF86975A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279583, "uuid": "73839385-1a2e-42b2-bc7f-be793b368706", "value": "24576:5IMJr+mWSxs/Wa3L6ZDClmDHEcq9bHsCBs:5IE7QWa6ZA/cq9bMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701279583, "uuid": "292da1fb-b1a1-48fd-89f9-d7760c95d49c", "value": 800353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701279583, "uuid": "d9b9709f-1429-4c7e-b6ba-d40e5d10a683", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279583, "uuid": "e9157ff5-75c4-4ea5-928d-2dd47ad55901", "value": "96__sidste_rykker.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a71d61-8e6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701231930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231930, "uuid": "1d27bfec-8930-4036-8182-66d82fcc9580", "comment": "Malware payload (Vidar)", "value": "69a2817a41b97ee8f1917646723312bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231930, "uuid": "d1b28a4b-68c3-4830-b4ca-34f809f4429f", "comment": "Malware payload (Vidar)", "value": "1b5b2846fe02fa318dd6f82439d4826948cbfc4d7245a8267ac37605bd094885", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231930, "uuid": "77b81f75-ce03-41d6-bf42-c795d63c0a2d", "comment": "Malware payload (Vidar)", "value": "c2d99017c57bb5bd1593d2ad0d3b55ac81f6650d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231930, "uuid": "21f22de4-98ad-4082-be01-b9dd6af52d16", "comment": "Malware payload (Vidar)", "value": "1705fafe7d086b8b2b3431789d4a2e87cd9b13a3d755688e19829f2b4e4f8700221c51e6e8f62ae424b6a8aa82206636", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231930, "uuid": "74dd17e5-db67-4cd2-b793-c274ac66aa26", "value": "T1E964086383E13D44E9264B729F2FD6EC770FF6918E497B6822199E1F04B12B2E163714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231930, "uuid": "79e2e8ef-b2cb-42c8-82b2-97fe0aced873", "value": "8997b51f82bf7e6f2352d47957e9bdb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231930, "uuid": "1cfcc1cc-1160-4971-99b2-dad1f3642028", "value": "6144:kNHZA7XGQCnoNjxI6u64o+sMU+5bYgdmm92:kPBxoNjTwo7MU+mgdmm92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231930, "uuid": "c28305cd-8b76-449a-beea-4be24b4d9354", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231930, "uuid": "3b437ee9-93ed-40db-9af1-978406f455d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231930, "uuid": "4abf680f-1024-4785-8802-770bbd4598dc", "value": "69a2817a41b97ee8f1917646723312bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c90ed0-8e8f-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701245921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245921, "uuid": "53d9d575-45eb-45b8-921b-d42a6beffb3e", "comment": "Malware payload (Smoke Loader)", "value": "8be2008edf8421e3dfcd9ff6484c6a84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245921, "uuid": "c6cbdf1f-bff2-4141-82df-092720a19980", "comment": "Malware payload (Smoke Loader)", "value": "1ba7233dbb067286a85d2d0764ea7fbbe041d4629d6055289f230cfa9c7ad35c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245921, "uuid": "dcbec823-140e-448c-83ab-6ef2de3a582d", "comment": "Malware payload (Smoke Loader)", "value": "70cd77824af984e16d604d6fbe7890ad2c60d556", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245921, "uuid": "a15e645b-9c18-46db-8b7b-f16cb1802eb9", "comment": "Malware payload (Smoke Loader)", "value": "ef7098d586b09752622e733bafb8758964c0ac66e35a85f64890b208479fc005a4eea7c517ce64a04d5d1c9422af26db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245921, "uuid": "b27fabd6-6199-42c0-ae7f-3b351aca9f39", "value": "T12E547D1266E96861E5174A33FE2AC6E8275EF8514F257B9B33586F2F49702E1C273303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245921, "uuid": "7da3c04a-ce35-406b-ac2e-a69921c64b93", "value": "a5ba2e63e413ae40c0d8efc223d7976c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245921, "uuid": "a1fdd1aa-96b1-4972-ab08-55e6f69a8ac6", "value": "3072:o/DWeQHxLdA2FYvGS4F9RBOWNLqq/8H6MVuZu+0PhbJQqzLD5ysMV:uDuxh++S4F9RtNLqqUH6gph2yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245921, "uuid": "8331012a-d779-4eb1-a6d9-1e60d79cb270", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245921, "uuid": "ad869c12-bdd9-4898-b978-b6928195b93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245921, "uuid": "17e587e6-dde9-4944-b3ea-645572dd70c2", "value": "8be2008edf8421e3dfcd9ff6484c6a84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50827921-8eb9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701263706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263706, "uuid": "82d72c4d-4892-489f-965c-d496ab2eda6f", "comment": "Malware payload (AgentTesla)", "value": "6ecbc27c5c4200c5a77a790b65ad1096", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263706, "uuid": "9a17e817-6ad4-43e3-bd85-fb23c94258da", "comment": "Malware payload (AgentTesla)", "value": "1bf7e6948cd011ce3db76207e54bc88d55d24c81332560d42e93ae1285586bbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263706, "uuid": "2979e226-c15c-45ba-b3cc-cddac4ae57f7", "comment": "Malware payload (AgentTesla)", "value": "679798fd23d7cdabffbce4250bfa1156b6c169f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263706, "uuid": "052bc9eb-1410-435c-856d-310adb15157a", "comment": "Malware payload (AgentTesla)", "value": "dfc228d4bb623a605566abca27ec3e114e5324c4081157d5f8115570658674e2d322cdcf1e5e52f00db1d1a2e9fd1f5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263706, "uuid": "46e8a63e-e873-4f8d-ab92-400a817099ee", "value": "T1CCD423A6E903B74A52ED929D6C930E19CE3BAB239353315D32B517904CEC72D9A1CC6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263706, "uuid": "acc61ec0-4fa9-41d8-b1f1-0347ca147a7e", "value": "12288:gv0yKeKhQ4oEYnzESxCBKbG0rctSQVz1mNqKfaAnb:EJKh2EYzEQC4rSSQRow2zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701263706, "uuid": "9f1c314f-7150-4859-ba2c-404c65c534fc", "value": 647309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701263706, "uuid": "a3b99d2d-adf7-4ca8-b584-ce62dc499943", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263706, "uuid": "ec9e2b77-06ec-496e-88b8-a246b1cc2060", "value": "SWF314811802010002.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d0d4fb-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701283175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283175, "uuid": "67723074-ff63-46a9-88fc-0b048e3f0f7e", "comment": "Malware payload (Mirai)", "value": "e26ea710e390f3559159701e1b1cf700", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283175, "uuid": "771bd5f8-907f-4a78-b529-970eb8a54ad0", "comment": "Malware payload (Mirai)", "value": "1c5969d2dd2735bbef26fb75202d2924267f3b2188b440ead1b8edee19e68d8f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283175, "uuid": "a1796906-0713-4c82-afc0-399750a4f894", "comment": "Malware payload (Mirai)", "value": "aa9c0b4153c2a665e21577a9d06690c32e179383", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283175, "uuid": "d1e0c0ff-15e4-44f4-9ad1-4b781b881914", "comment": "Malware payload (Mirai)", "value": "cb0f439b6ece75b9b572878599f90a6c425bd5a538dcf54cc9713cd81a91b2b7bcc95ea2c44e959ba3371b2036759022", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283175, "uuid": "cc11f455-1c44-450b-b9a1-1e3dd7326d53", "value": "T132042A46EA404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283175, "uuid": "7311fe4c-2fc9-44d4-9e33-1a816c61445c", "value": "3072:O8/WsphjlvbAmfkIaboVSyckpj/HS0Bpai/hJjogM/REC/HV6:O8/flvlcIaboVS7kVdBYi/XMgM/REC/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283175, "uuid": "43816ac2-d247-4726-b37c-d6d885fc10a2", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283175, "uuid": "f22f7d7e-2ada-4003-a7e6-1bd6908d28fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283175, "uuid": "bb0e9c67-7393-4eb5-82f3-51a3763e0188", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8bc2dd-8ee8-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701283809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283809, "uuid": "08bb67f7-9eb4-47ac-859a-c7cd98a49c64", "comment": "Malware payload (AsyncRAT)", "value": "3f539535513c9d8dfcf6cbbdb53aeff0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283809, "uuid": "d1bcde10-8bb9-4cba-b1da-312d91525ab8", "comment": "Malware payload (AsyncRAT)", "value": "1c7b64935e81217c7a039843ef1356ef0cde664a2ae8233ee5250f77ffb21452", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283809, "uuid": "aad54e71-4b5d-4b77-abdf-14c8ea3a88df", "comment": "Malware payload (AsyncRAT)", "value": "022be7d30e3bab69355f237d7071218df950f438", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283809, "uuid": "5c9ffed4-7ffb-483e-bbd6-09ca25f6838e", "comment": "Malware payload (AsyncRAT)", "value": "67aca99b3570b8b76bec07ea5fe3786ea5d03d5e9cf54022335b4afd0741693f282f5a9875f9678d9f0756b0dcf1d81c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283809, "uuid": "40554d0b-a844-4f29-beac-de13aa8df793", "value": "T1A953F8013BE98125F3BE8F7469F2658546F5F5AB2D12D55D1C8500CF0A32B829D42FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283809, "uuid": "aa5b5038-004c-4a41-b445-8f135c1333a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283809, "uuid": "6d4970bd-fc6a-46ed-83b4-21f4f9d21769", "value": "1536:VmfWSqHdykrVMKuJUYFOGXw5bfAP9RE/xlrfTGJx:VmeSqHdykGKuJUYFOGXw5bfb5lnSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283809, "uuid": "68bb1dc6-a226-4653-9094-9973095bd868", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283809, "uuid": "53b4e6b7-b198-41c6-8801-b06ff601bb72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283809, "uuid": "d5e9d25d-fcb0-47c8-ae80-fde0e96fe2bb", "value": "1C7B64935E81217C7A039843EF1356EF0CDE664A2AE82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11c320c-8e5b-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701223522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701223522, "uuid": "b4d86942-4ccb-4c23-8cf0-8ad48048f231", "comment": "Malware payload (RiseProStealer)", "value": "853a559e0dcb25ab9605685ec776224c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701223522, "uuid": "5422092b-678d-4e53-afeb-0b64c6127b5d", "comment": "Malware payload (RiseProStealer)", "value": "1d63f406d5735152484a975a6aa536758f0cca2f890c04db8bc2cd2c372393fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701223522, "uuid": "c4edab07-5ab5-4c83-9a40-7c4603a462fa", "comment": "Malware payload (RiseProStealer)", "value": "c2547e02024a59dbf726bf6bc03b1cd29c7565c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701223522, "uuid": "b604eeea-2481-4c02-8369-60fd4bde6987", "comment": "Malware payload (RiseProStealer)", "value": "7311252f23292f1d9b379457cb2cc60dc69b796f2a8dbc01d81131be5fbef8fffba05938cc4bfd14d6776b5dd77ee678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701223522, "uuid": "961a37cf-b7d9-466a-b8d2-caa8495a7188", "value": "T10C95334332CD8052E7B9AF701CFB32C30A35BD88F5E446676A0BE96B59512D4E23539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701223522, "uuid": "7533c96d-fe89-4c57-87f7-3f7dbde192f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701223522, "uuid": "2a5cfd0c-65e2-4b5b-844a-cd8262b7ac06", "value": "49152:93mTOafM0CwkXdPY/eTwTvSYRvMpZwCBtqtMibzqarNS+qn3:duLfM0C9CKYG7wCBtqtZbear0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701223522, "uuid": "b8c3c715-5827-4916-ac6e-39f9f6841531", "value": 2023424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701223522, "uuid": "1cb9f730-4c56-40dd-b561-e35ccf1cf989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701223522, "uuid": "3f202e2d-bb92-46be-9f01-3a599be4798b", "value": "853a559e0dcb25ab9605685ec776224c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461228eb-8e99-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701249945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249945, "uuid": "2324f963-799b-4e63-a8f3-ec8e53fbad9f", "comment": "Malware payload (AgentTesla)", "value": "a6f3abfe902b8efa5a3f6074aaf0413a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249945, "uuid": "0ea098bb-449c-49ab-a609-d1d7d4ba17d0", "comment": "Malware payload (AgentTesla)", "value": "1e7617d15a0ba3358c412bf17bc39aa9c145f83c9c3488a4b8499fa69991e5d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249945, "uuid": "71383193-7989-45a9-ab30-cff7f8503ac3", "comment": "Malware payload (AgentTesla)", "value": "8c1c7f8ddf81b7948911c2a9fc16ba4b7d2c8e8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249945, "uuid": "b0d8f33e-ecc2-44a9-9c74-6e8f09f244fb", "comment": "Malware payload (AgentTesla)", "value": "e2b59efae4ebf8b39a2d3b72df8f7d874f2b56320e5149a67398856c11fcbd387a0063bbaa35d77add48c2b18bba1fff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249945, "uuid": "d19ebaee-afa9-4370-b8f0-ac8803964f5a", "value": "T1B5E4126072AD4F9BFC3993F50820E0054BB1BE3A55BBD35C1CE0B1DA56BAB600962F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249945, "uuid": "72513927-b9f3-4d0b-b622-22afe1be3439", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249945, "uuid": "efbfcdc2-3cd6-4bfd-958c-b3ce4d1194c7", "value": "12288:X9P1E6jD/RwdCHOOE924ekHzAtfYEe7Gh11z6ZFHQr/WpY25tsX7VYRVjKopoxay:NP1tD/RwdqO6kTjq1mFHy/WpYD7AVme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249945, "uuid": "eb36f862-e7ff-4a67-bce0-0606f28f81fc", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249945, "uuid": "83bf26e4-3e4d-417c-b506-fe006b9f1b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249945, "uuid": "eed1738d-2f49-42dc-ae9f-3f76c111840b", "value": "SecuriteInfo.com.Win32.PWSX-gen.22923.26352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b8900f-8e87-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701242242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242242, "uuid": "a6063424-049f-4174-946e-8fd2362291e6", "comment": "Malware payload (RemcosRAT)", "value": "9203e81e9f0750bd6c759535dd0c6cfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242242, "uuid": "b0bd0d13-b3ef-402a-9d4b-e3707e766155", "comment": "Malware payload (RemcosRAT)", "value": "1ec6d9467259d4524dd9bb3ff8d5d6befe7ffb90f64d91418880c5ae5071fd6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242242, "uuid": "3671d06e-e823-4b59-8f40-8c04f0238933", "comment": "Malware payload (RemcosRAT)", "value": "a741a11f3bd150e37f52d3c85adb000ccda9a90e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242242, "uuid": "c3dccd4f-2e50-4978-bf9c-5024767185ba", "comment": "Malware payload (RemcosRAT)", "value": "ee727d342be7d23bb1c1123aa3f5a1a699b2ed008cb130eba684a03d009f19f423f00d6cdca6b63fae9361988406f822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242242, "uuid": "3ecd08c0-a999-45a8-9d86-4a7f06f455a3", "value": "T10D25235372D8C617DD7913F49869E8314177BC9AA8B0E11D2CC6ACEF7A63B01CB019A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242242, "uuid": "0d249c95-3b8c-49e5-a2d2-fd9858ea0cf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242242, "uuid": "496c98a5-3a3d-4c34-8ff5-4fec74cc762b", "value": "12288:Clcopox4OnwPcvWRH9WYUDzisJpL0mvcJKC81B4jgD5jVbQDI3u3h0FOnjuo9Xt0:pein/adtUDzNpUoB4sD5jVR/6y+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701242242, "uuid": "0b3038a4-73fd-455a-adc6-3579de9338a9", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701242242, "uuid": "4409b766-e2fa-4d8e-819e-6e0017f0e460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242242, "uuid": "c08f1125-2b58-4e8b-ad92-1f301bf562f2", "value": "SecuriteInfo.com.Win32.PWSX-gen.28790.14117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43280731-8e8f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701245645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245645, "uuid": "3bbbe087-898d-4645-b781-c5fd9d67a668", "comment": "Malware payload (RemcosRAT)", "value": "01916bb6b25e2a99f62c3557c291b7eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245645, "uuid": "985ebfee-dbb5-4ade-9fa9-753d019ec353", "comment": "Malware payload (RemcosRAT)", "value": "1edac6d4e90a04a624c07ce659a240f4530d4634335faa698393c80cacba87db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245645, "uuid": "0a06f8c3-140d-4757-bec2-aaa49e6bbf61", "comment": "Malware payload (RemcosRAT)", "value": "860c38f5f0aa907dc3b8e0a1463eeaf16840186d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245645, "uuid": "3d4ae326-d7e5-4d44-9976-aa6fff49baa1", "comment": "Malware payload (RemcosRAT)", "value": "71caf162ce99fc947aab3ee1821be07b880d2ebb56dc8210d89365758f57a21dcdd477eb4fe515bc86d69d60bfcd205d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245645, "uuid": "843164c0-1788-43f5-8d5c-e81e2b70ce31", "value": "T1CAB5BB31B7D1ACADC251FA31267698004D165F5E3F38464E3F8FB5262FF6E0A2099D4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245645, "uuid": "b4e6fc86-438a-4b88-9f0b-37f893adc453", "value": "a68d8e2dafcb38cb88133c6298bff5cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245645, "uuid": "2d862d52-c497-47d0-8cea-ecef76221c1b", "value": "6144:pT74ZKA8lvBnpiz9iDiDP9KVdh0uzohH/+K/UReCVxiOYpraqCLY3WYfKMRPb4Tu:d4ZKSzsDGyDaH/+K/Ub31MQ6muOQrRPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245645, "uuid": "d78ed46a-5f06-4d2f-933e-92b8f182f344", "value": 2393192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245645, "uuid": "73cbc49d-0365-475a-927e-99fc8baae886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245645, "uuid": "1c1a536b-f25f-46c2-8320-a4f5b86636a2", "value": "localadvancedv3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c145c768-8ec8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701270338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270338, "uuid": "1d8be52e-75e7-4a1d-a9e6-6ec83ab67585", "comment": "Malware payload (RedLineStealer)", "value": "31dd9321975140a8db6e3c540fc62839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270338, "uuid": "721d2519-da6d-4a55-9ccb-efb4c5bb7d3a", "comment": "Malware payload (RedLineStealer)", "value": "1f006726286af92b1985dd160fd04511e14bf3a057214be582df838ddc50f058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270338, "uuid": "a3f05047-4f39-48b7-9bd9-2cc34db35adb", "comment": "Malware payload (RedLineStealer)", "value": "c0bba46b53547ed7d9effdd07339c5937049740c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270338, "uuid": "8b4a560f-5d2a-4d75-b03d-71f2d660b938", "comment": "Malware payload (RedLineStealer)", "value": "70befd182ed5b04ad7cb01f2da1c6eafd2104be21eb4c5d9d26e6fef3405e0e9c520f69cd510c71cc3e3bd621483013c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270338, "uuid": "ee50dd2f-4c4b-43d3-b0b0-559efa4a36ad", "value": "T191852312BED8C973E5B5337008F101570936FC56C638C6FFAB49998E0A722DAA932757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270338, "uuid": "c39c1ce3-a250-4cbb-948d-60ecc8f9c4f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270338, "uuid": "08ba94f8-aa91-47fc-bfef-008da65e5127", "value": "49152:zoWftfB8PqKxUwuBW5IbWhrIRGWD3zJ/0t:X8POtXbkUxzJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701270338, "uuid": "4b86d7f3-ed23-4bdf-af55-341e7f988a55", "value": 1826304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701270338, "uuid": "fd129a27-aa0b-4ae0-a92a-44c281e24cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270338, "uuid": "3f327e07-2c0d-4b92-a6fb-26887c030ff8", "value": "31dd9321975140a8db6e3c540fc62839.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77e409e-8ef9-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701291367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291367, "uuid": "924f2b2c-9f60-471d-bafa-57dbe93d7810", "comment": "Malware payload (Stealc)", "value": "5cecb579e1b2a6a37303439f92af1a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291367, "uuid": "aef19ec6-e375-4d53-9791-95a08e535001", "comment": "Malware payload (Stealc)", "value": "1f6011a2da78434b09f854d3ff86cb92ffdb3d6e953ce0a8535c32cac13cfdb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291367, "uuid": "c58d2022-b46f-4ce6-bee5-ccf9a9601a13", "comment": "Malware payload (Stealc)", "value": "d283469053e20db605a4c35628ad45cadf66ddef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291367, "uuid": "897eb61c-05a3-4753-92ae-bc3c09fe1d61", "comment": "Malware payload (Stealc)", "value": "14ab3f55ca152dd74661fdc0ea9ffaf6749ba0d466da71eaea019d95e745c2fa351bc5b2dd6aba19241276a6c8add1f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291367, "uuid": "47d6a5b1-09ad-44f8-a8b3-24e30bb743b7", "value": "T11734BE2276E1C033E1275A344AB1C7655A37BCA25B618ACF27A42F3E4E316D19F79307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291367, "uuid": "66a7ab2a-cff0-4e6b-b5e5-25636e17a2bc", "value": "10d5222eea59eee664433b569e6134b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291367, "uuid": "784bc35a-34e7-49b9-9ae4-26a7efa5d853", "value": "3072:SJJgBTGrU2KZKcQdet42xBD2iehuUIEfo2zYPGjYRXz/2fIQCYcAje+HHQ:dBJ2rpQt42xBD2ieXCK0GoXz/2fN06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701291367, "uuid": "05e07d85-d56d-46c2-ad16-d0c9dc738fb4", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701291367, "uuid": "9da57e4b-1a2b-4ae4-9768-fa5dd10ebd43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291367, "uuid": "044f2f71-3a66-43fd-b30f-9da17a4551bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce3cd7c-8ead-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701258734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258734, "uuid": "cd367325-d3bc-4f63-89dd-a137a2d4cb62", "comment": "Malware payload (zgRAT)", "value": "be12e363c356f2486cbde2d1459b9561", "object_relation": "md5", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258734, "uuid": "a631b70e-2548-4aa3-88df-8288614637f5", "comment": "Malware payload (zgRAT)", "value": "200eb8260c18eef2e2da74d5c78ec01616412d748ed39ecd04f3dce75d9038d6", "object_relation": "sha256", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258734, "uuid": "ae109ba8-a163-4e11-b54d-9c0f535ee26b", "comment": "Malware payload (zgRAT)", "value": "2f398bdfb9f2fc4979a7088973d3d7f7465eee88", "object_relation": "sha1", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258734, "uuid": "1e2919ba-9c25-4cbc-b82d-8d8cb3710dec", "comment": "Malware payload (zgRAT)", "value": "9891eb5410def8681870d218dd240a816a25d46cc58d6474a93d9a1e22ee1b91f13122713c71af4cd989617f86994e2d", "object_relation": "sha3-384", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258734, "uuid": "8979f7f1-53c1-4829-b57c-989798e693df", "value": "T1521533676A892294CB9F1BF76BC4D703644BC59E19D9B6B191C734C2C09B10FB0B178B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258734, "uuid": "0a3a79ce-2b51-4cd0-a4c3-0e070695a29e", "value": "24576:C/7XCQQhFIifNuL7wbJqXrOHaSIB0zZArvvL86dyk:i7SQUIincL10zZ4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258734, "uuid": "4c7181a7-c39c-45e0-bbfc-0b0a3bc02edb", "value": 939869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258734, "uuid": "12244e6a-6ffd-40c9-a7fa-dab3a56f9f8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258734, "uuid": "bade792d-e52e-4325-8c8c-106d41ffa157", "value": "CIPL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3b5ba4-8e5d-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701224185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224185, "uuid": "132ac43e-95bb-4a4c-a11c-c3be6068344f", "comment": "Malware payload (Formbook)", "value": "f9c83bb115f133ee1f2d3cb3f3147f4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224185, "uuid": "a9bd46be-9136-47bb-8e65-97c83f6a680e", "comment": "Malware payload (Formbook)", "value": "209679aa1403cd2c7e749d4d7a200346f6da67d4d51c62e33cf12a4962234047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224185, "uuid": "48f1ea90-440a-43c2-9f10-9bd235a0142b", "comment": "Malware payload (Formbook)", "value": "a50cd3eb1bbc9554d72ea06c71169716c8b50ebe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224185, "uuid": "96120281-0ad7-433a-bc34-2186a5a60253", "comment": "Malware payload (Formbook)", "value": "d1f93395ef6901ee4e11b0430eaeedc9486b5641c29e7ca274f1525a291442eac78ea3b04ba2f534d56bfea80a21be08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224185, "uuid": "f7030626-a81c-43ad-b2a8-27befcc129f7", "value": "T124049D2174C18072E1B302750AF89B3466BEBD214B766ECBB3C84F5D4A385D1AB36767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224185, "uuid": "a54aceab-2262-4a9e-bb02-f79f811a0cde", "value": "311fd3f73d2df83ccc26ba1163c75469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224185, "uuid": "e1e08984-2c7d-4289-8ce9-1d081be9fb36", "value": "3072:6N7c6uY/nGqsDhzayBXqZ1AhejcB+NVCVhpFP06YN/cQcY:6tc6uIbweGs1AMABauLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701224185, "uuid": "563a1b89-c3d6-42a3-87c2-af2227af7005", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701224185, "uuid": "b8d7ec85-2a70-44bc-ae99-2909724ffbea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224185, "uuid": "b18b7333-81e2-4e27-8fe2-2d1b7a0c7851", "value": "SecuriteInfo.com.Win32.TrojanX-gen.19205.17855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a339f7-8ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701272576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272576, "uuid": "1d77573e-bab3-44cb-b3fb-50643d0d0276", "comment": "Malware payload", "value": "4d2fa0b93bf4099ab8542e423efb85fa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272576, "uuid": "db1436c3-2fc4-4c44-b5d9-b610424d8799", "comment": "Malware payload", "value": "20bee040cc67d8b6c5cdb8f9713c2a5d28c654b963857625ac87ee440dc21fc3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272576, "uuid": "0184e5fa-8d84-42be-851e-76c59b0e614f", "comment": "Malware payload", "value": "f515f57fafb52fff6bc05ef21e0c42d25454003a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272576, "uuid": "f5ff5490-7706-432f-846a-c3c481d845c2", "comment": "Malware payload", "value": "1ed68dd2be97d8b32be5b4eb7f250eb2e5a6da9780887834966fe264d6e022780fac9b59d1a555ebc98d726214d8cf85", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272576, "uuid": "cc41e526-f77e-4a10-ad55-9522007fee9c", "value": "T169B633F96B332154D581B058857FC4CF8D8742AED168B1AF66BBCE7CD25A2801BA3743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272576, "uuid": "f5ac564a-fc94-4ef9-90b0-e9f701f8fffa", "value": "196608:k/hF7shYfA2Yz90XAtbujzGW++cAjEBZWZK5X17v5kF0eXEPWPy:ihugjXAoPGH+cAjus21CF0eXWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701272576, "uuid": "dd12d05d-c958-4a51-ae69-3ea1ab4e69d4", "value": 10434105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701272576, "uuid": "2bd48f8a-4712-44aa-b595-0dc3c633c8a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272576, "uuid": "f3cebadb-6dec-48c7-aacf-56c405660458", "value": "archive_20231129T154042772Z_73959.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d05573d-8e97-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701248990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248990, "uuid": "1980676d-c020-4f18-8e1d-5ef9f95e28ec", "comment": "Malware payload", "value": "c2a0c50cda64787f265a2e15fac98140", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248990, "uuid": "98096761-f693-4375-8b9b-b0d5dc6ad52f", "comment": "Malware payload", "value": "21065ad81aeb62e1a1987006b28ab35905655c08e7b59b06b32c34277b03c311", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248990, "uuid": "820700d1-c213-4e25-bb57-70481904e4ed", "comment": "Malware payload", "value": "29268c378cd47523cd44e0c35709d13993f25012", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248990, "uuid": "9746b9c3-276b-4ead-b756-241c61966c54", "comment": "Malware payload", "value": "f632fa24d9b0adc0d91459278f1253b73006945392f55ee1845cecaf6cef6ca1744eb9ba7912aacb5fc13ada0276bddf", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248990, "uuid": "df937210-9dee-4f28-914b-e551a025d6b8", "value": "T11AD3896DD74B02A98F62933BA7274E0586BCB72EF30051B5306C537433EAC3999265BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248990, "uuid": "77315047-25b1-45cb-9302-ecfad2d45103", "value": "768:dwAbZSibMX9gRWjbY0eOLYn208F4msmXqXSX1aXV/2ZEHlpR1DA+qK:dwAlRSYnOLYnL86mXTaF/2ZE7bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701248990, "uuid": "a73aa126-6545-42fe-a754-d1ef0ab1aefa", "value": 134813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701248990, "uuid": "ef64f621-a9b8-4234-8b92-f0369ffad57b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248990, "uuid": "5a4a5845-20e3-4233-a149-7cf178cbca66", "value": "PL1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce79992-8e5d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701224186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224186, "uuid": "738e5a66-2fa7-4587-977c-4400541cc641", "comment": "Malware payload (AgentTesla)", "value": "829bd2c14882f757efbf03a531f2353c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224186, "uuid": "3e77862e-a922-4c25-96e9-b9f5c34dafae", "comment": "Malware payload (AgentTesla)", "value": "220be96884f744741958b96b4eb85d3b23637f457a71e836190b9b4546e45574", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224186, "uuid": "96380d63-1d65-4123-a2af-dc0cf5665d72", "comment": "Malware payload (AgentTesla)", "value": "c59b72c251ecb4b017bf1afcaec782fb7021e53f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224186, "uuid": "6881847a-09cd-4b91-a455-36809fe3e603", "comment": "Malware payload (AgentTesla)", "value": "5b6f966659178f3be81eabf775b649b1760efc2a7d1013500f3b700e1115b9afffa63ef13a7037386b8e5d1aa54a1e60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224186, "uuid": "f5ddd387-e3d3-460c-bb28-c30872423895", "value": "T1FBE4AC98B3C2BBB5C5D437B5CAE49E534D3BBA2D396C9106F8A93BD98039ED00140E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224186, "uuid": "b4641ce4-ed2f-404e-86b9-5f77d4a7515a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224186, "uuid": "af4db993-0319-4ea8-9e2a-05a6ad92ecd9", "value": "12288:cloQfd+0+YucOQpApQrE17LtYKslSU2/eDSclThdo3yRCql5vWCXY:8Pc/Yt9pSQre7hjslSU2WDSo7o3ykqlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701224186, "uuid": "b0bec104-44a1-48ca-9687-c6e623f33877", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701224186, "uuid": "56c7d871-00c6-43c4-a0f4-9f62184308bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224186, "uuid": "9d20f540-aa46-4b6d-8a5b-8a40adfcc15b", "value": "SecuriteInfo.com.Win32.CrypterX-gen.25293.1967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65014896-8f12-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701301966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701301966, "uuid": "acbc70e8-b7db-464e-9eb6-f8373caa9ab7", "comment": "Malware payload", "value": "b13b0cf148e3a25cbad37604956df69d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701301966, "uuid": "f313d96e-11a3-4ddd-a2f6-2b03d16d3a97", "comment": "Malware payload", "value": "2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701301966, "uuid": "c514eb05-46b2-491f-a73d-a467cf5f25ab", "comment": "Malware payload", "value": "b7136c309dd803a1303c6d93c1aafebb00e1b6bd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701301966, "uuid": "4078632b-1396-42bc-b83d-948275e400db", "comment": "Malware payload", "value": "691416eea30eae84e1a167bc6c58a6f47cb9779dcc1b411f865a92d5e14bfadeb89feb738dfe859b2d7d30386f5ad44a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701301966, "uuid": "1ae20acd-12ae-4315-a260-86d26c8a0115", "value": "T10CA5295DAE3A806EC21DC53D9817957ABF703CD48B2AF2D742122A19DF3E3E41639358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701301966, "uuid": "e425a4c8-7c02-4526-977d-275867265c54", "value": "24576:fBlIwwkElBoKQs8pRUm6rPtWYW/x91J8/k:fBmQEjoY8Xbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701301966, "uuid": "d8162632-23d4-4ca5-ba7b-2de890a3d92d", "value": 2134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701301966, "uuid": "4bf1bffc-0b17-47f5-a826-af94ea85ddf2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701301966, "uuid": "a5ef5b4e-7d8a-4a8e-8f97-052cda1249fe", "value": "build-100.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2453a9db-8ec2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701267497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267497, "uuid": "b9e094c4-af7a-469e-8170-036d97c3d172", "comment": "Malware payload (AgentTesla)", "value": "1a0dcf2f39ecc46882855b4f6478f8b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267497, "uuid": "a109be8f-c5dd-4ec1-b9ee-7165690a9ddf", "comment": "Malware payload (AgentTesla)", "value": "242c9fcb4922c50dec24989b8994de592f9c3eab91b64196f106a54cf89ba61f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267497, "uuid": "f0804bb5-9a69-4666-803b-c45880b45917", "comment": "Malware payload (AgentTesla)", "value": "0a6d8e35ac1655d0675cebd84ae9f50ef7b6a984", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267497, "uuid": "6eefebf1-0c6f-4c44-9b1f-42d66af3f152", "comment": "Malware payload (AgentTesla)", "value": "b3130534eadf784a849eac76db43b10e731a7f7e27113e871b503e085ad1b10c1a1e3ebceb6a05251e4fd2f96f483dba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267497, "uuid": "926e2ef5-1d7e-4d9e-a425-6464321d7593", "value": "T11415CFC5E58896A0DD69AB71AA36CD7543237DBDA834941C28DE3E6B3FFB3931021413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267497, "uuid": "2be4d5de-3d22-4014-b148-99300220d9bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267497, "uuid": "aa965da1-38ef-485d-bac7-ca0ac03ff362", "value": "24576:FCCCCCCC8CpCPCCsCCVeNOmYNjYjg+k+n6xpoUh8OFoMjRX1q:Q6OmsjkZWOQXoMFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267497, "uuid": "5e1bb5c8-0f0a-4a5b-bee2-996d4f8c5a3d", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267497, "uuid": "493f1910-6bbe-495e-a53e-b7925558a362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267497, "uuid": "c67d9afe-0827-431a-a7ac-6ebf3b413c3b", "value": "correction invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549077cf-8eb9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701263713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263713, "uuid": "1263754c-9de7-4786-b7c1-9f6e5da4d50a", "comment": "Malware payload (AgentTesla)", "value": "43cacd3a5c59cac7965018ffb183a2a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263713, "uuid": "9d740676-acc2-4152-8d07-92be48b0ff99", "comment": "Malware payload (AgentTesla)", "value": "246ee881d5047db5525e8c5f180bb6f960c6a9bbeb98830f90efb70e8dffba99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263713, "uuid": "73f75ecd-b43f-47af-b218-908d25747d1e", "comment": "Malware payload (AgentTesla)", "value": "c2d345011a237b1f6f45cc71bba708db53275605", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263713, "uuid": "223693b3-1054-4f1c-804c-6a8ce5975022", "comment": "Malware payload (AgentTesla)", "value": "65861837257b972907820ae30ebd9b51813fd131d42de490a468d481524ec4008cae73b914933aa22ff9098643e3717e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263713, "uuid": "c3c1d5f8-9452-45d9-a550-a844ea6bb00d", "value": "T148E41369A1EA1FDFEABB93F4142090048BB5AD3A553AD31C1D4471DA4ABDB301F21F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263713, "uuid": "66ef2d1b-d187-4c6b-93c3-2be4049b1b19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263713, "uuid": "470bc973-80bf-4bd3-80cc-6f8825a54377", "value": "12288:wqZ1E6jD/PJK2MkHIlS3XwPfsuAxwQBoiGv7dM9LNvqf5el0uHzopox:LZ1tD/PJhMkolS3XwPAxwQB7GqTvqREe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701263713, "uuid": "30567b40-beb2-49cd-be7a-67d5d4f13da2", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701263713, "uuid": "b55f9a52-626d-4c0e-99ab-63bc7f42dd39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263713, "uuid": "0d213a1a-e63b-4d6c-9444-5a9393eda00a", "value": "SWF314811802010002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eca35d-8ec2-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701267849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267849, "uuid": "99146308-8beb-4a81-8396-92f16e34d462", "comment": "Malware payload (SnakeKeylogger)", "value": "528120e21119abe464179f5ab433a333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267849, "uuid": "32fa6fa4-6095-47d3-afb4-85c98c133a46", "comment": "Malware payload (SnakeKeylogger)", "value": "24c6082628e6b6daeede59cf5c1f1174a3ab6b3ac7e0d795f8c7c3af490f1940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267849, "uuid": "45b961eb-cee8-4392-992c-e11325b29427", "comment": "Malware payload (SnakeKeylogger)", "value": "b80f5f12815584bddb246d36427c994629ba5c8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267849, "uuid": "d99f6c0a-780f-4974-a4e9-66c433a3399b", "comment": "Malware payload (SnakeKeylogger)", "value": "27ea3a789390d0b59aef55b452a09f5632959bc1c628390f6727d6847e6e0de2c0372256e7ce8575c0947994a7db66ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267849, "uuid": "2f6fbf2f-640b-49ed-9540-44f0b690230a", "value": "T1F3B42371946893BBD07F0331017FDB5A2B22564E4456ED3EE90716DF63AA37A04A0F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267849, "uuid": "440e1065-8ced-44dd-be71-57464536fe71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267849, "uuid": "b5b209d8-9add-4e60-87b8-ec23f091926b", "value": "12288:IN72CULP2X6Y+zbok1xB9vb5R3GhnEDVXyFRQ4ShjqFB1D:paqbzcUxz2x0CF7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267849, "uuid": "ed13c0d7-c305-4c3f-97c0-4b78b368618d", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267849, "uuid": "0f94acd9-ca04-428d-89eb-394c3ab65bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267849, "uuid": "50edd554-422d-4577-8d56-0d8379592ac9", "value": "z56Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2110bc4a-8e6e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701231414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231414, "uuid": "9f603e62-8aea-4f75-9a84-a9d3ae2ae9cc", "comment": "Malware payload (AgentTesla)", "value": "1c4ebc320215cb70a76eb1aab5944dd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231414, "uuid": "64fe1158-8549-4cf5-a35b-2ea55747796b", "comment": "Malware payload (AgentTesla)", "value": "25cf9f55b14f768b46e2f505c038170b9934121589eab79193da2a38b1af50e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231414, "uuid": "a6961286-2812-4c91-8742-3ad4b5786e3f", "comment": "Malware payload (AgentTesla)", "value": "d8e8328256c47b6d28d46368c16fc918343d5062", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231414, "uuid": "163b34cb-11dc-4011-ac1d-473e850724f3", "comment": "Malware payload (AgentTesla)", "value": "e72424a97213bc284b241f8a6a042462566e487cc8957c2019edd375f274235f811c544a9853044337f119170bdaa8f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231414, "uuid": "b9e5b9c8-c3f9-4d4d-97ca-b15edd0e91c8", "value": "T154E4228631D88A93ED7817F50421C4766372BE66AE34DB8E6ED16CEF3E233014A51763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231414, "uuid": "1f3f70f4-57df-48a9-af8d-de2167d7a73a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231414, "uuid": "95e583c5-a78d-4409-9513-419f572f84ad", "value": "12288:hvcopox49T2iUIGiqbeIdzc2HCAu05uNbxbSxrRtEWkF2o:qeBTVU1iqbeIdzc2/u05urbSRRmWkFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231414, "uuid": "263a61a1-24c2-4bbc-a364-3ed00f92a0a1", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231414, "uuid": "954684b6-fc5d-4d5b-b381-b210a7e2e7de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231414, "uuid": "f55d9305-0e16-4a06-8df3-5a14a3ac671d", "value": "SecuriteInfo.com.Win32.PWSX-gen.3470.1570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8339446b-8ef5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701289561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289561, "uuid": "2de77861-a903-484f-9d72-16a46c2b25dd", "comment": "Malware payload", "value": "de9af0817acdf9357e04950e258cd744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289561, "uuid": "2b8e5f9f-ffce-4ad6-b9b6-05d5b477a1c8", "comment": "Malware payload", "value": "25d18c69efcb91e12f5ba3ad9d7af50ae7ef821b045ee3786f6d30f7668edd48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289561, "uuid": "baf8070d-4e0e-42e6-91d9-5a569b88164e", "comment": "Malware payload", "value": "ad59ff56ca37d1439c8dfe5350d51a45d644c3ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289561, "uuid": "2cf3a1ce-fd7e-40a2-a4df-9926cff223c6", "comment": "Malware payload", "value": "f8695a3ffebe84b23370a463457397b61b85d80b69e6b596bb495e134f5c5f961cb7971d353714f6cf80c637b93b7b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289561, "uuid": "dc0c3f6e-be10-4769-bd90-6c5b846a8834", "value": "T11F24D566E348551DE83E433CB41C38709F70BC52E16ED32E45BA7EED693BB498A205D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289561, "uuid": "8febcd0e-8482-4d03-a61f-3715f544801b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289561, "uuid": "0bc9ae61-6187-4ad2-8ca1-3ed614f8feef", "value": "3072:F3FDkMeM7yNgcpHBOrfSlqyo6iIcsRSdg61SWwH48I1yKSl:F1DkjM7yNgcpErf8o6j0261S7Y8I1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701289561, "uuid": "fa145f13-3b00-4bab-90ed-1efaea236cac", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701289561, "uuid": "7fdbf56e-42a0-42c0-9fb9-115dc8334c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289561, "uuid": "a8a2edd4-16f5-46d0-8391-cb4aa958e6d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f76e578-8eba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701264080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264080, "uuid": "8fdd628b-499c-42c2-9285-56c9106b545a", "comment": "Malware payload (AgentTesla)", "value": "5a64c96ccd06ca43c155577a49a77420", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264080, "uuid": "1d9238c6-7d7d-4c4c-8544-ce5771641968", "comment": "Malware payload (AgentTesla)", "value": "261445c7e46260e4be5a14f4603478a26bb69b3158c81197c62786f43be29939", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264080, "uuid": "f30f29f2-bded-41f5-80f1-5e7715ac976e", "comment": "Malware payload (AgentTesla)", "value": "88c7b0e46c77982490ac3479e81c97f017b751f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264080, "uuid": "fe7829f2-32a9-4685-9c94-0e4e2ebd5221", "comment": "Malware payload (AgentTesla)", "value": "290c94ff499018ea36020277d6b9961bbcb5b9df01f59f9e03a87b72efaaf4195c06e29a4ed90bf23a73cce5951030af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264080, "uuid": "2bb45c57-53dd-4df3-8bea-03db62274184", "value": "T15005E01BA1E66B56DDB297B65D34A12047B7AE2A2B3DE73D3C9130E74FB9B004001763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264080, "uuid": "10babd8e-a66b-4951-a868-ea96ebfe8796", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264080, "uuid": "71b23ab6-927d-4004-bacd-a6b1761be8c1", "value": "12288:hHtWpdqxlZ5RnwUwZxqsPBfJXKtha53yrH7vP6AI0opoxKFq:3WpdahnwUwZxBPBfUth0irH7vPje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701264080, "uuid": "7a0e8ca8-4cd9-4330-a00b-6dfc73b4b6e8", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701264080, "uuid": "237988de-2104-4141-9aeb-8c412d49c9f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264080, "uuid": "3ac45f37-4b37-40bf-a40b-c3339a9ac303", "value": "purchase_order T&B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37e621d-8eae-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701259175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259175, "uuid": "c2901313-602c-4574-8969-9a3e10547603", "comment": "Malware payload", "value": "8b2871282e466a6fc5182204a618ddd2", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259175, "uuid": "8ade9d5e-bf8f-4c76-b9a4-3d9c8224c463", "comment": "Malware payload", "value": "26f9955137d96222533b01d3985c0b1943a7586c167eceeaa4be808373f7dd30", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259175, "uuid": "4e9f1c4e-b8d0-4979-bed2-524c3fa0339d", "comment": "Malware payload", "value": "9cfb328e6815188c7c1a76fab37b75781c920f50", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259175, "uuid": "fd267491-4dab-4313-813d-4669667a1c97", "comment": "Malware payload", "value": "ac607baffd2e05b8cf46e6e477cb07e4bd3778bbbedcf71a06d90706870f5ee18b4bae874107dcc6da7e895bb0f6f24e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259175, "uuid": "c07ef388-5e36-40f1-983c-a426f27e4c8c", "value": "T1241140609F533A62DEA04DF831CE83A48A8D8B59D54078C68B05A8881722AD57B1BC02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259175, "uuid": "08b9a384-d92f-43a8-98c6-38128a0f12a8", "value": "24:9rLju4E6KO57DA+xdkpkgPXlLqNFbOiKRXhuUQz/dWLKC:9CvmJupkgPMzOiKeBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701259175, "uuid": "4a51acd4-5308-4470-8a14-39f92b4d8d7f", "value": 926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701259175, "uuid": "b2ba386c-1d0e-4740-830e-7803d447ae8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259175, "uuid": "722830cc-be3f-4f1e-97d3-cfb176ab492b", "value": "shellcode_ps1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c15b4c-8e6d-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701231333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231333, "uuid": "97c5d50b-e80b-4ef8-99e7-5670cdc65da7", "comment": "Malware payload (RiseProStealer)", "value": "93a5e2ce8e61b086777039b7e341c3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231333, "uuid": "024209b8-6353-4da1-bc8f-cdc73a7a9bd1", "comment": "Malware payload (RiseProStealer)", "value": "279cdbdbe98ad615ecf2f4d29117506258987b3c656ee983c88fb7d0830158f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231333, "uuid": "7f42595a-d773-45f0-aeca-57233d7ca074", "comment": "Malware payload (RiseProStealer)", "value": "6ee598a171c0eab30692f36be6ebe51902692a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231333, "uuid": "c28514d5-22d8-4f11-960c-49d495702684", "comment": "Malware payload (RiseProStealer)", "value": "f545af49cfb0dfb5bbe8dbff5368f100dce538052714d4da8eefacc735992e54b0648007a912785e0f76372271ebb2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231333, "uuid": "6a33b71f-6c71-401c-9df9-373ba041f947", "value": "T1339533026EED8192E6B41F349DFE6763193B3CA06A70E7B21354AC4D1962710E63633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231333, "uuid": "a7770ab9-1d24-4601-86c2-62ab348a741c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231333, "uuid": "21ecb0d5-3644-477c-9c7f-c967969a282c", "value": "49152:jBtU+wV3zvLUyXKS95gquqFqzvjLGhfwK/z+zVlKdcMFEGDd:dtA37LUaMuRwK/zIVwFZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231333, "uuid": "4e7ba1bd-3c1c-467b-a073-cca7e4c58521", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231333, "uuid": "d384cda6-ff6c-4db6-a62a-e3c33c156390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231333, "uuid": "23c372af-718c-4562-8250-dccf03587e6d", "value": "93a5e2ce8e61b086777039b7e341c3cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2024847-8e9e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701252354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252354, "uuid": "c6c51e65-839e-480c-a962-b3432999597c", "comment": "Malware payload (AgentTesla)", "value": "8a41910a5f3960d6e666be295331e764", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252354, "uuid": "ef4f32db-5436-448c-aa11-5208eb9d3ab2", "comment": "Malware payload (AgentTesla)", "value": "28790d9297cd9c705628b649855286df13c4a1ca8d44221fd0130dd447f65330", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252354, "uuid": "72ae1357-727d-4611-bca3-de4e7619088e", "comment": "Malware payload (AgentTesla)", "value": "1f4efb88bafd6bf9b01b06c4f167eb197d669538", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252354, "uuid": "275a4971-8991-4678-930a-0a4825ec48b5", "comment": "Malware payload (AgentTesla)", "value": "b586f6be4ecbb39f45fe7913aa76e9e0f36c618cc91a60fdd5dcf7ac65d62c1d5014cc6ccb671791074fb0a0b61d108a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252354, "uuid": "ddff3848-0a88-467d-8b35-70ddd48929dc", "value": "T1A874131622D091B7DD774E3154B694698AE2EC442962C38BFBAA7F1F2D3ABC74D01213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252354, "uuid": "71f4ccb2-dc42-40b0-840f-726221262331", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252354, "uuid": "ac24bf7b-a1fd-459f-85e3-ed0525632130", "value": "6144:wBlL//9aagr4kdIXl1BhD4OY6vgTZ3ryUs+rYafGYuZPtr5kJgMUYAyqlYzqgvHM:C99P0kTAPZ7d5JSPkJgMlpX2Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701252354, "uuid": "b8d29e68-78e0-444e-bcb4-07cb9e9dde83", "value": 362333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701252354, "uuid": "bdf9958c-9ac4-442b-b70e-cd63e25a389f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252354, "uuid": "b4430ab9-b467-4246-8e31-457e4fb233df", "value": "\u00d6deme-9092288282827223.html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10918b4f-8ea5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701255009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255009, "uuid": "1fa56ca0-4618-4cf6-b5d0-fee3826e815d", "comment": "Malware payload (AgentTesla)", "value": "0c0effa96012a2b63db5725f4d2de54b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255009, "uuid": "13cdefcf-9679-464a-9872-df4f562ed340", "comment": "Malware payload (AgentTesla)", "value": "295e8e26cc7553f7f2025f30c86119d6031606b2840f563bdfb921558fc66b20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255009, "uuid": "6d333586-393b-4047-895f-5a43ebe12d8e", "comment": "Malware payload (AgentTesla)", "value": "78db968949c790ce7a5441283d1cdd3d070454e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255009, "uuid": "fd8fb4b9-61e8-4a5b-9e14-3c1d1e0198d8", "comment": "Malware payload (AgentTesla)", "value": "dba1fd24dbfc5c93343f1ff052b082d85421e5d19c3cff80761dbc6fa9f41b542a89e711572cadbcfa768b589d673914", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255009, "uuid": "0d0393bc-b1e8-46d4-9bd2-782c46703caa", "value": "T13CE423C1875601472CB94A42CADFC332FC551A0866FD6FF68A17D2D403EA96BE3605BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255009, "uuid": "03db4b39-972c-453a-945f-102869be5457", "value": "12288:EmZqCvXVOmyxuYazS1oqhwfs9Iy28XvqkGJjD8Y50+Yk/c+EeE672XHGO5Si+ebD:TZvHeuY71Bh+85Xv4JhuLmcvq7tGjbck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701255009, "uuid": "0a470de8-1c7d-4c48-92c8-ce623c1e8cee", "value": 659437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701255009, "uuid": "e09a2487-53db-4441-a24a-a5d2d1c6227e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255009, "uuid": "7557b2d9-d940-4ddd-80de-b868f7e916bc", "value": "QUOTATION#20985.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcaff68f-8ec3-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701268236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268236, "uuid": "651286c9-8ea9-46ff-b634-c515637c13f1", "comment": "Malware payload (RiseProStealer)", "value": "a465dd9538d1a320f8f022fddfe4c556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268236, "uuid": "a5b1b495-8ee4-484a-906f-2601f99414d6", "comment": "Malware payload (RiseProStealer)", "value": "29b56c8ff017cf879af21388f2bfac638bdf133016db79e41edc06d2089b1682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268236, "uuid": "e95182c3-399f-40f8-91b0-f11ff255a8d3", "comment": "Malware payload (RiseProStealer)", "value": "d72d87365bf35a1ae0eeba53d6fdd37509c6e80a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268236, "uuid": "d4b6e6d5-d637-47ca-aa98-122b4e98d1d2", "comment": "Malware payload (RiseProStealer)", "value": "872045ba10905f77a8e712232875c6fbd58b7ac2736d347aef74e8b5e8ef71024073d8a17b68f8c5842d82da762d5093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268236, "uuid": "eaf19311-3da5-47be-add2-4fb7560570f6", "value": "T19D65235273E59412E5F52FB409F347A30732BCD2FEF0E25B2296A8591E53214B5B232E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268236, "uuid": "ae99523f-3243-4a08-a2aa-691cbd259086", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268236, "uuid": "e40c85b3-777d-4079-aa03-42949c6ffdc1", "value": "24576:GyIRhzJDSJNogVkDY6jwx6ebX5RLD+D28WlhDiUUbhEIxgWaxL6Ek7f:VSvcNxKDX8keT5RmDe5iHhs5UE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701268236, "uuid": "7f4441c6-610a-40c4-b978-d08c04c1ffc6", "value": 1525760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701268236, "uuid": "1c4b90ae-dc8e-432b-ad54-b60d7123cf2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268236, "uuid": "3ce63e8c-2565-4944-863d-12b76ea1dbba", "value": "a465dd9538d1a320f8f022fddfe4c556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3cb66c-8f0d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701299721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701299721, "uuid": "3af6215b-fd6f-40f0-b17c-8e9d0dd7d52b", "comment": "Malware payload", "value": "6c988eb9bfb52b15e606b28dd9b2997f", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701299721, "uuid": "57a39124-5b08-4139-929c-7bd143d11dd2", "comment": "Malware payload", "value": "2a7876be11ba9711d3c40dc32d0a682ab5d9f5f97a1e48800ff0e071c4494418", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701299721, "uuid": "c23db05f-9d20-4d60-8b70-d9255070849e", "comment": "Malware payload", "value": "42119f1efa6346e02918fd5339559a6e3372fa3b", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701299721, "uuid": "a9093329-2397-40bc-975d-cf0b78e42529", "comment": "Malware payload", "value": "8334c41b35ef84b6b8c20aef669e70e7a8e568269932d250d1f50b49833182bc255eadcded10b40419ffc3cb1c1b7aee", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701299721, "uuid": "ae218a29-f533-474f-932b-123dcc6b6d31", "value": "T1B761D1932151B8E9414287BF3D5966F6807FC224A64A6044F78C9F9DF9DDE63398E3C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701299721, "uuid": "069709cf-6dd4-4975-9c5a-477bca94f382", "value": "48:Ax+MTLimb7Tf8Bj3oVKZA31jgCfdJ0HuQ+3hFi5QsvuiBrVxqT/sFqxV:5GtDCj3oVSA31jgCfdJ0HQmAiBrVMHxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701299721, "uuid": "9709e40f-cb01-47c2-8342-48c7886397de", "value": 3250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701299721, "uuid": "dbcebf17-19f9-43d4-b544-df13e8f2367c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701299721, "uuid": "aa11fabf-d6bf-4e4a-a0ad-917618ab925b", "value": "NXBuwAyp.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62e2985-8ead-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701258696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258696, "uuid": "5df56bc8-62d0-4028-b4d4-2a97170ab28e", "comment": "Malware payload (AgentTesla)", "value": "e33a539e48b855577fd9aa719be99ca5", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258696, "uuid": "1d0252d7-677a-4469-b3e7-4a877b9bd035", "comment": "Malware payload (AgentTesla)", "value": "2d8dc695cd6550016a346190ab18bddbac02effaa80ad12cadef549cbabcaa1f", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258696, "uuid": "ab166475-35db-4278-877c-c4312b817eb0", "comment": "Malware payload (AgentTesla)", "value": "897a583f6c25443b0a03905d03ed322612c84cc1", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258696, "uuid": "e677ca92-e7a9-4c24-a5cc-bcc5d900aa90", "comment": "Malware payload (AgentTesla)", "value": "fbfff11b5f7257e2bf58efdebe8f7803a6cb0e3911d9c8babdf1df83230041e83548bbc2d7421d6817b5117879600ed9", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258696, "uuid": "aeaafae7-6dda-49ab-94a2-1ed9d038044f", "value": "T1E4150153324465EBCC2E0BB9A443E9B502B47F76B7B6D18E69CAAEB33443702055F079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258696, "uuid": "72b31bf6-edfe-43da-acf5-1c8212e93a18", "value": "12288:Uvcopox4iRF2UVrqF7Q4F17Xg0GJIQeukDiFXhyOMZnRghSGp7fG+0oypplPZKS4:fe8VSrXGF9vRxnguf9TwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258696, "uuid": "27c6a836-e824-4015-a2ef-9431467b65b7", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258696, "uuid": "21689990-4947-4735-a304-d45bc94bc97a", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258696, "uuid": "42f2118b-8acc-4741-9492-0e326cd9b139", "value": "Ningbo-Overdue 786542.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779d490b-8ef6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701289971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289971, "uuid": "d392b8ac-30e6-439a-bb95-b3886d86524a", "comment": "Malware payload", "value": "8ab22f6383453b92f082096204560c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289971, "uuid": "8816eefe-7ba8-41e3-9dbf-9a93e7f35fdb", "comment": "Malware payload", "value": "2dc2c00880d2115b0f9cb7dc04e36fc4b93e6f0d6557b6d88e41fab0b577875b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289971, "uuid": "e4370f3e-6ceb-42ac-9eeb-f0836c4461d0", "comment": "Malware payload", "value": "845e40d5bf81632f5c34202c244d7e13cf6e5ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289971, "uuid": "97ab5c4e-c9ae-4d01-b6b2-c7fccd1e156b", "comment": "Malware payload", "value": "4638913221ecd63db1c2e4de224a2ba94f3b24a4ccb36e3924c42712de9b2769623b149300838533a9e06a95ca6d3c5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289971, "uuid": "f45b6d5f-7482-449f-8e89-fa8b1fa40d3d", "value": "T1DEA44F03950D402CF626B2BF9C98560AF92F891DB357E1DBA637A4CC43325F26D38759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289971, "uuid": "23edecd8-a27e-47f5-ac86-baf8264ba55c", "value": "201b3bcc084212c558493e72b2f488e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289971, "uuid": "8281ce7d-daa4-498d-8dee-0d516ecc2882", "value": "6144:HW467ov/u4VbSYxyjGaSAWWBqS7CEfg9Fw9:HW4ESm4VbS9GCR7CEfwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701289971, "uuid": "21f86fca-dc4a-45bb-b7e8-d76144e72889", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701289971, "uuid": "5d8f4f20-3669-4880-b048-88d1f0595c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289971, "uuid": "db50fd15-dc20-46ec-b4c0-3dbba5f203b1", "value": "2dc2c00880d2115b0f9cb7dc04e36fc4b93e6f0d6557b6d88e41fab0b577875b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccefb3c8-8e97-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701249312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249312, "uuid": "30586cf0-1959-4ea3-ac6c-ff782e205326", "comment": "Malware payload (Formbook)", "value": "e7c8810d0f8e0731f926e1588a6ffb01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249312, "uuid": "5a02d3a1-a059-403d-ad0a-73970cf82f58", "comment": "Malware payload (Formbook)", "value": "2e62724f7fa1529fe91a2ba1dfef01c4b4180bcd1b51e1a2c1e0f489ad416427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249312, "uuid": "549ea05b-d3dd-476a-b9b8-8919e49f9c9c", "comment": "Malware payload (Formbook)", "value": "d111c18b0b4ad4b0806d1374db04deb61409c683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249312, "uuid": "1dc6f94f-1399-4c2e-b5a1-953c841806ca", "comment": "Malware payload (Formbook)", "value": "054dc3d93894e7bad4623379ce8b87ea07d8cd0a1f649de6760406f3795a1ce3efa7ec857c2e42b3ae8ef1dead71a8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249312, "uuid": "1bda8bb6-a888-4693-94f6-917281535434", "value": "T1ABE412527BC8C326EC3993BAA435D9B103B27E262075C70E59E5ACEB7D337104A52B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249312, "uuid": "4dd2d0ca-0cfa-4782-b798-8861ff2cbe3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249312, "uuid": "0b7a18f1-792d-406c-9411-a464c20eecb5", "value": "12288:0Qcopox44D4aGuobVePn49CRclDW4GrGDJGHH1eqkWDx1ChIaB3P:ye3Npeg9CRYGrGlGHslWD3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249312, "uuid": "7d90ac8d-c253-42f0-9961-2a6c20c76af7", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249312, "uuid": "9adef4cf-705b-47f6-962f-55e0fd2c3cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249312, "uuid": "ac88939b-b041-49b8-af42-2b32507122f9", "value": "reV4k1kglqeSbHd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae37aa2d-8f06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701296935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701296935, "uuid": "18133b7b-88a4-47b6-8892-ac2128fd56e3", "comment": "Malware payload", "value": "07db05ee98e9284a52f767b6410acdd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701296935, "uuid": "2d76685f-d807-40f6-8166-1ac866ccc2ba", "comment": "Malware payload", "value": "2f9b3c29abd674ed8c3411268c35e96b4f5a30fabe1ae2e8765a82291db8f921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701296935, "uuid": "9ee829b8-88b7-43a2-a2c2-138478bda14b", "comment": "Malware payload", "value": "0d43f5e0524d00507595a36d3c192a96ef2c5fee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701296935, "uuid": "2b2c161b-6dfa-47ca-b442-354f753e26a0", "comment": "Malware payload", "value": "4e771f377ccac293238c36b59e9b02872143aebb28eb7f39bd35aad21b6aa908c6ad1839b08e6486504e65bf98212f48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701296935, "uuid": "a9c905c7-2133-4d61-b5e7-81fdd59cb4ba", "value": "T17AF61903F8D61098C4EAD1B489254271FA71785C1B7923DF6BA1F7B42B32BE05E7A790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701296935, "uuid": "93de78ef-0173-4e19-9033-5edbb889908e", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701296935, "uuid": "8146db76-ee56-4999-a5b5-ecc01fa45a27", "value": "98304:6qXzC+uQB8Y1nn4zRBIYSLY+oaRcEihKPQnEH50x:6K4/IEqFLY+LRrihKPQEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701296935, "uuid": "79e378ae-5089-4714-8083-1acb28cb81d2", "value": 15872000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701296935, "uuid": "58e186b5-7ce0-4790-91f8-28e680aec8d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701296935, "uuid": "589e8b26-cea3-4557-8848-0bdcfc990907", "value": "SOFT_KNITTING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306eae7a-8e54-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701220273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220273, "uuid": "dc3e25dd-6dfd-4ed9-90bb-22df46e30ff2", "comment": "Malware payload (RiseProStealer)", "value": "541c9db2d6ce9444f8662855cf5ddef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220273, "uuid": "41d9c3a7-d51f-4ebc-98ca-169f0c28589d", "comment": "Malware payload (RiseProStealer)", "value": "308a68ed511f24c132a39ee7381c7ef2233764ccc9fd041786d830109cab261e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220273, "uuid": "199bc970-e492-44de-8a68-3e77b197de68", "comment": "Malware payload (RiseProStealer)", "value": "34198135f9c07a451ea8c316fd8af451f51ba96f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220273, "uuid": "15b0f4d0-bf4c-4aa2-851a-d6ae3b67be8c", "comment": "Malware payload (RiseProStealer)", "value": "9d2a38f514f15789ec44b1ef7d2a88fb563bceb88a2be10de3c15602d5d94498e8dac90d0898075de9192dcfd76c0748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220273, "uuid": "d684215b-2940-42d5-8295-9f4c43611887", "value": "T19A658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220273, "uuid": "a4fe862d-4493-49dd-a644-10865a5b96ac", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220273, "uuid": "94d780d0-487c-4067-a16c-99e565fed977", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WtI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701220273, "uuid": "a1ef9b50-7631-4a74-b185-7140b47ad7bf", "value": 1539891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701220273, "uuid": "580cb005-361b-4595-93ea-11aa517f08f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220273, "uuid": "cbeb3be0-072e-49e7-8c13-c37e5345a6c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d325c4a2-8e96-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701248893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248893, "uuid": "10ac29cb-3462-4f2d-9ec6-0e4fc48f22df", "comment": "Malware payload (Formbook)", "value": "ef210f0608870151e9fe20e57c1add25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248893, "uuid": "367a5116-a2d3-4199-9504-32464ea6c104", "comment": "Malware payload (Formbook)", "value": "30f3cd701c5fca6a931d7c59cd6a42b61cbce4d8f97c90f8b8b2fc87dc347638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248893, "uuid": "2bc142b9-eae9-4528-ad7c-672b7cb47585", "comment": "Malware payload (Formbook)", "value": "9e02f526d52367e637d9abc316b0f18c04f4367d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248893, "uuid": "c474cb57-9c4e-4f28-b439-6f97bc4fb3b6", "comment": "Malware payload (Formbook)", "value": "dbbc061cc4739c7c6cfd300dd031c039cafa22c97fa134fdbd909f1b1415642116b502055be2c3e95c3de99cfee117d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248893, "uuid": "22b7accd-8a0f-430c-aec6-5f6badf7bf3a", "value": "T103D41294B6DC872BDD3923F91821C8B14372BD1925B6C75E2ED57CEB3E637120A40A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248893, "uuid": "7ccc67ca-d3af-410b-93cb-d1b801d384e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248893, "uuid": "b14f2bb3-7c29-42ed-9990-a748ab3d562d", "value": "12288:oBfcopox4RZl4iIX+nBFeGDSfsJ3qYg2T+LjIKZstCUhQ:LetcXCFeGDmK3FgEsdOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701248893, "uuid": "835ab617-c59d-4f98-8fdc-fb81f721289e", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701248893, "uuid": "affacbfb-a49d-45a2-822f-e566c9971b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248893, "uuid": "4b916c4e-a7fe-4201-857d-d4014b89aef0", "value": "offer R 9513 REVISED5676565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5835f1d-8e9a-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1701250642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701250642, "uuid": "da8da3e1-7a3b-4385-8f80-d0d911258a7e", "comment": "Malware payload (CoinMiner)", "value": "b330b4e43499d7a11dfee2996f3601a7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701250642, "uuid": "5c42507c-cd9f-4778-aa9c-6496d5631474", "comment": "Malware payload (CoinMiner)", "value": "31048f16c5eb8e21419966964acc45a3f71d481f3b2486ff1af5f8c950accbe4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701250642, "uuid": "d5df7438-3c63-46e8-ab35-140d988fc7ba", "comment": "Malware payload (CoinMiner)", "value": "dc6ecdfef09c5b770ec9531592a043c731d099d5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701250642, "uuid": "240a73f8-3baf-4446-a0a8-64f9923b6d87", "comment": "Malware payload (CoinMiner)", "value": "f0fe56468df2bbe62450cf4d9b35c74d4f6cd8cfe97767ca29093ccafdddc6d7e94c17e2e60d368ddb0f527e819230f4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701250642, "uuid": "a5b9387c-7a92-4b8d-bb41-78967377d9f5", "value": "T1E2546D1266E56821E5274A33FE2AC6E4275EF9918F156BEB33146F2F49702E1C273307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701250642, "uuid": "4698becb-e382-4e10-847c-b740fce7596d", "value": "a5ba2e63e413ae40c0d8efc223d7976c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701250642, "uuid": "5a4c21da-dcf4-4c70-ac06-2edb365aca98", "value": "3072:yWcreQX0JTmRtRCS4cMS2hTnW0HN68Y3f09ce7NZaeuqoybzuQq4DJ0LD51CLsMV:Jcr0UbMS4c25WeN6WcK7kqRzznmh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701250642, "uuid": "7410e0bf-f6a6-4c41-99a8-0c38a4a45c8d", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701250642, "uuid": "7dc44c45-cd8c-40a8-ba15-77753827def7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701250642, "uuid": "20d5e6d5-dff4-4317-a3c6-05829d3261d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21a62f8-8ec2-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701267816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267816, "uuid": "5f6f6745-b35a-4bcc-9a75-a3e6b23b2d67", "comment": "Malware payload (GuLoader)", "value": "aaab29b9dbe7e78daa8c8e6e7321ea40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267816, "uuid": "1dbc0f50-93be-40e4-bcbf-8b605855711b", "comment": "Malware payload (GuLoader)", "value": "34502cba5d335023a6080887706a8564e92d9d85e5c0647475270270dffc7999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267816, "uuid": "3d3f4df0-c450-4f74-9ef4-3d11f64bd3d1", "comment": "Malware payload (GuLoader)", "value": "ade9955f29644a7609ac8df682dfbccecdab882f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267816, "uuid": "eb0f946f-a1cc-45fa-b76b-0b3e9b12713b", "comment": "Malware payload (GuLoader)", "value": "c008483370f36ceb5897b8ccc83679f86d12841d55aad1f56de53e07b785dfed495b51ae4a923a56bb402d63ce05e399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267816, "uuid": "e756b055-b5c6-4cfb-a202-5ac5e67c957b", "value": "T1B0B4225233909547C6E09E72687A52BAEF778E16D81147062F407C673DF73F2A42B22B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267816, "uuid": "aca18238-c738-45dc-a284-5da74af4e22c", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267816, "uuid": "6bc5ea42-a30a-4531-9de9-9b6bff188e73", "value": "12288:/cSFHADn7YLh27NCJFb4FVdm17zOckylak7iI/dKX0HOE9:/XFHaqcN8FbCCKdOT73dy0HO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267816, "uuid": "ede2ab3a-a9c6-4659-908f-b5ebe6169bba", "value": 511064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267816, "uuid": "8c64539a-77ff-4682-925b-255e080ed502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267816, "uuid": "1c9a8476-4b9b-4e4f-9dc3-f492a7ee7aef", "value": "rLiquidacionporFactorizaciondeCreditos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f5830b-8eb2-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701260702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260702, "uuid": "d08ad583-e316-4bab-9b96-5b6ab06da06e", "comment": "Malware payload (Formbook)", "value": "d0f1dae05882b226cf1051262efcb5ad", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260702, "uuid": "dab136d2-c12e-481d-a96a-cf62e38c97b4", "comment": "Malware payload (Formbook)", "value": "3773eeda4725ca7f619e2137deb496ce006f7702495e6c448e874bdf6afea37f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260702, "uuid": "b364df6a-e447-44e7-bf13-23f33b7ceb87", "comment": "Malware payload (Formbook)", "value": "b66faddeb2f7464fa95e18cd6cdc64c7154a2050", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260702, "uuid": "d754e111-1c9c-4dce-9e2f-342cfd7162df", "comment": "Malware payload (Formbook)", "value": "fbbc4b27aed2f076b04404e316ef727479c7d27623d725546ea5d98cee3038aaa5ddce90ec209d2b397f4de5369fad7f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701260702, "uuid": "eeabeb70-bb30-489a-82d2-aad1400aba25", "value": "T10F742399474AB1783ACC608516A7782B7BAB150EB86B735871EECD1FC3270A6330E157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701260702, "uuid": "0ec1409f-24a7-4982-bf2b-8c92b7e2c6c4", "value": "6144:brPRc6Ete9xH6XLZpUsnnDt6goOz43aY0UTO8IYq0w7dZWD:/PC6EtXvrZnoOsqfYO8IYDwx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701260702, "uuid": "2e3fc23f-b3bc-4b07-bea8-30d66c18d325", "value": 364355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701260702, "uuid": "6d84e610-7bce-4b29-b7dd-a9d95028248f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701260702, "uuid": "56175a96-91bd-4921-b8ee-ae513eef06fa", "value": "Statement Of Account 2023 PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b0f159-8eb9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701263638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263638, "uuid": "14936665-f2cd-4df7-bde3-40744b26609e", "comment": "Malware payload (Formbook)", "value": "3e7f2a560c5888e30f136a7d9ce8d4dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263638, "uuid": "60715afc-c09b-4634-8d99-33f4738bf414", "comment": "Malware payload (Formbook)", "value": "398d657a86bb82638352ce58d7f71da551cc07c7a0831f83a588dff8bca0ca3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263638, "uuid": "159d1c03-6033-4f6b-aeea-7f95f4a580a0", "comment": "Malware payload (Formbook)", "value": "bccbe3b156582fec726ef7878e736079f957a508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263638, "uuid": "cf4be713-7d03-49bb-92fd-26c8df2050fc", "comment": "Malware payload (Formbook)", "value": "c27acaad3c3c68c6745bbe7451e872e2ae8cd976d2a0a25faa6431e00fcd322275ee0f17abba7dbe1317afd8b27790d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263638, "uuid": "d09df447-e50b-4e48-aee1-465b51ae9ae5", "value": "T1AFE412A472089137CD1D0BF910A3C8F04772BE222577D2CEADCE6DB77A877894A85563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263638, "uuid": "a513d59e-e305-4ec7-a144-e8e9767e49e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263638, "uuid": "de2845d2-c1bb-4c5a-b6b2-8b7d0eba51ef", "value": "12288:EHcopox4Ff+CmA4xiS/vAOG1SvRHtAbgXjtYUUnN8E0WDi+t8yzD/n/fWUPm:ve5GCWiSR7+bctYPnZvLP/JP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701263638, "uuid": "38582959-6e08-4e63-92ee-f65c799669d3", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701263638, "uuid": "14c3b53f-088b-48d4-90db-58cad7640634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263638, "uuid": "a05be82f-afcd-469d-b815-da7375440d7a", "value": "Revised invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746267c9-8ea1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701253458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253458, "uuid": "dc824934-02df-428b-9156-b8da066c27c7", "comment": "Malware payload (AgentTesla)", "value": "74c27a46a863e7e47162ed2dbd0ee752", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253458, "uuid": "ab64e54f-9616-4f8c-af17-34de0b65754d", "comment": "Malware payload (AgentTesla)", "value": "39c43eb3ddd3a51f8e8af5ef5563ac69850ef82850cfbaa7096d9b8167592f65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253458, "uuid": "5d31381c-da16-4054-911d-b7039f10e713", "comment": "Malware payload (AgentTesla)", "value": "7a88529b6abff0503155a9904a7e85c5fdbfd20a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253458, "uuid": "f1e79142-9a12-43e1-b105-061a01757406", "comment": "Malware payload (AgentTesla)", "value": "719bc2f067c7f453a623cdadae52dbfded7db1cee944f017b774bf16d8c4a6fde641cbd49fd33dc45c8192f260f8c0d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253458, "uuid": "a54a0984-95b4-4d78-8e2b-8b45ebc519b7", "value": "T18AF41259A7FE2BABD97EA3F05621C0015BF6FC3A2576D3090DC172D606A1B115BA0F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253458, "uuid": "eb586ee4-dc49-4cbb-8a5a-e0009ad5cbfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253458, "uuid": "e1f7aec5-c9e8-4ecd-a0cd-198bac862cf5", "value": "12288:5ae1E6jD/3CqszNVdQen9xZ7CeDs5KuQMqRi55MTGfopoxt7:ce1tD/3CqsZVnzhCeIxQbRi5+yfes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701253458, "uuid": "e653a290-c5e8-4ab3-a3c1-ec69fa60c197", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701253458, "uuid": "d471f919-5010-4251-924d-429a39c4517f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253458, "uuid": "5969ffa7-2a00-4df9-bce9-533b47943c3e", "value": "SecuriteInfo.com.Trojan.PackedNET.2548.4870.3965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bae479-8e98-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701249459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249459, "uuid": "e777f86a-0248-4b5c-a985-7800f24fc363", "comment": "Malware payload (AgentTesla)", "value": "af5c90185525f9642892cf84660f67c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249459, "uuid": "f3ed1e63-4f04-4e91-b94f-6f6833d8166b", "comment": "Malware payload (AgentTesla)", "value": "3c4c069b208bd00f2526297e14f831b5f585ae06f0e4ad48292244027c21f089", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249459, "uuid": "e984215e-de65-41cb-b835-74c545ed39d1", "comment": "Malware payload (AgentTesla)", "value": "38cb5b82dd4cce9a0f54027379c9cc9bc6595876", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249459, "uuid": "d5efd4c7-5225-4000-951b-5623b7d66eff", "comment": "Malware payload (AgentTesla)", "value": "8d4fd97e9f278b322152606853fa7f4d2da01a887210b76d57a300938862107fc50854ba944cf8a5170086c732b07963", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249459, "uuid": "8e84dca6-260a-4da5-ba46-a88f5d780f0c", "value": "T12CE423183254B933C8FD0AFA82506C9D43B6795A14E0F3E96D64F0DDA9CABE14744BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249459, "uuid": "44bcda66-5e8a-4e41-ae13-9bf5ae7ce32b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249459, "uuid": "18d7af6d-ef2d-4b7f-abea-3ec9ae15f062", "value": "12288:U4aQmbCpr/oROemhC2xEvrPU3N0TZjIRJy55Xj0gsHbos4qS:UI/oz1M3SNfwbHtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249459, "uuid": "8a90f452-b7c8-45e6-8782-dc6dbbf4c747", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249459, "uuid": "f2c3a70d-0ca7-4bbf-bb4d-93c546510969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249459, "uuid": "d9dced02-9709-449e-8a6b-c6fbdcf6ec37", "value": "PO#F211213-016.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d8d9ca-8ea6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701255768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255768, "uuid": "bde62241-6196-436c-8a24-3c83cd4745c0", "comment": "Malware payload (AgentTesla)", "value": "eaff099bfe4f18d5bde6ea38e10a4e55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255768, "uuid": "6a4528a7-f706-4f04-9334-b769649f2734", "comment": "Malware payload (AgentTesla)", "value": "3e2ffdde531a3962ac75e2b9fac81afd2d6caae7970ef1eadf93be014d6c8116", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255768, "uuid": "d8bd4232-f5b5-48d6-8cf4-4e4fc68db993", "comment": "Malware payload (AgentTesla)", "value": "8bed8c1cd563e9c5d95af3dc482e3870df51a20a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255768, "uuid": "a1976a9b-500c-4a3f-9219-b1486866ee18", "comment": "Malware payload (AgentTesla)", "value": "4b7f620ccd474a23cd83e91cb82e745ac3136a4e25d9f465fbee627ecb71d3e1ef847687eeaeb5727533a22e0691cc87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255768, "uuid": "b7b7037c-cca6-44fd-ad19-c66f6fcec972", "value": "T16CE423C1875601472CB94A42CADFC332FC551A0866FD6FF68617D2D403EA9ABE3605BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255768, "uuid": "9f7d07c8-728b-4c9b-9fe9-712362547b65", "value": "12288:lmZqCvXVOmyxuYazS1oqhwfs9Iy28XvqkGJjD8Y50+Yk/c+EeE672XHGO5Si+eb6:0ZvHeuY71Bh+85Xv4JhuLmcvq7tGjbc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701255768, "uuid": "85c3ac4c-6e39-4d86-8514-ea272b80cd71", "value": 659439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701255768, "uuid": "e9a26700-2e13-4dbf-b761-a0d1e531d57f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255768, "uuid": "2eb36193-b11c-42de-b4d1-24ab60ec78b4", "value": "PRE ALERT NOTICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ffca52-8e87-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701242167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242167, "uuid": "e97d1d65-42d2-497e-b9c3-97dfe99799a4", "comment": "Malware payload (RedLineStealer)", "value": "cc6cab738f4cca4e3131c665bd51ec0f", "object_relation": "md5", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242167, "uuid": "5cbf1484-9c3c-458a-b84b-61aa503093a7", "comment": "Malware payload (RedLineStealer)", "value": "3e7f6d5d557801bf97b2144ba8aa9cd00a476e4389731d44ae41a08acec7c0b7", "object_relation": "sha256", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242167, "uuid": "920cfd5a-d4fb-42ad-a864-7a41b712d234", "comment": "Malware payload (RedLineStealer)", "value": "eb76f0888782aeac94d69354576d2990565688b1", "object_relation": "sha1", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242167, "uuid": "0f77ea71-175c-4fd5-af7d-2f5d6ee55607", "comment": "Malware payload (RedLineStealer)", "value": "027dc2deb56977639e2540a2aa8445fcdba23bb262ddf5322bfa7140629174f55fc35deba776a75d210c3b95235f3d6d", "object_relation": "sha3-384", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242167, "uuid": "484b4db7-12f2-4044-b2ab-8c4e7ce58829", "value": "T141B5339FFE3D6409466DB32C024B14D9BC43F46067FC170FCE9F82A69A636E2A501998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242167, "uuid": "a0997d2b-de38-45de-88ec-8058ac3bcce3", "value": "49152:e7Pqy7LR2askvU8AivVlzE0+tac6rJLnOAZumLxixZ/uHOe:eB9i4U8TVQvqEmN7ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701242167, "uuid": "e3ffe326-6afc-4b2d-8e5c-6b840cbd3275", "value": 2288798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701242167, "uuid": "e196b0e8-06a0-41a0-b041-3454ee935aa9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242167, "uuid": "6ae0d5fc-86a6-45c4-9c7e-e8843dbac434", "value": "CheatLab.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f9adb0-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701282937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701282937, "uuid": "06090968-320f-4a2f-b729-91a54637ffdb", "comment": "Malware payload", "value": "45ae0455fdcb1ceb6e1d3eed8ba7ffaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701282937, "uuid": "709b946b-aa78-4b39-ab8a-3e806d04597d", "comment": "Malware payload", "value": "40443a173109769738ac141017ad4e51dee33603d7f22f4f2dd8863b892d9ad4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701282937, "uuid": "13fa5d39-2d5d-469a-b688-76546b3a2cbb", "comment": "Malware payload", "value": "e37f49a44bce6c23e48bde2ede905f42fe570ebb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701282937, "uuid": "de7e3c6a-dc88-41a9-87b3-34856683da8b", "comment": "Malware payload", "value": "897f162d115a465ca732a8c2ca46fbacd6517946659af9316272811227e68a06201f29cfe1c441701171d6eae1965dac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701282937, "uuid": "30d93480-e2c2-4060-a1b3-bd4944bf9811", "value": "T1ABB41262B395B1ABE96F103606949C6C4BFB7E00B074434B3C54FD797EF32916E2A948", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701282937, "uuid": "c7c653a4-8fdd-48e4-ba4d-c8a7ab60186c", "value": "91c9c82d5da6c673b4454be0c166d822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701282937, "uuid": "6b29ad14-edb0-4e5b-8b3d-2253e21facc8", "value": "12288:4NrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVj7jo:4thTiP+ffCfB5Lf0F7Z1E7jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701282937, "uuid": "0412edb3-91e4-4ee8-a907-2f58fa9fb0d9", "value": 538224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701282937, "uuid": "ff81e9b7-d7be-48a9-83db-8835e648e5b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701282937, "uuid": "923e5c53-8194-4576-bb1b-9e8f77969dfe", "value": "45ae0455fdcb1ceb6e1d3eed8ba7ffaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a240c65d-8ed4-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701275440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275440, "uuid": "91eb150b-da4b-457d-b0b2-49227b780359", "comment": "Malware payload (RiseProStealer)", "value": "ec2cdb03142e05907df86fd4aa638b33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275440, "uuid": "4b84ef5c-70b2-4453-907f-34cd9d976eac", "comment": "Malware payload (RiseProStealer)", "value": "428d3eac1d6720cca1a2461153b8e39b5ac10340f458c1c5ae93d2c85cebc054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275440, "uuid": "a091a53a-de42-4d8b-a2aa-31f58222d642", "comment": "Malware payload (RiseProStealer)", "value": "a2b1fdc24ef9f8da7c95323a59d510162ea2faef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275440, "uuid": "f919955f-6f89-419f-93b2-e0e3565479ff", "comment": "Malware payload (RiseProStealer)", "value": "ad7d703b8eb5da8d6a620cfd35002242d48630c4cddefeb9069a21c1447441c6365e9583c3e4a6a504aa9f3c5d75d94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275440, "uuid": "ee980328-72b8-4c98-84f3-0313adc86aaa", "value": "T1DC95335395EDD027C6B40F70D8FA5B970E327D81BD38A35A3349B8687E220D49672B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275440, "uuid": "95564945-26be-4f97-a2c4-23b923a94ef7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275440, "uuid": "b771dec0-02eb-4941-9cc5-822c83cb09d8", "value": "49152:cTTOJywr57GnOV+PEYDuhnmv0lZJsQc71Y0z/XV7uvc:aqGnKKMlZjcTXV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701275440, "uuid": "ef8c1e35-19e0-40e8-825f-538fb14db1bd", "value": 2022912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701275440, "uuid": "59f3594d-cdfd-4f0f-999d-675a196256f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275440, "uuid": "48ab3f4b-9a47-4c21-aced-da956fda96fc", "value": "ec2cdb03142e05907df86fd4aa638b33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c099729f-8e8e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701245426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245426, "uuid": "f3694e54-2dc6-4158-83d9-2bbf43f192ea", "comment": "Malware payload", "value": "8e264484016325647d9c346448dbae01", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245426, "uuid": "7bcc9277-f019-48f2-8f59-0e1f87f90d18", "comment": "Malware payload", "value": "42bfca470daeb0d4058675a0ec6ad836742648eb4cdb982739d81eb83466ad35", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245426, "uuid": "64f4ed34-031f-434c-adf5-7ff0eea7c21f", "comment": "Malware payload", "value": "692155902fa20bfe123fead7f8eca35ec12efb53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245426, "uuid": "b8f14a5f-0fc6-485c-9812-26e00ba07e79", "comment": "Malware payload", "value": "e6cb3b038dbd30fc61b4a38637ebe94bbbc0f2ea23757174f37bcbd9cf0f96bca82343099b4e0fc17f26b4dd9e00e0ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245426, "uuid": "d1fde670-f198-482d-8ac7-bd5e0c737977", "value": "T14FA130432FA0648507AB4FF6792760C1F8FD5C5A6874A857EA4094B0FC94376CB89B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245426, "uuid": "a7522c73-7276-4c7f-aef6-96ac8195c4b7", "value": "96:P8OR7ykyxEdyvEzr1tCBqB1gmAT5dZEfyrBdu+8gHXTRdjj:ko3yvEz/C01iT5dZEfB+8qTRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245426, "uuid": "ed49c766-549f-4c07-9dd1-71da254f4bb0", "value": 4847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245426, "uuid": "6e586378-7a26-4684-b515-3707bd1b51a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245426, "uuid": "8dc3eac1-09d5-40f4-9090-3ce4c9c9dc16", "value": "pagamento_12.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b54e3c5-8eba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701264073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264073, "uuid": "daae6320-72df-45ea-ae84-8a98deacad3c", "comment": "Malware payload (AgentTesla)", "value": "727c58ccb4c2f587307f0757459728ca", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264073, "uuid": "53d3d04c-9cd1-48f1-ab30-5092515e226c", "comment": "Malware payload (AgentTesla)", "value": "448de9e091aaf9286c4e6072c4c1cec1571bdfd87e39a81c7a9f0899c59dd357", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264073, "uuid": "e9bf7674-7c83-4d52-a095-bd0ad795fa03", "comment": "Malware payload (AgentTesla)", "value": "a6bc4d5876e3697b561a4e79fe6b1a6d296e0a2b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264073, "uuid": "44910c72-1746-4e71-894b-f3b31f79b585", "comment": "Malware payload (AgentTesla)", "value": "0f5c90d4cf9c639f087e80cd1d0ddd74206216d49072cd6fd344af57059ec6afd2ca9e488f129d503114a2d1d4c6a1ed", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264073, "uuid": "7491ded1-d207-4867-a257-d7d774fa40f8", "value": "T121D4236E67D4980B6E0ADFC2CF00E56C22F8975F968DB5DA50E08E785F1A484D0CE85F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264073, "uuid": "ca74422d-c83e-4db3-a58f-d38e253e6c44", "value": "12288:srboolW5RGtFwZxOsPBf/AbwyY9JyrHKv2TAIFOmK44Z:UiGtFwZx1PBfYwyecrHKv21OJ44Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701264073, "uuid": "2f3e7cd1-3d45-444c-a95f-7f4735d86221", "value": 645594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701264073, "uuid": "b3b4ac92-5f0d-45a2-9a52-9c15779d70b7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264073, "uuid": "bd664c3e-b767-4abb-a982-c8c2ab221ac9", "value": "purchase_order T&B.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5146743-8ec1-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701267338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267338, "uuid": "c9851d22-5f19-4052-b285-7c40c756ac1b", "comment": "Malware payload (RedLineStealer)", "value": "74529863f065d162236a886a39812f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267338, "uuid": "8dc69826-77b5-43e4-894a-9a4cdd1fb2b9", "comment": "Malware payload (RedLineStealer)", "value": "4494260e0d16004295e37f60f1e68a2ce88268ae3fb4028464dafe57eb2382a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267338, "uuid": "ae07ec4f-fb6e-43ef-bba3-c2f17b751edd", "comment": "Malware payload (RedLineStealer)", "value": "d7d2e45438eb568a97947cff576b14a47a2945eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267338, "uuid": "b15e7a8e-c4ed-43f0-bfbe-30e045d5bf1c", "comment": "Malware payload (RedLineStealer)", "value": "255144f0d087080287fe532df3c467bb8c3ef5971c6553b08e98bc4e014b9221c73929fa167448d294e40e79cea7245c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267338, "uuid": "951fbce4-81dd-466a-9be9-26ec08c53bca", "value": "T193B623B7BB406257D14598777712BAA46293FDFD8AF95301E7AE32A8FC7C3858020847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267338, "uuid": "14c02215-afc5-45e3-bfcc-38335e068f95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267338, "uuid": "e758119b-80fb-4659-bcb5-4f0ca4b5ca88", "value": "196608:yp0ZpANcdmzzzq5vPJ/P1n9L48WK5xpc/5BFZOgrERo/6DpUxMb+rzFL:y1cdmzXq5vPJ/7P5UTFZJr5OU+aF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267338, "uuid": "304a06e5-eee5-457d-9eea-2f951cded54b", "value": 10906624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267338, "uuid": "41c30170-8a36-4a02-8e3c-4836e5d8f424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267338, "uuid": "07ae7c39-5b4d-468a-844b-1557990ae7e9", "value": "74529863F065D162236A886A39812F1F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8fcd27-8e7e-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701238545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701238545, "uuid": "fcd6a931-d296-47fc-bb3c-c40d1c06bcd1", "comment": "Malware payload (Stealc)", "value": "3a4bd9f63354d5c840069528f2245b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701238545, "uuid": "8493d035-7b13-40e3-bf74-ee025ccbabde", "comment": "Malware payload (Stealc)", "value": "4495aea2bdca5be58cc0530892de3d3a983dbf47e73980c463b0048968c13074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701238545, "uuid": "de07710b-3bba-439a-b980-c15e9b061ef0", "comment": "Malware payload (Stealc)", "value": "34463fc105fa2483254ff1aa627de59665f03c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701238545, "uuid": "740baec3-41f1-4440-bf5c-69a0cb5fea86", "comment": "Malware payload (Stealc)", "value": "9ef90cbfa6ae3ca71b8f7ab264630226f05cd63308ece8d1d9e7c821a65cf688b09c8f5666972526cee55d0599af5a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701238545, "uuid": "f20a2d77-7403-462c-a1fb-5445c5cb539d", "value": "T14D545C13A6E46861E5174A33FE2AC6E8275EF9908F156BDB33186F2F49711E1C272313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701238545, "uuid": "67f7cf6a-5d0a-4a3c-8f75-5981913819b1", "value": "99e733edb40d39f08a07658473c3f554", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701238545, "uuid": "3bdfc7b9-4ead-4368-a1be-ce91d9ebd50d", "value": "3072:4J+F/wMPsQ+1XiLsm4JsicWgi/bWMa8/viej/I1Agp12PQQizd5C23fkpsMV:M+DPIxksm4J106vaY6GIh1klkd3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701238545, "uuid": "9d561c66-963b-498c-a397-7fcff0e77d40", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701238545, "uuid": "c1f7651f-8c89-438c-abe3-804b7e974ab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701238545, "uuid": "282fc8a9-dc81-4158-9e16-c083f22010ed", "value": "3a4bd9f63354d5c840069528f2245b8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0074b9c9-8ebb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701264431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264431, "uuid": "18b296d3-c656-44d4-bcae-c240cc183e45", "comment": "Malware payload (AgentTesla)", "value": "aface11585c6bc9d6a5fa83caddebfb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264431, "uuid": "cec9ab25-6e57-450a-a6bd-b4d1dc05efa0", "comment": "Malware payload (AgentTesla)", "value": "457bd98aae7e7103720ef403309b9862ca33f4295b788e1c8ce374d4921cf057", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264431, "uuid": "ed065893-b3bf-4d4d-a818-8a039418fe68", "comment": "Malware payload (AgentTesla)", "value": "f4c60f43b7ad54be28e06699a2ecdd6dfe6232d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264431, "uuid": "0ac1c780-5a8f-46bd-8b8e-04a1784fe7fc", "comment": "Malware payload (AgentTesla)", "value": "98643b2e04d06d6f7fc265d156890b1acb41b0ec7c77b7572f276a529787a7ccb4340fe75a45cd042cb012db56f25dac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264431, "uuid": "5360f7a7-1be0-4b39-80ee-16dfd51d0b56", "value": "T1CC65F147ADAABB25E93443F325546A1C0BB66C6E7CE5E3074C8DB1C6D7B6B400A11F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264431, "uuid": "31d60e65-b55a-4868-8265-e2f0a56401c0", "value": "12288:s9l78EN4iZwP2XNFzW5b7gTyhRBSe7Y003MiNOx+0t+8U+n911oap:s9t8EN4EbXDzWtNnBLvONOk2391d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701264431, "uuid": "431f9267-b8cb-4923-81fa-a17681ae7af1", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701264431, "uuid": "30b353c8-1d42-4c95-835c-25943771d86f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264431, "uuid": "611fd2da-c34f-47da-b89c-5800742433e7", "value": "Promac S.A.220172615415415.DOC.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3557509-8ec2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701267845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267845, "uuid": "7a31af99-eee0-4e3f-90ad-64783c2217ef", "comment": "Malware payload (AgentTesla)", "value": "4a87b16f06380501f46e97b6865e9580", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267845, "uuid": "97b9ec91-f58d-4447-a1a4-852bf1464003", "comment": "Malware payload (AgentTesla)", "value": "46fc7d09450dddfd2a6c3aa223c239935863b80cec219c6495dc2725390d60d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267845, "uuid": "6d9b1933-5d9b-4fe7-ab38-bc647e6f22f3", "comment": "Malware payload (AgentTesla)", "value": "9f874b792cdc59ece80892b053a026ee6119d0e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267845, "uuid": "31b11f54-423a-48fb-8e15-d48b3a274fbc", "comment": "Malware payload (AgentTesla)", "value": "49d8b3c97bc4f70aab49419f5b06895595b343e2cfdf2d4724a196c6aba46642064a7a2eaaecd7ca20ade56ba7b68f02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267845, "uuid": "1273b054-e4a4-4a84-a8b4-1dcece04addf", "value": "T18D152C09A7DBD6F6E24C27B29821187527B4CDC69182E39F584D73A49DB332426063FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267845, "uuid": "a0aabb94-db61-49d8-b4c8-a570406ea296", "value": "12288:k87AtIRMdsHo6Ll673ZChP8396YAQE4XJBp2qqIpyu3:k87AtIRMdsHo6LlLhP8t6YXEk3xpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267845, "uuid": "1df4d7fa-8074-479b-95e0-748b5573c0ed", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267845, "uuid": "505ee982-538c-4d2b-ae3e-07889b78f915", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267845, "uuid": "c2a59441-94bc-4163-bd5e-10e8558a5d42", "value": "nCota%E7%E3o CBL AR.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce33fd0-8e8e-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701245446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245446, "uuid": "971b4a5b-eb8e-4d4d-9038-900a75ec2926", "comment": "Malware payload (Stealc)", "value": "088151f6906a953da382a3d008837cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245446, "uuid": "013a080f-2d70-49ba-983c-31ac73557d58", "comment": "Malware payload (Stealc)", "value": "47281571c8ba7092f5e7864377be0dc4c8d170f501203a6dc104a401ddc62eac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245446, "uuid": "08b2ce1f-c026-49e2-a716-83cae4ddb869", "comment": "Malware payload (Stealc)", "value": "6a232234505929132a6accd629481b9a9ee2f3ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245446, "uuid": "4506aa19-876b-41ec-8b33-1d1d5e4c304b", "comment": "Malware payload (Stealc)", "value": "1b16aac2a236619469bb0228dc4d1737e1036de992723effd1fe273837d235ef88fcb89732d0b8fad8ac951a8b18bc32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245446, "uuid": "bbf8cb87-73f4-4989-aeaa-bcc6b1bc12ed", "value": "T15E546D12A6E56821E5174A33FE2AC7E86B5EF9905F156BDB33186F2F49701E1C272303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245446, "uuid": "4255f798-22ef-4fd9-a4f6-cdb64d25727b", "value": "a5ba2e63e413ae40c0d8efc223d7976c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245446, "uuid": "003d7875-3810-44ee-bacc-af705a67cf7a", "value": "3072:34zkeQXipEm6TxCS4JqlfYerU4Ej3sfvvNSHCW7v0CyjK6Yqn8QqUjvD5LsMV:IzMitAsS4JqlAB3CVSHZ7v7h6RR/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245446, "uuid": "cdc7276f-2743-461e-a4f7-a443fdacd39c", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245446, "uuid": "545281b4-7dec-4f0b-b9b9-227b1d82414e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245446, "uuid": "228b96b4-4caa-4bba-9cca-65d2271c764b", "value": "088151f6906a953da382a3d008837cff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b8fa39-8f00-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701294228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294228, "uuid": "b33660c9-1b98-410f-a011-e66c4b9ba3c1", "comment": "Malware payload (AgentTesla)", "value": "a72ec96c36c6b5575b4bc0bb74d90fe5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294228, "uuid": "cc8a749d-9cb8-4b0e-af5b-60e676a79b12", "comment": "Malware payload (AgentTesla)", "value": "48445024105791ab8b37eb5292e8fbccd1c32896a0f91185d9981f3c8e636e39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294228, "uuid": "7183c319-387d-4f5b-9c98-c8b277b69b5e", "comment": "Malware payload (AgentTesla)", "value": "f557e053a83ea092dbe2eec1ed2473685ce59c52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294228, "uuid": "fc99a2a1-29a2-45fd-ab45-c41049fc484f", "comment": "Malware payload (AgentTesla)", "value": "b6691e1dc322a755ef0be1b606b5927c6b7b539e6a2bbbfe6cafc2107d0c38ce8b5cb8f35d28adbadb24281ef8dfd20d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294228, "uuid": "50098ae6-f5d3-40a4-886f-f2efa3ec1a8a", "value": "T1A6F5495BBA401CF3DECD01F3E0E907488A83C86E2709D7B63AD7D1E9B64D2DA5539186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294228, "uuid": "4c2528aa-9252-4903-a659-416edcd015ab", "value": "49152:9GbYYwBvf9LG8vf0aGWSCEtcTRP75LqsnROa:SYbB90CEtcTRP75L9RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701294228, "uuid": "8a0b050a-abb8-4b0b-a94a-3287ee6bd49d", "value": 3622912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701294228, "uuid": "7f7e2eb4-8a1b-41f7-ada8-ade42d6d6f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294228, "uuid": "7a1937cd-e5ca-4f6b-b42a-504df43bc2ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0358f5-8efa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701291836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291836, "uuid": "7da72e8e-7646-422b-bc47-4cacf545cc4a", "comment": "Malware payload", "value": "cb00c0664a222daf1fb7ffe9bc3a4cc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291836, "uuid": "0c3a9473-3414-473f-a867-d780add0313d", "comment": "Malware payload", "value": "492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291836, "uuid": "62b6446c-cd13-497b-ad11-2e1c251be05f", "comment": "Malware payload", "value": "aa21464853ce5790c81a52044a2b188d1f844047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291836, "uuid": "48abdb15-c792-484f-b3ec-2d31e23f0dfb", "comment": "Malware payload", "value": "ad18bac4b40077c628424af7b2ab9d8774ee7543ec2182425592d0abb6ddeedbed5878955ec73e6b5ccfad895a605cc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291836, "uuid": "70b0a16b-8c3b-4138-8076-32140ac85b96", "value": "T13B22D56B7861C0A2C353C5BF7B5F1721D27FE6B79270901ADFE00C607B35AA68B4610A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291836, "uuid": "a102d0e8-ab6d-4cd8-95f8-9479d3b8473a", "value": "d66000edfed0a9938162b2b453ffa516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291836, "uuid": "a936ebd5-2eeb-4bc5-9aaa-2cf38a535d68", "value": "192:F8fzqMmTL+f6eeAY82mNZRZ1eLP/x1fkNvFCDko:F8GMmv+f6eX22RZ0LXTsN0ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701291836, "uuid": "4820d84d-8922-4da5-8cf5-36f61c9b7e9d", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701291836, "uuid": "80f74bab-24f6-49e5-89a7-96279f8c5308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291836, "uuid": "b92b9477-8263-4154-a3a9-b161e2690fb8", "value": "socks32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0daa6205-8ec3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701267889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267889, "uuid": "8eec0000-589f-424f-a612-aaccce21157e", "comment": "Malware payload (AgentTesla)", "value": "5f8f3330ac4e19f6cab6134a5f78f83f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267889, "uuid": "82c8b85a-3a0a-4a0e-9fa3-cb8bc19a164f", "comment": "Malware payload (AgentTesla)", "value": "495a50620b8b64d002c8335a590a57e78c7eeaaf9a69fb5103f06f4605e2d8a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267889, "uuid": "e033381d-50a7-4af4-80bd-bd85f38326d2", "comment": "Malware payload (AgentTesla)", "value": "f5dcd5a3db21baf057bb13fd916a7d87714af982", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267889, "uuid": "57460692-dd8e-44ec-a849-bae96214cf14", "comment": "Malware payload (AgentTesla)", "value": "bc3d608544b385be9bd6f716c60154b2659f710dd866a8a2fddb711d84147f1e08442b27ec568fc0734facef42cab72e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267889, "uuid": "3e53337a-5608-48e5-b090-90964af86d6b", "value": "T1A6E4121AB6F81BAFD97A53F81824901007B6BC3B1976D35C5DC4B2CA42B6F805A62F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267889, "uuid": "af36bf9c-5a29-441c-87ed-b2fef5ae3dde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267889, "uuid": "d37f3d18-9a7f-4fa4-b9eb-9d8c70b49d7a", "value": "12288:+SR1E6jD/I+uw/iEMcZoHyKT8ycEZwlaKkEo+yOPT2Ai/oYuKopox:bR1tD/sYPi3nc2GDkE1T/JYHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267889, "uuid": "60da9d54-9179-42a0-9aef-89cbe5877d31", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267889, "uuid": "a3ca9a44-496f-4ff6-9687-d39fdca3cec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267889, "uuid": "95d37f28-375a-4754-82c5-df895dc0e6d6", "value": "rSWIFT0044FIDB230077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf180ea-8ec0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701266678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266678, "uuid": "0621ef8f-5978-4fff-b6ea-94afe96446fd", "comment": "Malware payload (AgentTesla)", "value": "eb4e972ff1d0fc39b4af48d166227dc8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266678, "uuid": "292f809f-5e86-47d9-be8c-dcc154f78d6b", "comment": "Malware payload (AgentTesla)", "value": "4a1453f288a7f4349876171c3f24db14acab1d8cee8534314e65c940c10a052e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266678, "uuid": "e11b6fe2-facb-4fe5-b4f9-ab862c997418", "comment": "Malware payload (AgentTesla)", "value": "dd6db21f26eccecd60ef0db6df2fe599e06ad1d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266678, "uuid": "2b7e2339-63a6-4ccd-9690-758fbfd54cf7", "comment": "Malware payload (AgentTesla)", "value": "1f7412ebd61067b89844abb9fe106e1c489108fdeca546890023b0329bd9380b408418ff31e257f2a2813cbb33014ee4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266678, "uuid": "82582564-e769-4fa6-9736-b49246b020ef", "value": "T10EE4129135AC4622CDA95BF66162C0B24376BD266A33D71E2CE43CDB7F537528B02B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266678, "uuid": "e3c65816-7acc-43c3-a096-9d7eb40960f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266678, "uuid": "ffcacfb6-ce1d-4586-a107-61dba3ff02e5", "value": "12288:ducopox4UGrpzyrezOCU91OVSrT+b7Ds0rEYfsc3wROWHFy5O6n:zeYGYyz3VSH67Ds0gYfsc3wROEFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701266678, "uuid": "fabf68e7-67b9-40f6-8931-7cf60e6d425e", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701266678, "uuid": "904316e6-b8fa-4e84-bbb7-7a6cfc70fc10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266678, "uuid": "c6b0c57d-7529-41ff-9faf-60510b813f0d", "value": "New Order #1437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c7a5bb-8f01-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701294553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294553, "uuid": "563f599a-bee2-4804-8ac0-8f48b7beda06", "comment": "Malware payload (Smoke Loader)", "value": "2c188e4f188a0327103ee5fa7eda58ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294553, "uuid": "d94b6ac6-7c94-44e3-a4f7-fa16fbd2373a", "comment": "Malware payload (Smoke Loader)", "value": "4acef4a7f5645fa4af6e49a5f873942470945d9ff02668be8040808dd346719c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294553, "uuid": "cb8b1663-9408-4921-b00b-7791547a8730", "comment": "Malware payload (Smoke Loader)", "value": "ec64b75b8b81a99aad2e6b4d8ea1acdacc9b4aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294553, "uuid": "daf66623-51de-4a18-8b54-4ce7980b79b1", "comment": "Malware payload (Smoke Loader)", "value": "75a3c13324237eb8054bce9296c8fdd4c2a4d1dd29bf54e957ef2a7cfba1a6ad59ffeca6a18cbc0cd88c11e76990f07d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294553, "uuid": "94998b41-348a-4e79-9eac-7a1c637c0a86", "value": "T17234C01276F1C032E6275A3409A1C6654F37FCA29B6146CF27A42EBE4F326D28F75316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294553, "uuid": "9a3a940d-2ef9-4c5e-bcd2-54c3d1347bbf", "value": "10d5222eea59eee664433b569e6134b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294553, "uuid": "fa1318b5-3802-41e5-afb4-d95d0fe49f48", "value": "3072:odaBYGrUOUVKpgyjt4VxxVUXXPnrqe5s5yYv1TRnz3HsQCHzMe+NS:o0BeON6gt4VxxVKPh5+yYNTRzxmAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701294553, "uuid": "599526b4-b5e2-4034-b94c-212e5d01bba1", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701294553, "uuid": "03795d20-a792-4870-bf14-4ee8c5418517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294553, "uuid": "259a699f-c3b2-4dc1-847a-8c5ffdbc8070", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f096b3c7-8ec2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701267840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267840, "uuid": "1446468e-aed6-4f09-af42-71dacace0494", "comment": "Malware payload", "value": "bac595c48f758494fbf8d1ba1f17a338", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267840, "uuid": "8a02e26b-f774-4c13-a155-6137a290c236", "comment": "Malware payload", "value": "4aedc43584eb7b2faac9b7b0392ff6977bd216c3a1e6b8e6f28d3a2102e76caf", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267840, "uuid": "3394c5a2-471d-479c-8dcb-99967e7510ed", "comment": "Malware payload", "value": "95817322c06cdb57e4b6cdbbba0ed235a42d1f27", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267840, "uuid": "cb043997-7672-458c-af38-9972d42c1eac", "comment": "Malware payload", "value": "40431a3d19e45292e0a6264f54751f3e712aa8495ce70f8c4480f009aae40f7399f84f07afe0ff01c6f1deb8ab7d0ffa", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267840, "uuid": "1bf3d3a0-9a07-412c-a801-b2a886e5fcfb", "value": "T152355C5A27456D6BC58DCE33C9D6BA47C736C4F0A74FE389285636AC0E163A38D418CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267840, "uuid": "115b7bf7-5a1d-4f9f-96c2-ee44d2b344c3", "value": "12288:Zr9NAc2ZJGgcAGBUS/3OCvY43AZ8LjY4D4DLi/aDgOdcGrZdD:Z/MG+Y3ZvRAyLjY4D4DLcGrZdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267840, "uuid": "ee6396ce-dc65-4c46-876c-ca32242a9ddb", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267840, "uuid": "4cbc2716-80e5-44cc-b8fa-1109fa61ef61", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267840, "uuid": "2e18dbd8-17f6-463f-803b-ca3ca1194d65", "value": "nCOPIA BONIFICO.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384cbb2b-8eda-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701277839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277839, "uuid": "de1e0850-15c5-48c1-8ee0-94a054791843", "comment": "Malware payload (RedLineStealer)", "value": "80ff1bf4d4492f517689525e97a10605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277839, "uuid": "381b0ed6-a0e0-4d68-916f-9f654c77fd10", "comment": "Malware payload (RedLineStealer)", "value": "4c2259bad0d965dd619a39ab78793890e5433abc7b81e8faed67bde00e337599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277839, "uuid": "f3edd8aa-aad7-4bef-a285-a51ed47ce6fb", "comment": "Malware payload (RedLineStealer)", "value": "a18f2b8fc5930cf5c6fb7697caf97fd447177fd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277839, "uuid": "9fa61b8e-5b13-4958-986d-0fb11169d26f", "comment": "Malware payload (RedLineStealer)", "value": "f8a578a3ae07abf12e5466adb0c9a0ee6a4fe0d62568fd9313528c306f1569d71838e23ce33783cbf495470cd9c8208e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277839, "uuid": "f4124d08-267f-4f58-a3bc-026ef7738e4e", "value": "T1EF853346EBE84472F4B6173235F163D30B3B7C26593093AE2A17956DAD711D2B0323AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277839, "uuid": "5d68f6a8-009e-404f-b00d-08c962fbdfdb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277839, "uuid": "366059a1-676f-416e-bf2c-a536e4644735", "value": "24576:GynMqFZYGtDDvbh/xjnyRvIigGlcxBuXzjS3mlMa7Vpd0ukAj9j8axrhnMp2pK:VlYGt/bh/NyRvP7QsfS3mcukw9jR0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701277839, "uuid": "8d6bff14-3ec1-4b17-9770-cbbf725f0d70", "value": 1819136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701277839, "uuid": "163d14cf-1dde-4c76-9eac-67b2dd894817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277839, "uuid": "3e2efce0-2b53-4bdd-9df0-1b53b6df54f9", "value": "80ff1bf4d4492f517689525e97a10605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f03c288-8ec4-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701268535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268535, "uuid": "dd51df41-f400-40b7-8688-04827300e460", "comment": "Malware payload (Formbook)", "value": "d70fee6773a2fef1adcd5b2c92d83c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268535, "uuid": "31c8bb8c-d317-4de5-b126-94e94b538013", "comment": "Malware payload (Formbook)", "value": "4c98667e55e0241bc8475bfdafa7847d1708e3d004d7190fca89fa10fa088123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268535, "uuid": "c0f2898a-9557-4919-a602-70988dd27efc", "comment": "Malware payload (Formbook)", "value": "e8ecdd408dd72dbd7634e1b9bfeb950ac65e4790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268535, "uuid": "0149f1bd-8a4e-462b-b339-c535ce47493b", "comment": "Malware payload (Formbook)", "value": "019d8cae74c38b48fad2a837f82b1c7a9763b85b62c15739903631225fa9743c08debc1b7eefe260e6e001eada5a3d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268535, "uuid": "c3d870b6-cf53-4f5a-b263-94701bd4b1e4", "value": "T1019533C262EDC413D6742F7854F767EB0936B8A0FF744329275EA85A4460AD0B67232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268535, "uuid": "90395ba5-d2b1-4c2e-a6ec-739a4f779965", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268535, "uuid": "5611ec3a-7e25-4212-960c-f66a375f0b32", "value": "49152:Yi0m/xKNmT6fM28QSjJrA4gXYbvV4AdIYi5KSLkT767Zb4+TujK:X55KNmT6fM28/19XIYGXgHp+TujK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701268535, "uuid": "00055907-4e83-4a4d-98e4-f863e56885ce", "value": 2024448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701268535, "uuid": "d6f042c7-29ee-4435-b56b-7bdbb9ecb890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268535, "uuid": "854160f5-e96e-4059-b2eb-f904522dabae", "value": "d70fee6773a2fef1adcd5b2c92d83c0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c7c194-8e76-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701234932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234932, "uuid": "ce14b174-7d8e-4b55-afbc-9e2b3bf84e57", "comment": "Malware payload (LummaStealer)", "value": "383e85d2379f81e0e746f1886fa4d968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234932, "uuid": "bdf39c3e-df7f-4530-9b73-80d58a815b3c", "comment": "Malware payload (LummaStealer)", "value": "5148d1d1fccca6226ee17d6abe0866e4f309b8d4144d99c4a37fd4b44809566d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234932, "uuid": "4d81b52e-2e1c-42f5-bc5a-4047003ff538", "comment": "Malware payload (LummaStealer)", "value": "560b5b0f40ed3923d010f1b271decdffd7455023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234932, "uuid": "96e8ed0e-b5e9-485e-a3a1-1ec9e1c29608", "comment": "Malware payload (LummaStealer)", "value": "879ad858fc26d5905a51be567061039a2e22756ac144b3c6310e603991edde4467471b11a18bcc6d46170f30ca0c1c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234932, "uuid": "d0756b13-75e5-4932-a89a-274e047bc3e2", "value": "T171953341A7DD8202E6B12F300DF32F97067F7EA9E6A5C3563352AC5FA92215494F036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234932, "uuid": "e343b9bd-e2cf-4f20-8af9-8b9e267d5ab2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234932, "uuid": "f91312fe-907b-4439-add5-a99b2e59a19c", "value": "49152:kIOYerRFzsKKrvURiTxqf5N6hILvZA96QZ+wyUm0cu08mCjOGg:EhrMKKrvUe6BB5xN89g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701234932, "uuid": "acae0463-6164-461c-9d8f-e2f5a28a9b8f", "value": 2024448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701234932, "uuid": "70ec1a36-c221-435c-aab2-b077b25e30eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234932, "uuid": "cb2d7900-503f-46a7-bc66-25e875935356", "value": "5148d1d1fccca6226ee17d6abe0866e4f309b8d4144d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7804bff6-8edc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701278805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278805, "uuid": "e6715b1d-e437-4bca-873c-9eb08dc3abc7", "comment": "Malware payload (AgentTesla)", "value": "32bfa5ce21546b8b2156e88a38c951d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278805, "uuid": "67097956-1dcb-4496-a0ab-73b439400cdf", "comment": "Malware payload (AgentTesla)", "value": "514de837b5ed18cd2d8f89382cf72fda346681fca39a4eb895f06d8da5717fba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278805, "uuid": "985849fd-8c95-40a0-a237-0e4e1496a240", "comment": "Malware payload (AgentTesla)", "value": "b9ebea60c30baab007602f042b08a4299b17c952", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278805, "uuid": "08f7eea3-41ed-4c1e-abf9-45aaac82d8f8", "comment": "Malware payload (AgentTesla)", "value": "9550c38f1bd567dfb94397f089b46d49d20412fe29a99528933f52a731c3ae6ece3f4519de087362e89b177f7db61bec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278805, "uuid": "dc29b7ab-265a-4dfe-9bf0-b9d60efa8bd3", "value": "T189E41215FA793F66D53A8BFA49B621D047F6293F2636E3940EC230E91261F840B50F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278805, "uuid": "d0503e22-417f-43df-97ea-e701511a27b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278805, "uuid": "9358a006-83da-4c98-8a0c-75363b2a98db", "value": "12288:YxyxB99kYOkxk42qWalr661yr4NunbAjQxeLLUeFs8LhJkB3zgxqMNopoxb:qyxTM4nWEjq4N2bAExeLw9WhJkB0xqMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701278805, "uuid": "57e14825-f573-407a-91f7-91fe0f063d30", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701278805, "uuid": "ba335d0d-9575-4780-aab4-58672b4dfd56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278805, "uuid": "fede74e7-a113-4366-81d1-22742e322e2f", "value": "SecuriteInfo.com.Win32.CrypterX-gen.11078.6292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bea8e02-8ec7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701269738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269738, "uuid": "07dbaaf4-91da-4780-8a6a-f7f5aa7fca7c", "comment": "Malware payload (RedLineStealer)", "value": "aab85d8dc402cb3c4487d181db202529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269738, "uuid": "aec28ab1-c13d-4380-b4ac-93979472ca1e", "comment": "Malware payload (RedLineStealer)", "value": "51ece97ff2a07a17964f2efee643f0be6da2596c4868e0d6e4c41b38efa1db42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269738, "uuid": "c7383448-4fa0-4e3f-ade1-79d440d8df2a", "comment": "Malware payload (RedLineStealer)", "value": "658d18524381b7d7e98506e3a4c7a61de2f810c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269738, "uuid": "9961a961-9483-4b08-9fd4-dffaa8486c55", "comment": "Malware payload (RedLineStealer)", "value": "54607375986c14cb0718f2b3b227c0414fc1be3a6758674b10cec93d35db1f17d36310c006149c295f508fd0fe60a5a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269738, "uuid": "de74fc7d-4897-4102-9baf-3ce4d584b742", "value": "T12C03D08344796A18CA15BE36011188E2F6D5B394F6582101F7CC9CFBBF2E784E75BA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269738, "uuid": "fa596363-557c-4f2f-bb46-b3baa93d467a", "value": "768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701269738, "uuid": "08cb2fd6-7bc4-4da6-aa05-5b7a27078743", "value": 38584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701269738, "uuid": "7b4b9c36-5674-4a39-95e0-16192da6317b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269738, "uuid": "2a6d885f-89b3-413f-bd5f-c023f3103585", "value": "aab85d8dc402cb3c4487d181db202529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0afa35-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701283219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283219, "uuid": "ed9a30b0-d447-4686-b8d1-14377d1794ff", "comment": "Malware payload", "value": "9443ffe27267408d471d64f9cf479c15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283219, "uuid": "b5760a97-1b83-4f48-b6b5-7a2a45031755", "comment": "Malware payload", "value": "53266267af33a55c73bad711fb27a21e7a2691f3a329dfce08c0913ceca1ac24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283219, "uuid": "2ecf5f7a-74e0-4a56-99ac-75f27ea6eb70", "comment": "Malware payload", "value": "065d8b13449015a811b3414035e9abb97f0c1e12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283219, "uuid": "f2502c9e-c497-4f05-9e33-683f4f6b69f1", "comment": "Malware payload", "value": "6df601bf01dbba4acc2023bf622715f9b400429dfa542bbf90537a5937fae261ec30915741aecf2fc10ed4cbd5da295b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283219, "uuid": "2f419e49-e2a7-4b9d-87c6-b60153ae989e", "value": "T18662D60D6AD44C2DF7F23874573DE10F49BEB8623661AD8FB780B2463874392C5E455A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283219, "uuid": "4af098ae-0213-4913-9d1c-36129c2394c2", "value": "b415e597ba603f57842db9bee4a0b864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283219, "uuid": "4cdded89-007e-45c8-80e2-352d7866235b", "value": "384:6KwAXvjMDjSMUcH2clU6MQWS+ctvQ+VXi0x:6KlvjMvlUcH2clULQ80vQ+ti0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283219, "uuid": "84a559ad-9bf1-4e8d-a698-609d2ff68170", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283219, "uuid": "012dfce3-ef7d-47f7-af72-d301efb00669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283219, "uuid": "596859a3-884e-4a95-a65c-3a8e9a42a2dc", "value": "9443ffe27267408d471d64f9cf479c15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dba398-8e8f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701245653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245653, "uuid": "8560547a-c2bf-4c3a-8d1b-be401d23dbab", "comment": "Malware payload (RemcosRAT)", "value": "df1a69ba64b59119237d664555b13107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245653, "uuid": "e49ae3a7-13fd-4112-89c6-b844c249a8d7", "comment": "Malware payload (RemcosRAT)", "value": "535bf9315ca3a515f25cc125c2455b3e0da2d6836950aa40d2a4f1fcb285abd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245653, "uuid": "5626bd47-3e68-4c96-9149-23f691c7b575", "comment": "Malware payload (RemcosRAT)", "value": "f166ee9df97a13002532439e934c56f1db032b55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245653, "uuid": "d32e6477-a1a7-4658-afab-435f088e639c", "comment": "Malware payload (RemcosRAT)", "value": "0b68eabd8633adb780b99b244883f07db1894b9bcd65a3732353a39636b82ad1578dbaf4d5a8ae0d2d831f03e11827e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245653, "uuid": "50a2422f-2a0e-4a8a-9b68-54db881ebf4b", "value": "T198B5BB31B7D1ACADC251FA31267698004D165F5E3F38464E3F8FB5262FF6E0A2099D4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245653, "uuid": "922ea588-b23e-4cae-b8e6-6ef70751e5f9", "value": "a68d8e2dafcb38cb88133c6298bff5cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245653, "uuid": "c2453284-50b2-4cb6-9aee-cd283ee2b23e", "value": "6144:MT74ZKA8lvBnpiz9iDiDP9KVdh0uzohH/+K/UReCVxiOYpraqCLp3WYfKMRPS4T/:k4ZKSzsDGyDaH/+K/Ub31MM6muOQrRPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245653, "uuid": "324a740e-f672-4cbc-b854-dfbe3e588309", "value": 2393344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245653, "uuid": "1211795d-3222-45af-bbaa-f2e0808981ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245653, "uuid": "d5ae077c-ff96-48ba-97d1-0ece0a2ccefc", "value": "nodehost_UEv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f842cd32-8ea6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701255827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255827, "uuid": "4133894d-41db-477d-8359-55188836211f", "comment": "Malware payload (AgentTesla)", "value": "95902a3682c87f24f301723be8b5114f", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255827, "uuid": "f4fd0ccb-54d7-4191-8fe4-490fa130c007", "comment": "Malware payload (AgentTesla)", "value": "5361b39e6cba842c7bde10d9c1984f61ac3e32d3118a22d6cd82f6ecb43207a1", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255827, "uuid": "989c6215-ccc6-4831-9224-cb2061abc3af", "comment": "Malware payload (AgentTesla)", "value": "12aeaec503b8058b6184dae0192aafe3553aebed", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255827, "uuid": "11a60157-58d6-402b-8b04-18d99e0640ba", "comment": "Malware payload (AgentTesla)", "value": "de7c72a7286dedae604cdd06ef7c2267d56a3c843a70c279188b3bda88fcaddc0133e659b831245f55ef57fe01091392", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255827, "uuid": "a8691fab-0517-4df6-8278-73ebef859a85", "value": "T1F3E4128139D99E27C66F25F828BA640113F7849A7D95F7CA5DC1F0CA5AE1FE0030169F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255827, "uuid": "29c09d24-0d2b-4ba8-aec9-abd4114d6f3d", "value": "12288:Rh6pQmbCp92iNWgkjYa9U5NKl6Bngsvjzzpb6LDurVFk1ggb:Rl1TkjtU50mbzF+/8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701255827, "uuid": "e1c3f824-7409-4ac3-a89e-98127292154b", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701255827, "uuid": "4229cb08-ad1e-427a-9aff-12e98210104c", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255827, "uuid": "0db23107-d698-4a24-b0f6-a962c8e3a5d5", "value": "PO#23-0196 Soft Shell Nylon.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795ace90-8ea7-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701256044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256044, "uuid": "7b45dc6f-f83f-4140-8981-a55f7dd0ccb3", "comment": "Malware payload (RemcosRAT)", "value": "340954f4002563056238d23d33892995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256044, "uuid": "0147245c-5627-43ec-90f0-1189cebdd75d", "comment": "Malware payload (RemcosRAT)", "value": "5370332f1c37afc41f5ef1780d6d991a7ce0b93e6790addc9b8917e63036f77f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256044, "uuid": "f35a384d-9afe-4d30-b409-a254cc00b72f", "comment": "Malware payload (RemcosRAT)", "value": "5bda5904ca1b561426f5cf7eb56c8473c1232f0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701256044, "uuid": "800952d6-0269-4763-8a1c-fa6684535178", "comment": "Malware payload (RemcosRAT)", "value": "295833d3f085dbfe45717242a572db0cdc93691ac4eb0a68ed47addd579fed77f57ef7eef9af4b91f8297af02d70793f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256044, "uuid": "1462eac9-1286-4c5d-bcc0-9533bce05391", "value": "T1DF3412952F66EC98F1C090F49401E1F472EA2C761EA3664D0BE4BF57BCBE580BD96063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256044, "uuid": "6acb109e-1279-4c4c-8c8a-cb41325032f3", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256044, "uuid": "1576402b-bdac-4eae-9105-f2d14dd18274", "value": "6144:cmvl3n8iOiB4RBucKa3h80tK2gBWvADGGw6j12:BvlX8i8RB5JvADGGnjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701256044, "uuid": "d2e717b2-90ff-4a44-90a0-e306c49276ef", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701256044, "uuid": "dbe10408-53d7-43a5-b4f2-895dc90be94d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701256044, "uuid": "84fbc526-2878-450c-9455-6c47f7528c3f", "value": "bRYb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62bb7eb-8e8e-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701245435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245435, "uuid": "7bc546fe-72a0-43b4-8bc8-f8903f1b2112", "comment": "Malware payload (LummaStealer)", "value": "2df03e1b84d452c2053d47b0f593d855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245435, "uuid": "d0c17fb4-de90-4321-8f25-f2bb669c6f76", "comment": "Malware payload (LummaStealer)", "value": "53fa7d3087b6a6dce7ac7b28c28e5385e9232c3869d07d569ea6f24db43888b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245435, "uuid": "dc49b90b-2821-470a-93f8-42494948864c", "comment": "Malware payload (LummaStealer)", "value": "1a12480c4eab6e8d2efba288e49e9461ea90b18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245435, "uuid": "a881e3a1-1a77-47b8-a67a-c13b8b62bf6b", "comment": "Malware payload (LummaStealer)", "value": "e7d8e43b138bcfa4de53ca74b6bf334a5e8d6fabf2849cf7efe3179bfa988597e24c957329f0d630ba0b06476f343d70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245435, "uuid": "d6e75aea-eec6-4602-b842-1aac15649b80", "value": "T1EC258D2138C08572EDE3E0B742EDFA2602ADD4B0072556CF16D85BFEEB606C17B36596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245435, "uuid": "ed24397f-7da3-4058-87f6-3d4961fac510", "value": "87161a064f5daa4a79ca02075d04f281", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245435, "uuid": "832b013b-3a65-4c05-a612-e01621c7c593", "value": "12288:VWJtO2qFC1w9J02SRCdFTb766TO0cMI9dbwaCDbCbu5kVwdm:Vd2qk1w9J02SRCTmWR5I5CDbCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245435, "uuid": "718471b6-0560-4fe3-ad87-128d3f02c0cb", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245435, "uuid": "5bb6a5e8-faae-4cea-b312-ca92e4eacebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245435, "uuid": "e7a9329c-f76d-4cdd-9e1a-f947cf7ee575", "value": "2df03e1b84d452c2053d47b0f593d855.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495e9764-8eb7-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701262835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701262835, "uuid": "5736a38f-26bb-4aed-89a2-8d3e466775a4", "comment": "Malware payload (Vidar)", "value": "b2f9c8c1367bb5a64232dd815c5158d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701262835, "uuid": "6291caad-7dfc-4c9e-9e28-9f398d42ee9a", "comment": "Malware payload (Vidar)", "value": "543d0a85398762fdf5d155fb14833257aa09fcc86da9e789dffbbdd29ff2240f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701262835, "uuid": "26e8e715-dfab-4e3c-bec1-d524aa6962fa", "comment": "Malware payload (Vidar)", "value": "f9419c4474e46b2348166798e55d6c4cd3a738b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701262835, "uuid": "af28ada1-6bd1-44cc-b0dc-1a1ff2af3889", "comment": "Malware payload (Vidar)", "value": "03fd47bc27884c5982f94faf3bda8777b824ef1f2e25d75ca7a8fd5efe3a0123b51b8e0c13e9d71d83090acf23dcc29f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701262835, "uuid": "63741d7c-1bcd-4d62-888d-1ed4f94e5436", "value": "T1A6748D03A6E5AC61E5164A33FE2AC6E8671EF9508F156B9B33146F2F49712E1C273703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701262835, "uuid": "3bf51bf6-eda2-4041-8da8-aaa3d3b2e93d", "value": "a5ba2e63e413ae40c0d8efc223d7976c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701262835, "uuid": "9c1a5c3a-64d3-4dd2-83c1-5927fe1765a3", "value": "6144:u/FGZvV7Sw4qYUPx00ujDLsjwpWu/sdwFmsNM:eF1LqrfujDoLtWAgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701262835, "uuid": "6cddd4ac-4122-44a1-a584-ad40abea5718", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701262835, "uuid": "b776cc6c-d808-4fa5-9f6b-5ea4c952bbff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701262835, "uuid": "92f7d8eb-0060-4789-9d89-5e22d6747c9f", "value": "b2f9c8c1367bb5a64232dd815c5158d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9046b9e0-8ec2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701267679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267679, "uuid": "103ab1f7-6b39-4d31-b326-67116ec0739d", "comment": "Malware payload (AgentTesla)", "value": "52092f980201ffce0352e5126ed0bf43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267679, "uuid": "0127a934-be42-4bab-aca8-1ee2339252da", "comment": "Malware payload (AgentTesla)", "value": "54aecbaf7821c0ee087cae191865a7df8b58408efbaec7b96b6b0dda54efd32f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267679, "uuid": "d7139b5a-b371-452b-a78d-140ec979604f", "comment": "Malware payload (AgentTesla)", "value": "919d960cad9c7495d253f741fe56000bfe11e938", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267679, "uuid": "a0654cee-f568-462f-8c0e-c9a1a0a054b3", "comment": "Malware payload (AgentTesla)", "value": "b07293d572a5dabbd5a75d1b7a9677f74e79fec2fc4a731c801c32888b53dc919d96d4b3eed92881d25895c31301383b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267679, "uuid": "933b4ac9-37d8-4663-b7f4-cf2958917670", "value": "T19DE412897A6C4B17DD7D13B56431C87543337E292AB0DB0E69E97EEFB94B3110A21A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267679, "uuid": "e2d6670f-ca2d-407c-bc5c-07aa8f39e626", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267679, "uuid": "b3e454a1-777c-4b58-a07c-3b58b3f96b77", "value": "12288:fAcopox4QzSIGjRzgx1JtoZX8F8D0m3SqazJb+cgxWZqiwn4DbOKij:zeQSftg3Jto4eSqRcm/iw421", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267679, "uuid": "0afbecd5-c017-4c04-b9a6-19a477ccff47", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267679, "uuid": "47eeb587-f3de-4b80-a5f5-fef01f247e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267679, "uuid": "1207ebb3-134a-47c2-b524-b20a7873ab4c", "value": "123 WHL ASA route SSHAS0123860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3ca320-8e5d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701224423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224423, "uuid": "fc960b91-bcec-45fc-98fe-409f8906e94d", "comment": "Malware payload (RedLineStealer)", "value": "0e6a673dad85f9967a63b0c9655ca986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224423, "uuid": "e0a3ef44-d698-421a-937b-ad796ce7c4cf", "comment": "Malware payload (RedLineStealer)", "value": "55f27011c5ebbe08d2aa779b039bbada049d8e6e2f9094f9cd8d1cbbab0a562d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224423, "uuid": "0a7f34ef-d5c0-428a-b02c-13b88eb98219", "comment": "Malware payload (RedLineStealer)", "value": "0775c4df814ec8312a41be4776c187e3fddc2762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224423, "uuid": "5759c511-0e4a-40ab-b28a-dd161ed413f8", "comment": "Malware payload (RedLineStealer)", "value": "a48b0226bc1b02d80425f686d1461c2dbe8ba639d803f34512bb5f6d1542c8d01d970cc61eb88d8d334ae070feb7ed32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224423, "uuid": "3e009cc8-5d6c-4d02-ad40-0b66e07083d3", "value": "T18803D08344796A18CA15BE36011188E2F6D5B394F6582101F7CC9CFBBF2E784E75BA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224423, "uuid": "3ef7719f-f963-4964-868f-35910cd62ae7", "value": "768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701224423, "uuid": "adfe5ead-99dc-4a45-832f-97f8444ca66d", "value": 38601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701224423, "uuid": "acc1dc21-64c3-42cd-9cfa-590a43c21656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224423, "uuid": "51e9d670-8d97-4292-869b-dd38c9ec5313", "value": "0e6a673dad85f9967a63b0c9655ca986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c4025b-8ec5-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701269144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269144, "uuid": "a29035a6-0026-4b29-80bf-7e63f737b762", "comment": "Malware payload (RiseProStealer)", "value": "37303cf95e57208d991e49c540cba294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269144, "uuid": "c6ac3149-69ae-4b7f-ac49-ab8ac990999f", "comment": "Malware payload (RiseProStealer)", "value": "5658f2d0a6782fa0c9ec353a37d0252e308e373d28c8570f9765fc79d3a6bb2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269144, "uuid": "b9850856-c1cc-4888-af17-b731dda75884", "comment": "Malware payload (RiseProStealer)", "value": "f0d6b9aef910fdc67a61f66de44bb6c25b4a6d56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269144, "uuid": "f1505304-21e4-43fc-9974-9fd1ab9dd8ec", "comment": "Malware payload (RiseProStealer)", "value": "41754f5ecb76f70fcadfbf7b472e21a967c5f3ab8711644d4e883538d1c277950be6cc073fbf24d60f79e06bc0b7e65c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269144, "uuid": "c4011b9c-3ffa-43fb-ae12-5d2dd52e05cd", "value": "T1FA852303FAEDA423DC5927700CF712922B7A7EA05DB8C75B1BC5945A1C325E8A47932F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269144, "uuid": "7555be52-f3da-4d3f-bc3b-2923545f10e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269144, "uuid": "d0ac37e7-f54e-4383-aa4c-55e0996999cf", "value": "49152:jW4FsXXrnUG2+Fr5EdYoRhLtjk7DXgegdmolVzWWHl:i4F+g3+7oJ47DQR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701269144, "uuid": "44a7e7a6-0a2c-492c-b56e-fb851aaa6a90", "value": 1825792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701269144, "uuid": "f397e8fe-f8e5-481d-a2a5-d5f228b1b9cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269144, "uuid": "3c4bd52d-07e4-4472-b009-caf43acedc2b", "value": "37303cf95e57208d991e49c540cba294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fb5ad0-8ed5-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701275661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275661, "uuid": "cedd3ae3-55b5-4870-a5b1-bb70eb8837af", "comment": "Malware payload (AsyncRAT)", "value": "95373762b1f74779789f73c6d25a2cce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275661, "uuid": "7746b2f4-ca2c-4b9b-92a5-c149b1d6d65c", "comment": "Malware payload (AsyncRAT)", "value": "59f01de5b08b5d08e38e9edaccf55ad31b61c8f3f0dfaba1263e5cd16d1e0e90", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275661, "uuid": "ff0442a0-65a4-4b6c-bed9-dba684694da5", "comment": "Malware payload (AsyncRAT)", "value": "3c904381008b857205c97947a25cf04c3b9153c4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275661, "uuid": "67724a43-6265-45c1-99a4-0658bfa69186", "comment": "Malware payload (AsyncRAT)", "value": "73ef5f61b50bc1b3f537653d27c3fe9a3be301f4dbc587382b93dbf212d74e8e89068645f5e0c98b5f92027cdeb8951a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275661, "uuid": "3e0c91b9-be4d-41ac-a55c-058c843e1309", "value": "T13FE24B483BE54327D6FE2FF229B2A10102759507D923EF9F5CD885AB6F67B8142003E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275661, "uuid": "e782480f-15c0-4638-9d2e-b1c5ca67d512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275661, "uuid": "eb58f1ce-4186-428a-a4b9-76af1e7c3177", "value": "384:R5wTA+5OfPgEBQqWvfcQLZe3s80hYACSqRSMg2uRugtFuBLTIOZw/WVnvn9IkVuC:frgECfLH8MYAoRSF2uBFE9RS0Oqhnbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701275661, "uuid": "9779518f-2cb8-4d91-b0ce-f453fd2b2a2e", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701275661, "uuid": "c6e46c23-0f32-41e3-82cc-cecdd201035e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275661, "uuid": "af6aaf49-9b50-42dc-9734-9df699e78556", "value": "xGm2okFRNqtP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461f7d7b-8ed4-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701275285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275285, "uuid": "10c9b1b6-68e8-46a1-8582-afa706514d0e", "comment": "Malware payload (Formbook)", "value": "f2fcd44fd69512b96bc679243b22e5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275285, "uuid": "50e0907e-53c5-4492-bd0b-0989231d8d6e", "comment": "Malware payload (Formbook)", "value": "5a420cf9353018576f8b446fd12723e585b96e2086b4aabf06cd113f376a6369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275285, "uuid": "f05001ac-6af9-43bb-ab99-82cd05c75ccf", "comment": "Malware payload (Formbook)", "value": "17eed19e35d8424ef45ace39c13b929a6a209ae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275285, "uuid": "794cb82c-a299-4be2-9d65-5bae7b303616", "comment": "Malware payload (Formbook)", "value": "3f5640f9da03eaf072fccaa2c640a7e5fe165395aa2a8bf79f55e3e778ed57f913b59bfd9f352b7022ccfb1110615b5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275285, "uuid": "866bdc4b-05eb-414c-8283-041bdcaec557", "value": "T109E41208ABB82F33E4B947F91975218487F6A57F1230EBD80DD230EA1652F480B91F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275285, "uuid": "3bc79409-3808-423f-8d10-fe7f54cb38fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275285, "uuid": "65ae4d88-b1a0-4d00-800e-fbbafa1b9808", "value": "12288:mxyvX6CvSRyno9AziP2e5RADycvEX3PlGK3SzdfcgOsf//opox:QyvX6C68onyDv8PwK3g/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701275285, "uuid": "cc0720e0-dda5-4533-b6f6-e2d9dc6634ea", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701275285, "uuid": "38319808-855e-4b1a-942b-b44a0d47ca76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275285, "uuid": "68f58bac-2720-4239-a3f3-4cddcbb35974", "value": "SecuriteInfo.com.Win32.CrypterX-gen.24138.2522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c91e909-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701283161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283161, "uuid": "89b40d30-1754-4a9d-a6a8-57353a736656", "comment": "Malware payload (Mirai)", "value": "737ce3f27dd93d9b6a26828073e8965b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283161, "uuid": "65f78647-fc53-41f3-82f7-c97a2096601e", "comment": "Malware payload (Mirai)", "value": "5abb705e6e923f055688eade559f4102134c4fd406f6ffea57623d35346cab04", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283161, "uuid": "59cd3949-2d86-447f-a992-f9c033855033", "comment": "Malware payload (Mirai)", "value": "9e1b8f4ec79e75d35232869ff3a84156fc6b76ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283161, "uuid": "b68a40cb-b4bd-416d-a3b6-734d4aa5044e", "comment": "Malware payload (Mirai)", "value": "b984a2fc52f4167c3d89ecd2b03bc0e87ce32d98d573d46cbb9d8424073140367f6c9e7037abd9f84a5438c997dde150", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283161, "uuid": "fec97485-981b-44d0-a0d8-270f11be8dd2", "value": "T157D33A17B5C180FDC4DAC1B44F9EF53ADD32B1AC1238B16B2BD4AA221E5AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283161, "uuid": "c23d4140-eaa5-44d3-82d4-e0b7777cef88", "value": "3072:tGtwnNiaOnUTyFiPT9OSQ7AOaogjV2iZlBWCgDiAJQPdL:tGtwnNiaOnUTYuLyZJQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283161, "uuid": "52918e51-3dd7-4942-9680-68a50a764866", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283161, "uuid": "f43519b9-f84f-4fb8-9948-1d2995f407eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283161, "uuid": "2a80f4e5-f3be-4953-b66c-db820fa70937", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3aa254-8e96-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701248854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248854, "uuid": "a5668eca-6ddd-4a0e-87b9-1197fa3a5a29", "comment": "Malware payload (AgentTesla)", "value": "7e0f00a82650a6e6a34356570d8a283c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248854, "uuid": "a682f19f-141b-46cc-866b-b7e020dbd771", "comment": "Malware payload (AgentTesla)", "value": "5bd3f5d12690c59a0b40566fdc674310f02d4e19d6a6c6dba23b71854872d1fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248854, "uuid": "5a3e60cb-3dee-431c-beae-2a037f6f78fb", "comment": "Malware payload (AgentTesla)", "value": "7eed3a24f79623af2e2c8d08e53a63e972b14d45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248854, "uuid": "8a877390-feb7-47ed-b08b-566e6d67c354", "comment": "Malware payload (AgentTesla)", "value": "38cc259c8545d78191501952c226a366a74b96aaf5168ee2e278ddcf1d459bfc35f150ba69fd34078d1c489d09f2917b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248854, "uuid": "68a5fad0-c742-47d5-b599-875c65c87c3c", "value": "T16BE4125A72CC866BDCBD43B45572C8B12776BE666A32E78D2DD82CEF7943B080540B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248854, "uuid": "baf7e17d-d3f0-40ec-b815-2290a6be3823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248854, "uuid": "8ef0b363-560c-419c-bb29-462273a39758", "value": "12288:REcopox45WawGy8o1+2DZngF16zZN+6DWBHPji8NgsOZ7IMjhJsZbe/p18j4O:NetWawG7o1H8mzDWBHPGagllt+cQEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701248854, "uuid": "8aa3c1b0-bbde-4ac2-9e94-91eb010d6b62", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701248854, "uuid": "ada11603-6f46-4d5c-abb3-f462e31fc2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248854, "uuid": "5b54b465-4487-4197-a097-b03ebc04269c", "value": "SWIFT MESAJI 29-11-2023--pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc0514a-8e74-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701234039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234039, "uuid": "9491cdf2-c432-4e41-a14e-1c78b1f3a065", "comment": "Malware payload (RiseProStealer)", "value": "9ccee611e9037817f4a0e93d477e64bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234039, "uuid": "0c08c61d-237b-440f-ae02-ead1fc8ef8fd", "comment": "Malware payload (RiseProStealer)", "value": "5c4d93be7d334a4ce5884cc29b1dba7b67fc0d7cf1e7b11d02108fd979f53871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234039, "uuid": "69d1faf0-3e4c-4d39-9433-202bed2d2ed5", "comment": "Malware payload (RiseProStealer)", "value": "bd9f2f061e084338858b049c4173ea708fb1b4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234039, "uuid": "3c064c1d-05e3-4fac-98f9-677cd63f8f6b", "comment": "Malware payload (RiseProStealer)", "value": "ec837426e8e5fd010ca02d2fdf0aaddc58fc05f1e0b2ba8b7eb15acd92d33ad66d000f5be105ea9d08840727b6ae7c1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234039, "uuid": "4ac9f91f-acd5-4ed9-a3ba-b210bb6bc754", "value": "T16195334367FAA833EA713B7004FB8B6B1237BCD0B6F062651645EE491A65994F43133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234039, "uuid": "7ad380c8-2b67-4a20-a414-e7535213217c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234039, "uuid": "bb5e423c-a4d8-499e-8d3c-031a3b42335e", "value": "49152:oH9d6bTvi17QhzfGS+kEJDvCG7WHWB6wfYcKUGdSoOH1y01A:Y9dYi17Gy17d/fYXU48H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701234039, "uuid": "79cb5875-0f2c-4ca5-88ff-b9cfcfaadb78", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701234039, "uuid": "59b6aff4-8046-480f-b5e8-1b8f054e979d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234039, "uuid": "5c071349-f21b-4902-aabc-8c0d83b4e4e0", "value": "9ccee611e9037817f4a0e93d477e64bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4114593b-8e97-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701249077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249077, "uuid": "e5879fbf-d84e-4892-8706-1b9d44a44a60", "comment": "Malware payload (Formbook)", "value": "daf58ca77ffd2e1f17e049c1a6c3f532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249077, "uuid": "8c9f6b0b-4e90-4e02-a913-82a0c05b2b01", "comment": "Malware payload (Formbook)", "value": "5c5d5a0231e21ca60288730e851e75a6e069893bba46336400e17571ee64516b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249077, "uuid": "cbbee9a7-3195-4b49-81ee-5e6d5b8dc02e", "comment": "Malware payload (Formbook)", "value": "231992937099138c049b05b379883c7172b7d28e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249077, "uuid": "1643a21b-0db3-4c9a-ac4d-4cd3d09003c9", "comment": "Malware payload (Formbook)", "value": "c5bd90f44278189898d032ab7c08b210a5e41fbb74d964e98867870f61de9c135b3fac1db326760112e36dcc6271741d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249077, "uuid": "23410ce3-23dc-4ee6-9547-74907a33784d", "value": "T17DA401E2B256CD99DC564BF10C6AA63001B75E4C94E9910E30E93F3F7BB23932846D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249077, "uuid": "73fbd299-b1b3-47fd-bd6b-53917a0d2191", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249077, "uuid": "19e8f356-7eec-4370-ac55-a15dbcee44bf", "value": "12288:CVEAmDwDTm5pRVukgcf7dKKOIORos+9KEUTGxQi6R7:IpDcpDTdK/RknKi6R7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249077, "uuid": "76c919e6-3739-4893-8d05-922a6ef71a0b", "value": 450839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249077, "uuid": "5964a0fa-17ae-43b7-96e4-df433a27fb4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249077, "uuid": "e63c60e6-38b5-44fa-8c80-152a471510c4", "value": "5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b060b5-8ec2-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1701267500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267500, "uuid": "ad7232df-ac40-4776-a4f6-0ca2ad416047", "comment": "Malware payload (NanoCore)", "value": "00bc84ea46871a6109ea431895212de6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267500, "uuid": "7d043672-73e7-42c3-90a0-e124199ae6dd", "comment": "Malware payload (NanoCore)", "value": "5cdd0eea11c3a986453ba11e2d2f5dfe8df3d5182c498e9d49b61bb5f1a07977", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267500, "uuid": "2516f7cd-9697-47e9-ab2a-eddeacb1e8bf", "comment": "Malware payload (NanoCore)", "value": "a39d7050310f899c6f90a32965fdae7510b7dc6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267500, "uuid": "3280544e-9563-4575-9121-6841fe60db62", "comment": "Malware payload (NanoCore)", "value": "6ba9c025c69a771efbab0f8e078f63ff125fe03c7591321577d39d8ee4d602f3bb316a1b29455a3f4611d185fa250c5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267500, "uuid": "a1d5fb54-5813-4836-aed8-36907fe674f4", "value": "T172C3896DD34B01A98F525377AB1B1E4542BCBB2EF38552B2346C833533EAC3991252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267500, "uuid": "5e70eef4-a4ae-4bda-8140-dd1930a061df", "value": "768:qwAbZSibMX9gRWjTKJQN43etP6v58aKfjmbLfDOCC7RyLVIm66Sm:qwAlRKNCrv4fjCLfDOCrBr6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267500, "uuid": "47b2f2f9-9b23-474d-9af6-ccd9773152e8", "value": 126787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267500, "uuid": "4e69c6f3-f09f-4e8f-b0ba-4eb6ec4f6c8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267500, "uuid": "cec956d3-6eb3-41b6-bf40-d8743a412df9", "value": "plugmanzx.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad06906-8e9f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701252422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252422, "uuid": "bbcd3072-537c-4d0b-9c98-bcf376281eca", "comment": "Malware payload (Formbook)", "value": "4638bfcb8909f3fcbbc876334713f3ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252422, "uuid": "c8e8ba39-8144-4642-a466-b9bae9c87800", "comment": "Malware payload (Formbook)", "value": "5e172b1497a76076f9ca46f345383aad816d90c2c8799a7ec3520a85f38c2bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252422, "uuid": "4da5bf50-3ff3-4550-913d-187d5dd72573", "comment": "Malware payload (Formbook)", "value": "604c1b6057851e126f9aef2ebb0d474c6bbd1315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252422, "uuid": "abc6d5c6-24bc-4f4b-9800-998d94e8f23d", "comment": "Malware payload (Formbook)", "value": "4bdaffdd82e548cdaf51843387951177c6a795a4a4f7c36335f728730c178823c4d6f17bbd2659877d57b675a48f847e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252422, "uuid": "791cb41c-864c-4231-a35d-931d150b4ef1", "value": "T18BE41209BBCA5BAED97693F4051481018BF5FD3B9579E3482CC1B1EA42BAB604B71F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252422, "uuid": "6da39578-0d0f-4794-b812-052b18fb60e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252422, "uuid": "7d9a3f18-2ed7-41bf-82ca-4d8f459d171d", "value": "12288:nmY1E6jD/+cAsqkSEhtiw3SuIDzqqZaMePrv4n0v8xPvORNsc0+5eopoxvkU:mY1tD/jADkSEhtiw3ZmahTw0kxPvsscN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701252422, "uuid": "50ba5bbc-209b-4c3e-b57f-e759144e9d67", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701252422, "uuid": "4a13ec51-b73b-4c3f-aab1-7110ece53fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252422, "uuid": "642b078c-299c-48be-9f20-736b30eb98cc", "value": "transfer_20231128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927bdaa6-8e52-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701219579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219579, "uuid": "649270c7-db43-4c55-b804-578f26a5d226", "comment": "Malware payload (Stealc)", "value": "be266f86c6927fedc41f106002e6c9c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219579, "uuid": "1dc7a801-f990-4eb4-b89e-6b24402a4964", "comment": "Malware payload (Stealc)", "value": "5fdc91ad771c9fc0b8f3fa547a3616468ce0b7bb448f726ad9c055083ac13c0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219579, "uuid": "67a28673-4d8d-443d-af18-2f4fd9e6da1b", "comment": "Malware payload (Stealc)", "value": "df0330a62814ed3f86beb07fb1acfcd7b49c2758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219579, "uuid": "cf542678-b719-4496-be2a-0f78a3ce6685", "comment": "Malware payload (Stealc)", "value": "2bc2e72f8b2ab486aab23b3c47a480d5c337ba86579f8e7d7141aa1b7598dc45c4834749d81c0d6f50c8fcd8c3d14243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219579, "uuid": "7d54dd72-e0f7-4d59-8e4e-533bf011bc16", "value": "T12154E64392E23D44E9268B729F3FD2EC770EF6918F097B6921189E2F04B1172E263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219579, "uuid": "14613ee5-5b5c-4401-b68d-0be28a92d680", "value": "29febc0919e45955d8257576c2c564a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219579, "uuid": "fcd2e6c6-8256-4ede-b850-e9c6dcedd932", "value": "3072:QygbQfvakrXmz7LOSuXwOqZBeUo5KoMQ5LlxG:LfikrXmz3pGwOAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701219579, "uuid": "d40fd7aa-5389-4aa5-a01d-f36f4f63fb8c", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701219579, "uuid": "d70123a2-fde7-4a8c-8686-400c261cde4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219579, "uuid": "c784c2eb-e89f-4a3d-b5c8-44e526ec3c2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1836b13b-8ead-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701258458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258458, "uuid": "06a1859b-8cdd-468d-a5ce-9007696abbba", "comment": "Malware payload (RedLineStealer)", "value": "01b7044967c5f9df8a04244961d157a6", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258458, "uuid": "cc866fc4-84f8-4ab6-bb73-46ea0d8ae0ad", "comment": "Malware payload (RedLineStealer)", "value": "6053dc2f853bdaa5959085349b94ac35eee6e2ce49ee3b700c703a54996ef814", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258458, "uuid": "4ad46b11-0bdd-4f95-99c2-e04253dab0d7", "comment": "Malware payload (RedLineStealer)", "value": "40d4123a54180cbd72a3e661c4820a84fb7789b5", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258458, "uuid": "27cd048e-881d-41fb-bc2e-c7f4ed0ac550", "comment": "Malware payload (RedLineStealer)", "value": "285cf6702474b010e72450835bc1f908c2a9f59cea04074349ef2491a853b69f8d28f1a27e5c32fa441dcb794a703597", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258458, "uuid": "1b9b62fe-d5d3-45ac-9f1c-3ce35326dd27", "value": "T15ED5BE1A35CAC636EB7E82306679D77A61BA7EE00BB104DB63D43A1E1E305C11276F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258458, "uuid": "32f97eee-00cd-4d3e-89f6-705686e68cdf", "value": "49152:45lQ14uW8zBQSc0ZnSKnZKumZrFq4Fb6HXr1iWnYs4ntHurpllQ6acuxtZFCNi2X:r490ZnpKNFnWnpuxgi2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258458, "uuid": "6d3c7071-3645-4641-bac8-8f4e7ddcd98f", "value": 2886656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258458, "uuid": "d45aba16-4069-4c26-ba35-26e0b97a13dd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258458, "uuid": "354cafcd-ac29-4755-8516-5694d8ef0809", "value": "Cheat Space 1.4.3 (1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc338daf-8e97-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701249338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249338, "uuid": "c59b9204-9ce4-4eed-bbc0-5a060a58f12c", "comment": "Malware payload (Formbook)", "value": "869b8afb5bf731ec5cc6ac3bd21076ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249338, "uuid": "000b5c14-0cff-4837-a8bb-840f87df187e", "comment": "Malware payload (Formbook)", "value": "60c109d13054650015d4967e4612a05be05a6f1687833dc944fa6c933ec83ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249338, "uuid": "4511da49-0ab1-4b50-b5ee-19efc37b8c3b", "comment": "Malware payload (Formbook)", "value": "7db187179ee05fe2e2cf2e5be2527346302e51db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249338, "uuid": "185c5835-ce1c-4523-80a3-13a0f6583231", "comment": "Malware payload (Formbook)", "value": "72d69377ff8aac2d2d25e7858824929a463e4c38fe84be39b4bdcf73660637b307603ddeb26fa48bc157e94d9e99bc8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249338, "uuid": "68755401-f19b-40a7-bf6d-bb06c932221d", "value": "T13AE4225572688727DCA8ABF15431C4F043BB7CAA693AC30C2DD57CEF7993B514A00A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249338, "uuid": "cc1117ad-92f5-45eb-91c6-1667e3248d08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249338, "uuid": "cf96893f-6bf4-409d-9cc2-7aa67d9ec9ef", "value": "12288:n9copox4NVFt5/5O22Y+3ND+P96Q1NGVCgj/O7DVXeHmyX3UNXlUdSRvS:WeH/OxY+096Q1FVXO0NXlUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249338, "uuid": "4125ea08-4207-4373-b532-dd36571e68af", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249338, "uuid": "54cdfd30-7094-4801-9feb-4af7403d1680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249338, "uuid": "e9445d9a-1a96-49cf-a682-4a1c7079b657", "value": "DHL_#AWB811471048477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ee6ee3-8eb0-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701260069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260069, "uuid": "f8a39ca9-5a90-468a-a64a-a029e8a21d81", "comment": "Malware payload (zgRAT)", "value": "95ee9a372c00b4fbb86fc4cab7af8739", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260069, "uuid": "4c7c2448-74ae-48c5-9e51-e2a78e3758de", "comment": "Malware payload (zgRAT)", "value": "62d9dc60aaf065ea6a33d95d6b62e20f4e1eeb704649155eff91874c226c31f7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260069, "uuid": "2c6f4cd9-313a-47fc-be2d-dd594639c38a", "comment": "Malware payload (zgRAT)", "value": "f34fddbaa40770e9975eeea78abc023400f0f944", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260069, "uuid": "90058570-8789-4fdc-b13c-0369f0074924", "comment": "Malware payload (zgRAT)", "value": "3ec521d11d794e39db3647cde74328837d075919d94f38bd2fed8fdab05bff0932af28c4939381b1f057c3e64045c1de", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701260069, "uuid": "360303ba-986f-4085-870c-d856a5ecc7f7", "value": "T10C85BE066B86DAEFE74D17F2909005942B75CD0AF1E3E76F4847A2A1ED833285D4B07E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701260069, "uuid": "e6c74de9-a2f1-47c5-b1ac-9c19de6adf7f", "value": "49152:hMxANAq8hkyQi0jbaJENy/rPcd+iOz8NVUyhKjeL:pbaJ2FrVUyhKj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701260069, "uuid": "b1353807-4b98-45a2-bdea-824c96f5f748", "value": 1770784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701260069, "uuid": "f0d37b5e-9364-4049-a747-c7473c9f2b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701260069, "uuid": "fb2b8451-c4c9-4695-a3cf-039c09835464", "value": "95ee9a372c00b4fbb86fc4cab7af8739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5cfc1fc-8ec8-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701270345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270345, "uuid": "6ccd0c39-f5d6-42b5-b291-8d7d77956640", "comment": "Malware payload (Stealc)", "value": "b45aaebc00c15eeec2bbed80ee98d08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270345, "uuid": "9d10f964-c55a-4de7-a31e-c139fc351bbc", "comment": "Malware payload (Stealc)", "value": "633482b19b6a22fd3ccf4913c6d1ac22ccf3272bf627ef5ae6dd2f49d1b90449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270345, "uuid": "53796873-e207-4ccd-a1c2-5e0684dbf063", "comment": "Malware payload (Stealc)", "value": "8060434053311a3a333a3230773a2d4b8cc3cee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270345, "uuid": "9725fda6-ce94-4000-b478-fe2efc44fc8e", "comment": "Malware payload (Stealc)", "value": "17547b2ae9bcf3ef1c0560aa87c1fbf77b2a8311667346a62834318a4fbb41f769873e931a6e40952970975274fbf3ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270345, "uuid": "9a886765-a933-49b9-be03-54b5ca680b9c", "value": "T18E3640A6FBD2D8ABE176C33C84A7111B55AB7CCB3980F54F500FB1022D212989FDA55E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270345, "uuid": "52b780dc-89b9-4758-a256-3701d93111b8", "value": "20b0403956cf314ea7b78939ce0c6521", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270345, "uuid": "3bcbf8a7-cd65-451a-9f0b-fa9a0899d3b5", "value": "49152:CVSYyiTlJ0hxmmnE3FvAddZXS0GvivyjNAqYBHd/iD5TK3fA10nz8jvjOOG+EKG:WifB3f38jbOgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701270345, "uuid": "a43f940b-5314-4ba4-95f8-423e68f3c1c7", "value": 4877824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701270345, "uuid": "c3f9ff12-3db4-47f3-8ec9-f60af21faf26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270345, "uuid": "ba1688ff-6f2f-47a6-9f56-9752ca39a44c", "value": "b45aaebc00c15eeec2bbed80ee98d08d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddff325e-8e56-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701221423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701221423, "uuid": "7627f139-1693-411f-9c83-b27b5c2681c7", "comment": "Malware payload (RiseProStealer)", "value": "05842edd8d0522cf4fcd1ea0b65285e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701221423, "uuid": "810771bc-3ca3-42d4-88c4-21945317b182", "comment": "Malware payload (RiseProStealer)", "value": "638656575facc006a9d08bf041b7a52b7e6473fdf66a5588201b84aa11b755ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701221423, "uuid": "4e2edea8-71fa-4b3b-9939-86909ca2e6c4", "comment": "Malware payload (RiseProStealer)", "value": "781105d8d4ec1a3a3bf688986c64c05992eb9f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701221423, "uuid": "bcac5dbe-82fd-43fd-a475-4969acd42902", "comment": "Malware payload (RiseProStealer)", "value": "19a7bcd83ae2967c2c42433cc27fd02b54da15877795101dd8e57f7edb10580ad1972f10b1935a725f0c577f6447df6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701221423, "uuid": "1e1131da-910b-4cc5-bbcb-a8903646004f", "value": "T18385239126DED022F4757FB454F30A531B39B8E2F6B0E3563709AD299D52280E1B2B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701221423, "uuid": "38eb51e1-1acf-4d4e-93ce-64dca5160417", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701221423, "uuid": "815e81d2-9854-45ad-9eee-ff384c8a157a", "value": "49152:T/GvPyALu0342PISRrJSmvusY4i3moxcSCj:bGvqsR342ZhiB1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701221423, "uuid": "5c194a03-4071-4f22-8475-ea5a1e134550", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701221423, "uuid": "43aef9ba-5b16-4b84-9eef-3e2995f2ed99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701221423, "uuid": "282381ab-b57f-47c1-827e-1236abe5a665", "value": "05842edd8d0522cf4fcd1ea0b65285e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd53acc4-8e9f-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1701252829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252829, "uuid": "5cd6baf7-5972-4123-90b9-c21e8025cb8f", "comment": "Malware payload (XWorm)", "value": "5c289ff4ed57a3ac15cfc78ae643ff25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252829, "uuid": "9e6fc1a2-0b96-4927-b697-9f3c15a40afc", "comment": "Malware payload (XWorm)", "value": "63edbe4f325e50211398663ab7efdf26e2cc794593b043b1be76a815ffb06310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252829, "uuid": "eac239d4-277c-4444-97c5-44e03bd5b7a3", "comment": "Malware payload (XWorm)", "value": "3f83497c1f38c95465edbecec7d068685b0895d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252829, "uuid": "a735df4f-e6ba-4f5c-9e65-7254f2a5abe4", "comment": "Malware payload (XWorm)", "value": "6a5a25b0240d1ae0ff31aa36fe269770418551476eddc6c9157acf652c073b69b05e9e40617c43634d63ea912a5af74b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252829, "uuid": "d889335e-e205-4158-82a6-ed9aabe14a59", "value": "T1B8035D4C73CC762BCB7D7B7E99F6014D53B5A2F31A03D34AAD8562A91D83BA14807B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252829, "uuid": "ff04c389-b231-45ce-af4e-8ecbdbc2c711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252829, "uuid": "c33b2876-f92f-404c-afa0-54e4210c4941", "value": "768:FNuIaOpxd+/z4Fkix6h38fyujfv5lOt3ZksOz8:rnbpOLrKy38NLOpZksOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701252829, "uuid": "8ff13525-406e-4642-bb83-6ce9e199bf85", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701252829, "uuid": "2b36ef34-6614-431b-b82f-03744c257ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252829, "uuid": "36d45b0c-5fa3-406e-a30d-bcc07d392dad", "value": "order90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89be578-8e82-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701240339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240339, "uuid": "26a15338-eac0-42bf-9dd0-90e9ad5501e0", "comment": "Malware payload (Formbook)", "value": "2a2960d0ad21925c20c2aede7aeaff76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240339, "uuid": "b3110af4-b4a1-4088-b84d-f99acd54c5f4", "comment": "Malware payload (Formbook)", "value": "6414d22bde2e1e36e1d822eff0abdaddd93e026af05b22149d759b9fdacdf75a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240339, "uuid": "8c2366c4-801c-48fc-957a-b1ab7afd7cbc", "comment": "Malware payload (Formbook)", "value": "90d3d04171f66e1540a5c746379dbd4d5d5c32a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240339, "uuid": "197cbc9a-55a9-437e-8e32-3de06d19e4da", "comment": "Malware payload (Formbook)", "value": "bf62084b26c4af9ef7a013d0d38be37dc7da5329a22021b48f785f76ab58fd15ee2a2c952cf16c7257e4ac59fa42486b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240339, "uuid": "5ebee212-4fa9-44de-9730-50b3eed90356", "value": "T198953313A3DC9123DAB42F7584BB46A31EB7FCA17DF0535A132398156822294EB7173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240339, "uuid": "50f90d1a-3c3b-4c96-909b-10a26caa704f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240339, "uuid": "47226018-6b6e-4c34-9cef-c5a157d19014", "value": "49152:L+KJFGOV/QySOcmThA48v7evwquEWskFHka6OL2rrhwF5e:aK7QyE+sEWsAkbOL2nhwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701240339, "uuid": "f4a30cb0-de32-4f72-bbed-8e24541403b8", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701240339, "uuid": "04b9152c-213f-4e8b-9741-f51022a1fe95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240339, "uuid": "3caecb4f-629e-4829-8d4f-a6b7040e7dae", "value": "2a2960d0ad21925c20c2aede7aeaff76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ad19fd-8e53-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701219928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219928, "uuid": "96a92d19-3283-4f6e-8691-08badc5a97b9", "comment": "Malware payload (Stealc)", "value": "8daeb676138ec7a6173f8cae4d9b5146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219928, "uuid": "c1fd3fac-e723-4cac-b88f-70ded045734f", "comment": "Malware payload (Stealc)", "value": "65bc094bc96a1963c31c2acd9a564cc0486dce8fcf23d6f69e09a4c61a2d1528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219928, "uuid": "eaf866ab-30fd-477c-b1e9-e8f2f5fb9301", "comment": "Malware payload (Stealc)", "value": "a06bf1709038a1b20d4d6144924e0341051ff999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219928, "uuid": "2e618344-c8c1-4046-8782-74986f135d9b", "comment": "Malware payload (Stealc)", "value": "62255f236429cea604b51e9c208c5601a106dd13bf7ab4db408ea453122c5b01fce9beba12288dea5bb8d74be4453456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219928, "uuid": "b25b6be0-98b6-4463-ae03-8b16b10df727", "value": "T1CE54C64382E13D44E92A8B769F3FD2EC770EF6918E497B6922199E1F04B11B3E163714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219928, "uuid": "77f56601-471f-4c6d-9af1-b9063a7c7766", "value": "29febc0919e45955d8257576c2c564a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219928, "uuid": "6007693a-efaf-407b-a916-7b10529ff161", "value": "3072:ndp234nKMyOiULJas8B7AhljHQJE5njQ5LleQ:EvMfi6KAdwJKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701219928, "uuid": "0afd9966-e252-434e-8c96-48f0cc534b18", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701219928, "uuid": "f550a9ff-cbd4-459a-a799-db854aeee63b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219928, "uuid": "b6554451-dc24-453e-989c-135390bd8126", "value": "8daeb676138ec7a6173f8cae4d9b5146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb3ef65-8ec6-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701269448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269448, "uuid": "16a60db8-9e6e-496a-93ed-346d174e6f75", "comment": "Malware payload (Stealc)", "value": "314202d1c41c9541a1c5579b45ad3a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269448, "uuid": "cb5d3878-c299-40d9-a950-259a5037beff", "comment": "Malware payload (Stealc)", "value": "67126ea123114450c7cf76ad268976944fa96565b334652d6e5b1248d1970f42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269448, "uuid": "f3641bfc-59b8-4d03-9bc4-4b79f4008d40", "comment": "Malware payload (Stealc)", "value": "b8d70a570876a584cd26c8c2cd1c4e43f416b287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269448, "uuid": "4153fd4d-5cfb-4b6f-8834-e585016c3462", "comment": "Malware payload (Stealc)", "value": "27cb672a6d7d8cafbddfcdaba39f6c22dd2af58c054d0e82da10cb8b0a5c53bb6980755c3f58e169382ab6b177a2ff88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269448, "uuid": "2ebebfd6-6631-45cf-8db5-a033924afca7", "value": "T1D934BE2176E0C036E12759394972C6655B3BFCE19B318ACB37A42A7E4E322D1CBB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269448, "uuid": "affb1b1d-61ec-4583-aabd-50b7e22071a3", "value": "df618219e8a2366147b60cb4a381a402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269448, "uuid": "a62872bb-72bf-40a4-8652-c36d16228634", "value": "3072:fJGi+7xic5KwKfJ54kxKCPDNYpOxNiKC2Wyexjk4BZLk7EyTxXWJ76d:RGNiJbh54kxKKNlxQKC2SjBS7EYC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701269448, "uuid": "685470e4-b1bc-4440-9b13-5162c504bc9c", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701269448, "uuid": "4f7a63fe-76e2-4238-a8fb-9306c802db59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269448, "uuid": "2db0e4db-1747-42d8-ba80-2c6532dd9bc0", "value": "314202d1c41c9541a1c5579b45ad3a02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e663a2-8f0e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701300321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701300321, "uuid": "e105a432-7484-48e3-a4c4-fb2f2eadcf34", "comment": "Malware payload", "value": "2b0d9f9a1ac794d88536831a3e156916", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701300321, "uuid": "d0c112af-f985-4ae8-88cc-f6b0c193b6e6", "comment": "Malware payload", "value": "672f42064edaf777423c28564d4699ba6d3a8ce7be6d2a077bfb2c56033d2738", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701300321, "uuid": "9e795583-7ad6-491b-8866-9ef8d7f51523", "comment": "Malware payload", "value": "5a459ff969093f3cd17dfaa7578a3cd10f633431", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701300321, "uuid": "a4f867bc-bd67-48ca-b1be-0ada9f77805e", "comment": "Malware payload", "value": "ca5b72c1545d6e78122c065e37914d5a547be4b927d8a96539f8459fc21e6be09e258ac7900e80f046cbbe9044f02790", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701300321, "uuid": "0219afd7-a714-4480-a337-bf0ace46ee5b", "value": "T1C761AF932151B8E9414287BF3D5D66F6807FC224924A6044FB8C4F9DF9DDE63398E6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701300321, "uuid": "42254a8d-d222-473f-a23c-20caa02ba514", "value": "48:N+MTLimb7ii4CHuKZ2hFN+CfBZL0HuQFJbhFi5QsvuiBrVxqT/sVCoZ:IGtSi4CHuS2hFN+CfBZL0HjmAiBrVMGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701300321, "uuid": "ee9d8a7a-8e78-4389-99dc-3469ede73c35", "value": 3221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701300321, "uuid": "b058c56f-6cba-41f4-90c9-5bba0183954e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701300321, "uuid": "3b920789-578e-4d18-b6fe-cf77aaedc7c3", "value": "UpnHvdKz.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69592ccf-8e63-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1701226811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701226811, "uuid": "06f7e244-fc12-432c-be66-0759629bbe47", "comment": "Malware payload (Loki)", "value": "9b3947ad2cf41a333ae68e023d150677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701226811, "uuid": "91d75670-9876-49ff-ae89-aa292813ce79", "comment": "Malware payload (Loki)", "value": "679c03f9666fdd722eaca13125aa58d142c02d761fc4b067b2a0eb1d3a8b9c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701226811, "uuid": "755f76f6-e45a-49e2-9cc1-5a8334ada0b8", "comment": "Malware payload (Loki)", "value": "89dd183cd0ddf37b1b7c9d6762200828fad6b7c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701226811, "uuid": "057e91a7-c38d-4fac-b4d0-38ad3e213dab", "comment": "Malware payload (Loki)", "value": "37024cceb22afbb4b7fdd7dcbe4530b0c2ea68c1f6470b016a3b7fa61b99a589b7be214c2dd622c925c318d509e0e2d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701226811, "uuid": "dc7fdc1b-e547-4711-aacc-88f6b9828364", "value": "T160D4155125500481C95F2D72B1AE83A2B13FBFBA595CB21A7A3AFBDE35F26C2C13114D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701226811, "uuid": "6f964624-bf8c-42cd-acc1-795c5130c1b6", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701226811, "uuid": "84f20beb-1b8b-4c8f-9b5a-e3baf695c254", "value": "12288:WmzqgYKhQgV+aq5ugmjxUAUJ8BplzkpSTf21:TYKhQgV+aq5uaEep221", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701226811, "uuid": "088cd591-8a37-4db5-b8c7-dd93146b34ef", "value": 602749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701226811, "uuid": "82892b34-0f97-482f-9281-a26c1863674d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701226811, "uuid": "7c4bb36e-0434-440e-8d1a-362714471c6a", "value": "AWB#9284730932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcad543-8eca-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1701270919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270919, "uuid": "ac7d6637-9c9e-4785-aae4-6f9b0fdc4f8e", "comment": "Malware payload (XWorm)", "value": "974bfe8206468dd65d2ffb0ee81baf65", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270919, "uuid": "55805e45-feb2-47f5-ae91-a5903c717914", "comment": "Malware payload (XWorm)", "value": "697dcf69689560f73d0b2d8eef4e20ff17a2fc55764ae36c0b349a38bb466ae6", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270919, "uuid": "bc2f5e2a-a0b9-4c7d-9384-3b99ed1103d1", "comment": "Malware payload (XWorm)", "value": "58da13c16c0ba922016e74b8cbaf748406f72d07", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270919, "uuid": "fd772c0d-3396-46ba-9d45-9fed870fcd3b", "comment": "Malware payload (XWorm)", "value": "3b72301246339c470955c709746c3b3108e197a684eb49fe265697af4703abc3be6ef578669e17dca1e1f8dac5c32ca6", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270919, "uuid": "ab6dc984-0f5f-45e8-bdc2-c8ecb38b3811", "value": "T105E2C05D0F1D7CE4F8505AB903D65940D39E3B322D903BE4F4636991E8CF588E1E262E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270919, "uuid": "2361659e-b3c8-4972-88f5-a803462d0a34", "value": "768:MsP7c+N94sjfy+7lAEqIntFTeI+gCjoit+fp00Pk5S+i25tLbDk0tQp:Mk7NN94sjKmGWnr7JVi8BWdnLb5t2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701270919, "uuid": "e0c9561c-f35b-411d-b761-9303c1561e69", "value": 31130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701270919, "uuid": "7878c1e6-f7b9-47de-b232-3eb768b5f57d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270919, "uuid": "7319c248-ba14-477b-95cf-2faf28934b62", "value": "linkedinsecure.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0291eff2-8edf-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701279896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279896, "uuid": "a540c0fd-375d-482d-912a-c6c9da5ce126", "comment": "Malware payload (RedLineStealer)", "value": "18fcba007799847120768b4e86307247", "object_relation": "md5", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279896, "uuid": "48b82bd4-fdb4-47e3-8761-d56e9e677306", "comment": "Malware payload (RedLineStealer)", "value": "69c551761dd5854d5a7dd7982f48f6f193336bdb72799ba8c53af5765c846d38", "object_relation": "sha256", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279896, "uuid": "8dccc5ca-29ab-4326-b97a-04589a22965f", "comment": "Malware payload (RedLineStealer)", "value": "2526e2687fb1a7939a93e4d64036ce6a2f16f9da", "object_relation": "sha1", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279896, "uuid": "bf7475ec-740a-4ae3-bd9a-cf70d9f238f7", "comment": "Malware payload (RedLineStealer)", "value": "2fb1dfc7042681389b383a73e9615f0708cc5400edc0aff0e0268e927064af225323a9a09ea0653a4784e82de86ca949", "object_relation": "sha3-384", "Tag": [ { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279896, "uuid": "1ab20e72-48a1-4825-bcf6-706fd5570e03", "value": "T138A533DEFE7E6A05431DB32D024F10C5BC03E820E7A85A4BCADF8295AB5B5F37115998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279896, "uuid": "69bb6fb0-98e1-45e0-8c78-2f9b7ce40a30", "value": "49152:p7Iqy7LR2asxvU+bi5VlzE0+tac6rJLnOAZuO0LxixO4vl:p89iZU+4VQvqE1N/49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701279896, "uuid": "39c1d8d2-cfb5-42ac-96e4-49dc8fff18e0", "value": 2134690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701279896, "uuid": "292a39ad-c986-46ed-8956-eea5fac46e1c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279896, "uuid": "744a726a-a346-49e0-9842-623edbe703d6", "value": "CheatLab.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71df7f4-8e8a-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701243665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243665, "uuid": "c4cab63f-7577-4455-b4b2-903cb85a3286", "comment": "Malware payload (DCRat)", "value": "2af6fedf71549dc7b2cfe9b9fc0b0f46", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243665, "uuid": "85f92686-99b0-4c87-828b-18278bb989be", "comment": "Malware payload (DCRat)", "value": "6bf5c2c4edafd90042653a48ba9b40573c05cc06ca6a753ae0433e0fe89e7247", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243665, "uuid": "6b456de3-315b-4a97-9337-dd5e7fac5f43", "comment": "Malware payload (DCRat)", "value": "6b627cbedc85199b690cd65f256126f245ec7ef3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243665, "uuid": "2bba9662-6fce-44e7-9b4d-dc3f78348c6a", "comment": "Malware payload (DCRat)", "value": "6f57c6e199ed35051299ea2a33e608bfa0adea091242a7cd8f2d4f62cf005ce5d3d4c496fe44f2fe1957ca100ee32487", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243665, "uuid": "4e36ba58-021a-49ca-8e82-ba7573a2757d", "value": "T1A4757C0565A38F73D2645B314697023D9295C72A3622FF4B3D5F31D2A90BBF18E622B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243665, "uuid": "c735914d-0e52-4510-804d-fbc73e842bce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243665, "uuid": "a04d91a3-468d-41aa-92c6-f8c3adfc6292", "value": "24576:7NQImOM3/QaaX2ik5q0o2ym2T2Dx0mimq0IKBGQLG+OCfjsNGn6IJo:7ut3Gks0bDbiyLGxmwGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701243665, "uuid": "35b81a18-0dfe-4697-ba0f-ca24ee483c7b", "value": 1640960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701243665, "uuid": "54a79b55-1474-456d-8e03-b35dd20c942e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243665, "uuid": "9ae9e37b-7db9-4ba3-97b4-9c33c31b53ba", "value": "2af6fedf71549dc7b2cfe9b9fc0b0f46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba46643-8e8e-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701245417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245417, "uuid": "facdfac7-ee4a-4021-9c69-8232820d1a24", "comment": "Malware payload (RemcosRAT)", "value": "95f31d6d932401a98331d69e5e818369", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245417, "uuid": "c9e6d895-98a4-44f0-a671-ce2beccbb40a", "comment": "Malware payload (RemcosRAT)", "value": "6c1357a59db122b1bf9fce73bb2dba136458d77bbbb1263137becccf9b6d0003", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245417, "uuid": "25a93203-f61a-4712-957d-3fa1eef49cde", "comment": "Malware payload (RemcosRAT)", "value": "82b22684a92e4c549c130930334f73ab67abf275", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245417, "uuid": "6d6895a0-8f4f-4e5c-9213-63daec73a147", "comment": "Malware payload (RemcosRAT)", "value": "b5946dcd32dbac063cfbaf8580e49ec38fb8cdce69783b602810c5c0d89ad95b2f400a5451bc7005cc2c08cd543a763b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245417, "uuid": "8f46ef21-5062-40f5-a7ea-4b4f807d1bf1", "value": "T123A152CC67D0754093BE0BB73F3720D1D688869B3F60969FA4828A686E51534EEC2974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245417, "uuid": "bc96f791-0051-47e7-8bc2-b2980f7ada2d", "value": "96:FWAL/Z6sQ7hHdxyta+RU7IS0tDkCCIykEmAGBTx/DdO5q3KPmEKm7hO5p3KPmEK/:TDZ7Wh9xia+RjS2wCCIfOGBTx/DdO5qB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245417, "uuid": "26b62e34-beb5-483b-b88a-25ad5c86a37f", "value": 4933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245417, "uuid": "11100a4a-52ef-4cfc-b963-40502c23b03e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245417, "uuid": "aeb2fece-7b03-4bc4-a157-4d0277ebdf29", "value": "pagamento_09.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905be21d-8efa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701291730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291730, "uuid": "18848b22-f065-4e25-bb08-c915bbc92a5c", "comment": "Malware payload", "value": "4799392d9450ffaf2569aa2827336dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291730, "uuid": "ff8a3c7c-00cb-4951-810a-bf64a67be681", "comment": "Malware payload", "value": "6c3869ec8c25cec454209f60a18b5a5cae2407708ecebc7f6be2734986dc499b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291730, "uuid": "5f412fc1-c83a-49be-a942-dce46a3de844", "comment": "Malware payload", "value": "2c25533d8323dff199c5c3b88dffb332b70c16db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701291730, "uuid": "64b69d31-103d-4258-97bd-d0e2ed0900ad", "comment": "Malware payload", "value": "6a8c061f6202ee6c3e53503720fefd8a834d4fe4085c973f315fca89aeeda85206b3d4fbd76b517085df3b0e1a8ff442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291730, "uuid": "3665a0ab-0796-4582-9ece-bd4a8fb86114", "value": "T11334C02176E1C033E61749B54961C6A45B37FCA29B7186CF2BE02E3E4E326D1CB75386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291730, "uuid": "9bdb165a-91b7-4426-996b-826823f3ad43", "value": "048b096be44b05bf4b925a53be1310a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291730, "uuid": "bcebf594-aaa7-4393-9c6d-a27df185229d", "value": "3072:kBjxKDkq4BShrXfl94Uxb/dtNyjXGNmIiFfCY4R/Lk79oi1SOa:ojrq1h7994Uxr1yjrlCYs4793N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701291730, "uuid": "ea3fef65-4b03-4670-9ef1-47c43539f07d", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701291730, "uuid": "60399b11-726c-4451-ad80-91e7789006fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701291730, "uuid": "878f1104-3aa6-4ebc-9f3c-89764034eedd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7205c15-8ebe-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701266133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266133, "uuid": "66cf2524-0ce1-4a46-b919-80e2538df13e", "comment": "Malware payload (RedLineStealer)", "value": "3d75e7230bf434ceff8710174ee115b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266133, "uuid": "fa9eebcf-f78f-4292-8e7e-796f88fdff01", "comment": "Malware payload (RedLineStealer)", "value": "6c4aaf39142db9f2d3adc6f3a90d986a55fd54273be564d61a4cc229e55131af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266133, "uuid": "868366b2-ba75-4b47-a5fe-47c4263f0e2e", "comment": "Malware payload (RedLineStealer)", "value": "6db9c713d70d8f3715db9ef4139669d8d110c4e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266133, "uuid": "6ce243f6-9162-424f-a136-16328cefd688", "comment": "Malware payload (RedLineStealer)", "value": "7edfb4f23e72bb45f962264eae5fefcbcea0315ca11fd25befb9cccb0e951ae6c6d30ce0150c3557b65d0a21d73187cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266133, "uuid": "e7ee207f-47e3-43b8-9f3d-1ccb1345c782", "value": "T149548E0676D2C4B3D523123209E8D7B95A3EF9110B5189EFA7A84F7E8FB13C09D31969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266133, "uuid": "a79feb67-f5d5-4c2f-b8fc-fcdb34337c4d", "value": "87d552636d31eb7a2797c4a63e862d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266133, "uuid": "a783f337-00c1-44fc-8c32-53ceb0555a79", "value": "6144:vyU1zKCKVDp3Cbitu7gJzmgkYUDBg8ZHAO0Jb8CuZoHI66G:vyU1K9pv6RZH2nuZn66G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701266133, "uuid": "ed39166f-87b0-4c69-b208-e646bf2df879", "value": 292128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701266133, "uuid": "15c55ed5-72c4-41f7-9abb-6333d501174f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266133, "uuid": "f89de04b-8033-44f4-adc3-78ae5b64a046", "value": "3d75e7230bf434ceff8710174ee115b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79316b0-8ef2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701288441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288441, "uuid": "5ad98298-4e89-4b69-b97a-fae89030b138", "comment": "Malware payload", "value": "44cdabc186e152a184a431e594d4345d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288441, "uuid": "3381328b-7e07-4a30-b17b-cfa4312a606d", "comment": "Malware payload", "value": "6ceec6de713d24950e651cddb2ad1c6103e392160623a94a62f9b42f77c58d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288441, "uuid": "3309c0da-6aab-4f3d-8a02-4ef91d937164", "comment": "Malware payload", "value": "d4a243dec68f05e972a7ac73111545d42ab5d9b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288441, "uuid": "8625ee91-dd8d-401d-ac40-a9dc68909195", "comment": "Malware payload", "value": "e433d219785677ec4fc716165397577016e05c2217b31e85c8d6b7488427e6c3c8eb9d845d15b9fe36a0208f0b36043d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288441, "uuid": "175a6b3b-6d68-4822-bffe-c68df247fbcb", "value": "T12B622909B3EC4339C1BD07BC0DB242256371E5A39A62D71F1CD890FE8992BD55B60BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288441, "uuid": "8e26046e-ed77-4f59-85b7-ad7ec694492b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288441, "uuid": "428a283c-ada6-4993-8383-866422d5b8c7", "value": "192:K+8C+EKS0O9ejYTDG8bcp4LlzKnieXubWyD9JEBkGxVXfqoNJRJw:KNVjYTDG8gpaReXTyD3EnxMoN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701288441, "uuid": "1e9cfa59-45ec-413d-b75f-7e8cda7dde9b", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701288441, "uuid": "5693db2d-0cdd-4d22-9ce8-6cd526d85389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288441, "uuid": "2f9515eb-6d58-4e54-9454-8fd05c3a0619", "value": "bRZe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ede007e-8eb3-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1701261180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701261180, "uuid": "f3b479ed-0fac-4f50-982a-9e58b1175405", "comment": "Malware payload (Amadey)", "value": "0b49a65179808bc95673fb714d14f0e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701261180, "uuid": "882eb7cc-7dbc-4a1c-862a-6d3d4ab8a16e", "comment": "Malware payload (Amadey)", "value": "6d74bee51b9f6bc06a3593599b76c620c9dac5fca77b91373687a86eeba60fc7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701261180, "uuid": "77515f0a-286d-47e5-ae2f-81e88cd6c862", "comment": "Malware payload (Amadey)", "value": "1f4bcfcef2868cc17908c09bf2dbdd8899a0bc88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701261180, "uuid": "3b331e2d-2792-4319-9de6-385970443926", "comment": "Malware payload (Amadey)", "value": "c1bcb98a889e351a06673cff7b8217812f62d9e0c8b0fef699c2dc596f74fe0ec4e4770f0ad30cda797ca52eab57cecd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701261180, "uuid": "3aa6082d-4400-4c4b-9b99-e585d2f70ed8", "value": "T19584AE12A3E16861E5264A33BE1EC6E4675EF9A09F156B9B33146F2F09702F1C273707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701261180, "uuid": "def2db32-a0f2-4b09-8f4f-56f9f92576a2", "value": "dd8733c9fb234680fa3734e11c254b80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701261180, "uuid": "a7f3efe8-9eaa-426a-9567-390c31ad24ca", "value": "6144:iTsyd6JNGmx4yna7cC9HtXCv1fTO1sh+vDoEec0V+Bkx8:iTsHKyna7cCzCR1EUo1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701261180, "uuid": "743d5fb5-9503-4df3-a183-6a18e1651abf", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701261180, "uuid": "60e37400-ddf2-4e13-ac6a-eda55ca71c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701261180, "uuid": "9dad94dc-b503-4734-8b1e-5f9ecb11cc46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c87e7f0-8eaf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701259404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259404, "uuid": "5e0a64b1-ae6d-4290-8823-fbf02c4f2980", "comment": "Malware payload", "value": "6089ab4f09c4746b7089ce833a48f147", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259404, "uuid": "655b8c94-5d13-4739-b7e4-77dda8aa487a", "comment": "Malware payload", "value": "6ee85957a62c6cca7500d4b1a5c327c2d2ee118035a032d22e101535d048cdd2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259404, "uuid": "82a670c1-fbb9-4704-b809-f4e9d8eb773a", "comment": "Malware payload", "value": "3c5a74f406afab819c6e30252963c58abb3eac8c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259404, "uuid": "19240b1c-2809-477d-b0ea-1f899bb2a10a", "comment": "Malware payload", "value": "a6670e9018beef08467224e7688ac9c5aa1b7d898c78dad0f285e12754ca22c5f353d2757c71dcdbc07f16b4d8fe66e6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259404, "uuid": "2d1f5353-0d20-4399-bb7b-4afee0931538", "value": "T175B3796DC34F02A98F525376AB170E4442BCBA6EF34552B2306C533533EAD3DA1662BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259404, "uuid": "b29e3df6-18ef-4e3d-a086-92411b876b5f", "value": "768:ewAbZSibMX9gRWjHuJ8bVHfTH16vWpiTzXTq+cwpJjWK:ewAlRJJ0HfTV6OpiXO+ffqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701259404, "uuid": "c64a7709-81f9-4954-a8a9-ffbf72064da4", "value": 112416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701259404, "uuid": "68185c55-4e30-4671-b8bc-136a3fe0d9d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259404, "uuid": "9d5b4f6a-93d3-433f-834d-cee377f8c49c", "value": "PL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480b77fc-8e99-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701249948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249948, "uuid": "89d6b042-1fc7-4a54-904c-bd6a6223d817", "comment": "Malware payload (AgentTesla)", "value": "912d05ee8b0d3208218642b141525b3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249948, "uuid": "668c4dac-7dd9-4c74-a1c5-a448b363ee39", "comment": "Malware payload (AgentTesla)", "value": "7272fdb494fe22e1dd40bea63970c10aa9f42b540646cdd4bc35a9a10081c502", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249948, "uuid": "f2004612-cd9a-4d78-88d2-fde897ef6cc9", "comment": "Malware payload (AgentTesla)", "value": "93ca44de47e206b42c0b7eb53505ab2adac3feaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249948, "uuid": "56eb0b8b-b4ac-4013-bb2b-158f4e7215f6", "comment": "Malware payload (AgentTesla)", "value": "94ac114d7c9d3574491f81f1d56ddec2b20e86827528902db119213a5bccbe869a1e0c30d43ce4a369c9ed26ed236dcd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249948, "uuid": "fe64eeee-b8a3-4a18-a6f8-a86dc7ca282a", "value": "T106E41245738CC326DD7A67FA2520D8B003BAFE562271E68EA9D72ECFB9537000651B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249948, "uuid": "b654174f-24b4-4cb5-92d2-5f05402e2c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249948, "uuid": "354caa25-1771-44fc-a672-7ec810e6e846", "value": "12288:KnCCCCCCC8CpCPCCsCCjcopox4JzGUF5CSwmZ3b7z+nAXzgoFehM3jQDVZFMAKwR:8CCCCCCC8CpCPCCsCCgeEK5QmZ3b1DZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249948, "uuid": "0d01c339-06c7-46a0-8017-348cca591cff", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249948, "uuid": "acd081f8-8046-4afd-95ae-d37bb3fff9b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249948, "uuid": "565e5a07-a554-4c3e-b727-a347ad2e3de8", "value": "SecuriteInfo.com.Win32.PWSX-gen.26567.23522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36acc30f-8eb9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701263663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263663, "uuid": "4d95edc7-613e-465d-b2df-c416fe5ac735", "comment": "Malware payload (AgentTesla)", "value": "e345a30e01818d9f08e83643f4a20793", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263663, "uuid": "642aabc0-212a-4378-ac7f-a0f302f7883f", "comment": "Malware payload (AgentTesla)", "value": "72a66d93187133f361b4743cdc36da80fd5924a621eacf1161ff71601b98724a", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263663, "uuid": "eed83166-945f-45e0-862b-563c736c5226", "comment": "Malware payload (AgentTesla)", "value": "84413f4a61b9d3486caa14718c1876a5e620a54a", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263663, "uuid": "a822c404-555d-4cf1-a523-b32e066cf9f0", "comment": "Malware payload (AgentTesla)", "value": "7d95f4856af4ff6d9c42d1c75767570ee49885a5d7b6b2fe933c8671fe1af651dc39ca1cd6d504ce7f7f8fe422e0de55", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263663, "uuid": "14a8f64c-6619-4d12-b681-a99d49697fc7", "value": "T192E412A9768CD672ECB923F01831C47153367DA929B7C64E6DE26DEF7C633004642A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263663, "uuid": "54dbb062-910e-4569-8db7-6b9546d7289a", "value": "12288:HZ3copox4wwSy1npDKEpQzI6T/0TlinhqVmWRi41vwulX9pDw7Hqp0/cHL:5se9SCnNzGI6TGl2qVmM11NlX9tm/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701263663, "uuid": "75e8f8cd-ecab-4a8c-ac25-20279dd48b9d", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701263663, "uuid": "b5c089cd-6ec0-4679-bd56-da6812460c36", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263663, "uuid": "67a6afb2-00b7-499d-859d-d38bc42990c0", "value": "Shipping Documents.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecce381-8e7d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701237933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701237933, "uuid": "eb56029a-389e-4134-8bc1-0a4989ac7a2f", "comment": "Malware payload (RedLineStealer)", "value": "16c3929390b880eb36aa4d3412a7130f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701237933, "uuid": "94b3ec30-3675-484a-ad17-0cef91de83f6", "comment": "Malware payload (RedLineStealer)", "value": "730da91d79807f62ec1353624681856dc3e5b60740c409649d0c57c891f83715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701237933, "uuid": "d9ce50f5-80df-4201-aa0d-d6d117f4e0e9", "comment": "Malware payload (RedLineStealer)", "value": "c6c36457ce8782b633b2f7d1658f73662d1db465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701237933, "uuid": "66fc0f45-31ad-4afa-be90-6a453e265d77", "comment": "Malware payload (RedLineStealer)", "value": "8d8b7d28182f1883dbced5a0d093a0f871ddf782379ed0093e863fe912988d32a0bc890ebbc4468f62ca0e410a60adb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701237933, "uuid": "da6d3481-3c6d-437b-92de-40e6bd07ce9e", "value": "T1F29523629BC09083DFB44BB084F71AA71E397CB1BA70D1BE15068D4E1E235B1567A72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701237933, "uuid": "b40a590f-3795-4106-a799-1d9d63c6a47f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701237933, "uuid": "be252bbc-0276-4fc0-b8af-d1afbb86b8f9", "value": "49152:1NPLfNoqSg6gdORuZgjeN/IvjYdsNK8wRtgw6el3:HfNXSg6FNrY5tgwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701237933, "uuid": "1a7f4070-4236-48e9-b822-d6d94e879f75", "value": 2023424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701237933, "uuid": "0058f436-198e-4542-9f41-09985c93572c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701237933, "uuid": "849c4e61-2bb3-48e5-9bf7-a5975030b38b", "value": "16c3929390b880eb36aa4d3412a7130f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e8c2fe-8ebf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701266217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266217, "uuid": "89874563-294b-4a29-a672-1517e2af1ae1", "comment": "Malware payload (AgentTesla)", "value": "a40f7b5da781ef32a8eac1b3e2a976c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266217, "uuid": "be179d1c-d6e2-43fd-9dc4-902e17f5c572", "comment": "Malware payload (AgentTesla)", "value": "73d6fc6dee2f45c63d3bf49027640cbce2af5089cc83a79d9e9cf68ff32607f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266217, "uuid": "e98b992a-cdc5-4cc3-b5c9-83f2d88e24ad", "comment": "Malware payload (AgentTesla)", "value": "5d57240d181e3c4b1de953d131de9ae4a0fc48fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266217, "uuid": "06bf0088-3e14-44ab-9c5f-4db81707ac29", "comment": "Malware payload (AgentTesla)", "value": "bc21d3c5050ee1c928acf3150736ed8af61a0ef2e6861606ca538920f2b4007d71c8f6c6c9d41c425a24969eed39a17d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266217, "uuid": "8a727816-a32d-4bce-a3e3-c7396e6d429a", "value": "T156457D0A7787C9BBF35D1AB5905008687BB6CD4E9153E3AFA5056BF0FE83328190917E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266217, "uuid": "76430b55-0a27-4ce9-859d-4f8a294f1522", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266217, "uuid": "24ec1f22-ce8a-4d51-a50d-444188eee13a", "value": "24576:hMVArAD8RkhQ60NFDoUup2Qf4xTmu63plqIU3KGji5ATkTDf:hMVArAD8RkhQ60Qn41s3r6FWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701266217, "uuid": "89364071-0893-493d-bfe7-4d8e0c6801dc", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701266217, "uuid": "e9385df3-82b1-4332-ada9-3904f1ff4403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266217, "uuid": "365f1cd8-667e-4b89-897d-b32d48ad0f2a", "value": "Inquiry for International Purchase.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0152e939-8ec0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701266580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266580, "uuid": "71e6cc40-2e4a-4835-868b-9a7091d2684c", "comment": "Malware payload (AgentTesla)", "value": "f99b7fb8082599e517ad13eaaca07e99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266580, "uuid": "d92ef208-da36-4b28-bf1b-0fc5f672c771", "comment": "Malware payload (AgentTesla)", "value": "743cee9f792183d5fd59545032be87d34956cc62b69bfc5503c8b1373866e01d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266580, "uuid": "9e5a714f-fba3-40db-bc72-a1af51fc5d78", "comment": "Malware payload (AgentTesla)", "value": "71f5bc9b019ea8575c7f83dd6cf923d8e3209311", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701266580, "uuid": "2a7ce449-978c-4030-ae3c-97352d16405d", "comment": "Malware payload (AgentTesla)", "value": "8f902930b770ce1be734d4d83d96a92628afe5d3a70ada601e4fff6c54d782f58771037cefee42312ddbe7923fcf2b00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266580, "uuid": "2202b229-513a-4a1e-833e-9fdd442e70f5", "value": "T1E4E4224A269D8B22DD6A57B6B272D87003F7BDA72977DB4D2CD92CF739177000901A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266580, "uuid": "5ab1e4c2-85e5-4781-88dc-75052d6b5326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266580, "uuid": "bff5fff0-cb23-4f05-b84c-cb493955f919", "value": "12288:5qCCCCCCC8CpCPCCsCC/copox4N6vsXU0n/mmTvB1YFv00RNlRuPdBgTt61m2xfh:YCCCCCCC8CpCPCCsCCkeB6vsXUqTvmRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701266580, "uuid": "eeb9a1e3-6ea5-4c09-93fa-0279d3780ec7", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701266580, "uuid": "5dbc4f5f-683a-4a45-b6a7-719695d93423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701266580, "uuid": "eecc0051-2859-4d14-b10f-f54fc41950ae", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ff84aa-8e82-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701240031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240031, "uuid": "8678520c-21b3-44e7-8ebb-b6a1aa5a6bdf", "comment": "Malware payload (RiseProStealer)", "value": "2f810097a61bfc09eab1c32030314a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240031, "uuid": "b9db6150-2d6e-4ae6-982a-407e5a39a24d", "comment": "Malware payload (RiseProStealer)", "value": "74e7aa1e29eee9cdd26bb113031cad7d4a3b11b40a4ee72f9408626d35973a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240031, "uuid": "1c1a1483-5b8b-4a22-86cf-16b16286c3ec", "comment": "Malware payload (RiseProStealer)", "value": "337aa15efbab3c148a3ef2fe0a433f180108943d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240031, "uuid": "52e9ce77-5f0f-4f45-8d9a-331625ac2f9a", "comment": "Malware payload (RiseProStealer)", "value": "3379e33f38006fb6d578725952eae6e4cb78a75d54a1d2f9d1db0af5afc8881354895cf26f7b6228776fdfac6163e73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240031, "uuid": "13c51ef7-c382-4256-957e-c61d889c8065", "value": "T15195331152FEC453DAB03BB088F393BB1A357D92BA78D7D7479A69084D62294B13133E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240031, "uuid": "03da52cd-bc7a-4634-b539-dc9de49ddbb6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240031, "uuid": "dbfba46e-9b5d-4d66-8102-fc8cd50cd586", "value": "49152:alCcbircVjdQsBLphlXChvhtufg0Njw+Ub5a1S/9vDY97ib:WccVj63Zt6gqj3sa1S/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701240031, "uuid": "33c1b683-b6ab-4812-b505-86f0611528e4", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701240031, "uuid": "42877992-506b-49ed-b9be-5dd75eaf8bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240031, "uuid": "68c58b9a-429b-4a52-9ff5-08ea810be58e", "value": "2f810097a61bfc09eab1c32030314a8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc401bc-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701283166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283166, "uuid": "00749bff-20fe-44bf-8d00-b87a40e587e6", "comment": "Malware payload (Mirai)", "value": "0452bbc91e17b997b1875c8908a0cc95", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283166, "uuid": "b93c95d4-76b7-458c-be41-361c9ad56605", "comment": "Malware payload (Mirai)", "value": "758b5bbabf6721af30d6e9452cf4160120fe631c1ec13f99b40437adf39fc9f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283166, "uuid": "f7a2ba45-615f-4bbe-8d9c-af192b18a8f9", "comment": "Malware payload (Mirai)", "value": "bc50cfebf606fce655b49318ffd76b2243fb5fa0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283166, "uuid": "f61b02e2-b10b-4860-a4ca-37bb8bc84900", "comment": "Malware payload (Mirai)", "value": "94b8c2c9cb4a9265aa6b2fc58ac0d10c7aaa5568fa10f4a2d4bdbcedf0b0204dc0e04c2dff09dd78edea83450c57286f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283166, "uuid": "0f8608d2-ee14-4e12-8110-aee6b92b4b33", "value": "T1B804D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283166, "uuid": "a614725b-9dfc-4092-b50a-1657f0844630", "value": "3072:ueEksFM+wX5OSaVR8H3NaMZOTTMJxt9U+7fKbvE:ueEnO+wX6VWdaMATwJHy+uD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283166, "uuid": "fed31c13-d32d-4d80-b77c-259357aa0064", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283166, "uuid": "3c401504-9b95-4ca8-b7bd-ac01a848888f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283166, "uuid": "ed6faff9-cd68-4158-abc6-ccca7768884d", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9d0402-8ea1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701253663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253663, "uuid": "a433ce18-3a43-4c31-9606-7e0a50239a6b", "comment": "Malware payload", "value": "d12150111da67b2eaa9014b431812001", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253663, "uuid": "d565e0a7-760f-4bc3-ae73-357c54eea528", "comment": "Malware payload", "value": "75a7d09c3e46f2dcaab69eaf721a645c03cbfe83b10b1f19724d9a40a0af9868", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253663, "uuid": "66ff58a7-4ca3-429d-b585-1c56b969e2be", "comment": "Malware payload", "value": "e1704782478abf8168e8247ae7b02f519b0c70f5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253663, "uuid": "ae018542-b1a7-4b2c-9347-9324a6c4015e", "comment": "Malware payload", "value": "e5b07536457983545933d5c90d52cf0d43fee01fdb2f3a859064be89b6543543139340441aa64c9e17477476fc88fed1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253663, "uuid": "08301686-464e-4846-969b-7f20b0f59dfc", "value": "T17C138412B7D6AF26E22326B499F3C295B329BD049FB6871F2198371FBD720701D42725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253663, "uuid": "d478ddd9-9abf-4eb8-b651-fbde8a96c1b3", "value": "384:naa8o6b8RjdT6OXvwZ0Y7hCBEj9SFZu60uw29EPSmRqiOe6giSwvxjk+tQxo6aiI:naa8o1RR4IEj9SV3iSHBeOxw+tQx9a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701253663, "uuid": "8bd5adc6-9160-4d54-a69d-19044d6ad046", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701253663, "uuid": "0d30baf4-6f03-4cfc-b1ef-2b1dc302d83f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253663, "uuid": "0a87deec-cb2e-48f0-b4cb-91fade8cf32c", "value": "VALLEY BLDG IND INC. CA. 2 .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75e81e6-8ead-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701258778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258778, "uuid": "f45a3458-cd94-4ca9-a07d-1776241534f4", "comment": "Malware payload", "value": "d58c4b3ac1fb1225f9d4789b7b3a2d27", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258778, "uuid": "a04872a2-571a-47f0-bf15-cfa5ad36598c", "comment": "Malware payload", "value": "763e89b91bab5ede21120845b8d684421a53ce5e76e6c6482b81222057a4d3ef", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258778, "uuid": "ab6066ab-11aa-4cd6-b379-960475f9369e", "comment": "Malware payload", "value": "686d956480d0eb5fc347ec7faaee498d630f1d84", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258778, "uuid": "d82dacca-9c1b-42e8-a900-b70af68b8936", "comment": "Malware payload", "value": "f895809200b56ac518ce210b27949efeca6bb7b22853c4c581caa4e1455175f86b7e130641ccace07704333e81834516", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258778, "uuid": "e6a73133-fcf7-4ca9-a44f-852f932560aa", "value": "T1EAD3892DD34B01A98F629337A71B4E0586BCBA2EF34551B1346C43B533EAC3D91666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258778, "uuid": "6e5f5849-6837-4db5-8667-140cb667229a", "value": "768:8wAbZSibMX9gRWjdVwqWth+vKW/OG/V+umtgozUmS+kDcngqbpyic:8wAlRUVwhzQJWG/V+5/Umpngq7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258778, "uuid": "d30d9b88-1710-43ac-addd-ee10ea330a2f", "value": 141294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258778, "uuid": "4c85fddd-494a-4f00-8dd3-f69f65697813", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258778, "uuid": "6affb0cc-bd20-4c37-abc2-c598a3d2fbb5", "value": "PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104eb5b8-8ef3-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701288509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288509, "uuid": "054be23e-e652-420c-b93d-7abd7b6c6210", "comment": "Malware payload (Tofsee)", "value": "52646ffb452eebbb52671e33e44abdf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288509, "uuid": "dcb8bd6d-a3b3-4307-8d9e-5212a6376d3e", "comment": "Malware payload (Tofsee)", "value": "769d4788c5326bd11e89586fd6624ec14bd0d1af52568f74fbc4450c89c7f3c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288509, "uuid": "405de1e4-52de-4005-948e-de97908872cd", "comment": "Malware payload (Tofsee)", "value": "b5ead6c60707f0c428059c7998f998ed2075a113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288509, "uuid": "07f3793a-59f5-4f74-b779-a2b32807c18c", "comment": "Malware payload (Tofsee)", "value": "5e365f55a01b405fad56b31828d6be3a1a1d67df8cfafbbf5758579c396cbf8a9e53cae18f44154df67a3f536b580b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288509, "uuid": "67ed141d-d71e-4abc-ba91-b9f7dbbd6c82", "value": "T13634B02176E1C033E12759344A71C6A55A37BCA29B7186CF27E47A3E8E316D18FB9307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288509, "uuid": "d5ba4a96-a9d2-4e2c-96f7-c49e23ef272f", "value": "eebe007c35cdacb43a780348e45aefac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288509, "uuid": "0efc3440-838e-48ec-9fd7-1f4f5ce8b8b7", "value": "3072:brBwY2AF5h62pI8HS49XpyMzYUr8gAX8c++6qX0Trz251kQCC4NTY4uHpr:Zw65DqOS49sMkUr8J/PX03zC1pya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701288509, "uuid": "6121da60-7dbd-438f-82bf-cace551dbbd2", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701288509, "uuid": "de3264af-da6b-4ce9-8042-0c875aa886a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288509, "uuid": "16d6d364-7c0c-4ff5-b945-53fb5e77a0d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54188b2e-8ed8-11ee-8907-42010a9c0042", "comment": "Malware payload (Kinsing)", "timestamp": 1701277027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277027, "uuid": "ff5cc690-b116-408c-8c08-4893317e005c", "comment": "Malware payload (Kinsing)", "value": "b3039abf2ad5202f4a9363b418002351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277027, "uuid": "54ef6083-4699-4a91-8ff7-f55725afd65f", "comment": "Malware payload (Kinsing)", "value": "787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277027, "uuid": "dc2b914e-950d-4492-9e20-51307fa3347d", "comment": "Malware payload (Kinsing)", "value": "0ceb8ffb0be23b808b534d744440f4367e17b9c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277027, "uuid": "c6549331-2a0f-4183-8950-8cfe329aab04", "comment": "Malware payload (Kinsing)", "value": "3f2d8004af8700aec223d489b696d83595ff3df4d15751c3da2a325e9a4e86ce095acfdb51939d8272e1dc86165c1d73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277027, "uuid": "7a0a880f-7212-474e-ab09-aa0d5975709e", "value": "T177564903F88955E9C3AED538CA659262BB70388A433023D32B60E7B51F76BD56F79350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277027, "uuid": "f8557e89-077d-46bc-be7e-dd634fe4bd55", "value": "49152:wCe/ydXZSrb/TJvO90dL3BmAFd4A64nsfJvaWi9sglz/KbwLjFfiawr1eAOkzDIK:3eidO9suPF+NL4FiBnIrb3rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701277027, "uuid": "1fed4052-2b0f-414a-94fe-cbaf4b0f56ed", "value": 5967872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701277027, "uuid": "46835943-4338-492d-86e4-0d8993323826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277027, "uuid": "032c867d-9d2f-4009-b57c-621e8c7e76e8", "value": "kinsing", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c141f620-8e69-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701229536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229536, "uuid": "0a65d81f-2191-4808-91a6-86b3c6aed7fa", "comment": "Malware payload (RedLineStealer)", "value": "697f5557761a4b9c0af4a042650c51e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229536, "uuid": "02e658a3-18f7-4c20-bb1b-15fba1c3b4cd", "comment": "Malware payload (RedLineStealer)", "value": "78de43325deb7060aa90f6c5ca1df33beb7d1e804ed96e74784f36727e6dc83b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229536, "uuid": "b8d4578f-5276-44d2-9f03-851ebe7025ad", "comment": "Malware payload (RedLineStealer)", "value": "c4aff4790440bb9c6062b81b9f8f820c907b1213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229536, "uuid": "d3653531-af13-4492-89d4-1dbcdc443443", "comment": "Malware payload (RedLineStealer)", "value": "8163f1f96dc060888c79710c30d3531687a0156f2c06eb18f0a71e6ef4a4eec64db7cd6594961b8feb7f23b9282e99c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229536, "uuid": "e5ec34ef-f4a2-40b7-9f4a-12e51b4d8977", "value": "T1A3953351ABDDD026DDB11B3848FB6BE30B767891ADB0421B6F876D4A7841BA0187073F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229536, "uuid": "4a8b3878-6210-4d5c-a0bf-1e1e897e5d9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229536, "uuid": "6af31abf-d4ce-4e1c-a607-7b5e28e5718a", "value": "49152:t5AKJl47BPNIh9OG+XaCAM4vVepMPiJaIs2bZTsEHJRXiM:HAuIBPNi5oaKJaIVbZTsE/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701229536, "uuid": "7c7145e1-378d-43fb-9a1e-69ab533020b0", "value": 2024960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701229536, "uuid": "d5b14f71-237c-4371-ba93-3413623b72bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229536, "uuid": "bf11f537-efa3-49b5-bcf2-ffeeb65cf937", "value": "697f5557761a4b9c0af4a042650c51e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2455c68e-8ec4-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1701268356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268356, "uuid": "bf97b326-c9c5-4fec-97f6-e19c0d4ad9d0", "comment": "Malware payload (NanoCore)", "value": "a2e15a15841102aaa128f682ec572b41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268356, "uuid": "36cd6c54-76d3-494d-872e-c75016b4fa3f", "comment": "Malware payload (NanoCore)", "value": "7a2f9e411b75bd3fff4de3eccade17a7c72c810cd786145239ab21950e761aae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268356, "uuid": "934b6f30-35e4-40c6-8934-1d6e0b4854de", "comment": "Malware payload (NanoCore)", "value": "f40dfc3f94abad4f63010239d7a55f164d74d073", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268356, "uuid": "203f88a2-150f-4850-8b22-c3db89183b75", "comment": "Malware payload (NanoCore)", "value": "55ada5d11dd41a87cda8bc8a6dfa1890107b0cb2db8d4e52f324e0d0f56d908b2f900d67c289b70347f3d1fcb7959395", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268356, "uuid": "1bf9c250-6703-494e-a279-e46ec6dee2f5", "value": "T145D3786DD34B01AA8F5253329B1B1E9442BDBA7EF38611B1306C437537EAC3D91292BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268356, "uuid": "e1844f0b-ded1-4f70-a121-5ca5ee87358e", "value": "768:4wAbZSibMX9gRWjsU67VMS9E3uIagPFEbZLIQATaj17nQ:4wAlRvUGnE3uIa0FuZmuj17nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701268356, "uuid": "871b2c93-b5c4-4cb2-a117-2c3186606478", "value": 139578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701268356, "uuid": "cab86b69-92ed-40c9-b02e-988ce41eb77d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268356, "uuid": "43ca2454-73ee-4a0c-9866-11a997839562", "value": "PI7812367813.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126ad9d0-8e8e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701245134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245134, "uuid": "2566c5f8-be72-424e-b812-9246f662006e", "comment": "Malware payload (Formbook)", "value": "2d76563abb155e455dcf98402aa934a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245134, "uuid": "3555c881-a550-4903-8703-ed3c1d943213", "comment": "Malware payload (Formbook)", "value": "7add5ce3875b472f3faa3357a71e205a9e68979e15a18f41c383f47518bfa276", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245134, "uuid": "32d5c15a-2f62-43d5-945a-24f051f617e0", "comment": "Malware payload (Formbook)", "value": "496b811f1752252a97a45f8791fda66a09f1a8f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245134, "uuid": "d3d8b907-9b9d-418d-94a8-2e1ccf0bc72e", "comment": "Malware payload (Formbook)", "value": "77d9e57bda089b8bbbfd40220255ef0812108f49c745494a43682e178c6045b2f08e8c211384188e8e3e1860a673fe0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245134, "uuid": "5428a94e-03e1-4ffe-b964-01fba9564618", "value": "T17745230BB9D8D437E8F057B0A4F34AE32775BCB2997D03361651E52A0CB2A86653172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245134, "uuid": "53e94d68-f800-4a61-b397-cce367dc99b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245134, "uuid": "369766e7-80b3-4514-b13d-6409e388c4a3", "value": "24576:DyCGUHil2LfVa0ghQUQuEuwdyDgmCmxPn5c46gno8lSzHVeayd:WC9ClGfVzghQUQu5umxPnxv9lSzHVea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245134, "uuid": "e9285c28-481f-42ae-8c52-ad1bb8d559f1", "value": 1218560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245134, "uuid": "25b73474-9aed-41f4-a63f-bc8b44eb8ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245134, "uuid": "a1f1b055-6713-4e64-a20d-36dbb736b3d0", "value": "2d76563abb155e455dcf98402aa934a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bddb0e-8e54-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701220520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220520, "uuid": "14c549b7-43d5-41d9-acab-ec2118ee05ea", "comment": "Malware payload (RedLineStealer)", "value": "c92066122188b2f61f5a5e1027643bbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220520, "uuid": "0583ade8-88c0-48b9-9066-68b74e59b4d9", "comment": "Malware payload (RedLineStealer)", "value": "7b556e42d07215442e9c2b9abb4d7ea808b599467d4f8ecd9167a44d90bf928c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220520, "uuid": "443d779b-1c12-4109-82fd-6e32af923135", "comment": "Malware payload (RedLineStealer)", "value": "c8bcb4abf6c8a88483159164c67be3614a52aac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220520, "uuid": "2e87c006-53d1-4cd7-9683-88001b1925bf", "comment": "Malware payload (RedLineStealer)", "value": "9f9ed7b2981b5cfd203c763e386b925dbd322cddaa68f669ed4bec962c71e8eaf1ab67b284c44a37b7d124b5ef76d172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220520, "uuid": "5d019b2f-6fe5-44af-b779-d8ab1e6b1b8d", "value": "T18295234727E98066F1B02F3188F767CB0A387C93EDB4969A7355DC1929A3591E47032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220520, "uuid": "5394a559-b55c-4f66-961d-2529be430156", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220520, "uuid": "b3d3107f-f449-4fe6-8f82-9475225857b5", "value": "49152:J25mawiohi4LOXrQARAa2mvI77TmoA27B:P9Dhi4i9E3moP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701220520, "uuid": "13fe8788-e1ac-4e28-b7cb-9d7718629e1f", "value": 2024448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701220520, "uuid": "9be2c4d0-72d4-4f0e-be93-751beb3f73c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220520, "uuid": "b8edcd82-a068-47ad-a0d1-fdbb73ad373c", "value": "c92066122188b2f61f5a5e1027643bbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3949bd43-8f02-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701295020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295020, "uuid": "41b103d0-0a3c-4de7-b48d-31ff3d8d297f", "comment": "Malware payload (Stealc)", "value": "75974b5828a4de85fdf197130fcc3952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295020, "uuid": "06801452-1ba5-47df-b001-79431ff4dc89", "comment": "Malware payload (Stealc)", "value": "7bee0b7e7a3c0a66e7bbbdf689bcd6d58f9f6fa4599a8f9f24d52d6946824a92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295020, "uuid": "f30702e6-0c1d-4bd6-b74e-c1db6ba513e4", "comment": "Malware payload (Stealc)", "value": "e2f10d5a054f593f02c85ced1834f4bd90ffd8fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295020, "uuid": "e68ecb3b-1a2b-4638-baf8-1c9eeb44e59e", "comment": "Malware payload (Stealc)", "value": "0ff184456f5d4494135674263968d59e16302b0a23eb7e691a21879abef3632db62b1d08a053d1df9fa270d7111f2fa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295020, "uuid": "1fe0493b-8547-4fe3-aa66-516d187e7187", "value": "T1FD34BF2176E1C032E12759344971C6651E37FCA29B6196CF37A42EBE4F323D28BB9306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295020, "uuid": "c53b9fcd-6780-4960-a851-098ed7afdf23", "value": "10d5222eea59eee664433b569e6134b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295020, "uuid": "c1317478-3606-4aff-b9f1-6f60958bfe9b", "value": "3072:xQ6Q2L+E61T6FkAd94zxWh/UCwJtTIB24sgNe4PCnDgV9hYQCqqe+C:C6sEry494zxSTpsgNJPSyJnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701295020, "uuid": "ee190c84-5902-411c-beff-c71fbb52a869", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701295020, "uuid": "8e7ae9ec-841d-494b-9116-b982cf1dbb58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295020, "uuid": "4d5555fc-a3ce-4990-a644-1717d733ad6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1472b2d3-8e79-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701236118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236118, "uuid": "6baccabb-2d2a-447d-82dc-77d3fc7608d0", "comment": "Malware payload (AgentTesla)", "value": "a0bb77b6563a467452a89a8ecaf4726c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236118, "uuid": "4631d362-8da9-418a-99ee-206d7df76576", "comment": "Malware payload (AgentTesla)", "value": "7f26a76fbe976c39ab6f41fe815adb5945b91d10d1bd48fc92a30d687263cb1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236118, "uuid": "6c7c6fef-5889-4308-8baf-b6410e9d61f7", "comment": "Malware payload (AgentTesla)", "value": "427feea765a0b2a0b802eb119f1d2b7544febc39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236118, "uuid": "357e004b-e6bd-4371-9295-f9f0ea0607e2", "comment": "Malware payload (AgentTesla)", "value": "10bce9f362a48eec7acb15585250951372d90bd72f90d270dab0a4a8eea126eaad9d14a4cf516dabcd0e56be83309dfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236118, "uuid": "40a7b98d-4972-42c9-a738-88497cdf69d5", "value": "T1E9053323AABA3A6E64C9617CC593AF5500D7CA09235A76A7DD1BCF9080334C8CE57DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236118, "uuid": "cb9814d2-945d-45cb-b832-49decffcca4f", "value": "24576:TXh56GDD/9FMULGg80Nw+HdCFlgI1qUaAN954cex:7h9DD/9FnY0Nw+HdovIAN963x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701236118, "uuid": "22926535-3327-4e29-b59d-bbb5673909f0", "value": 797264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701236118, "uuid": "aad35bae-ee57-4db4-84e6-c23dbd824b08", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236118, "uuid": "54cb2344-7f1d-4fce-b7d8-d95b2830b2fa", "value": "QUOTE--2177700XXXXX023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3695f18-8ed4-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701275442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275442, "uuid": "3decb88f-976d-4eae-8ee4-2f02f109be43", "comment": "Malware payload (RiseProStealer)", "value": "bfe60c2fcff03a008ecf75717942014e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275442, "uuid": "f9c8648e-17fb-4ddb-8b00-1214fc7baff6", "comment": "Malware payload (RiseProStealer)", "value": "7f5509513a53d6def4cba9f0dd90a168ffdc9c9c0815aab64623c93610dbce6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275442, "uuid": "095fdb16-5cd7-43ad-95b7-deb1346f5a2b", "comment": "Malware payload (RiseProStealer)", "value": "12a4551682a71eb8ff7c46af2539db7b6344f1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701275442, "uuid": "28a98ee1-c9b7-4fbf-94b1-b1150c81d348", "comment": "Malware payload (RiseProStealer)", "value": "38e7155dddaa47b214c6b0ef700cce283afa68593dd81cd9b98c8d41d148b733b0c687b38e486f5a1f8c61f1e0c407ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275442, "uuid": "fdc06dcd-8144-4208-a9c0-0aff4f32f7a3", "value": "T19385231993E64971EA663BF828F707930B70BD218CB4E76B315A941209B3684E43777F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275442, "uuid": "6dbab87a-d756-45c8-a38d-3c3b5256d7b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275442, "uuid": "0f06ebaa-62e8-49ee-b192-c808156a53ec", "value": "49152:Xk0BrmSDqKcgVZJaL2si8jQ4zvwXvwW/:5BrjJVZJaLXtvwoW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701275442, "uuid": "5de9986e-f8b4-4278-9e24-11b67d2f0143", "value": 1826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701275442, "uuid": "ae865696-651f-4e90-b7dc-10ef7509c899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701275442, "uuid": "b1476adb-e6f6-4adc-b383-0711390c044a", "value": "bfe60c2fcff03a008ecf75717942014e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93698805-8e8a-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701243632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243632, "uuid": "069b7e9a-5354-434c-b24a-246a97643baa", "comment": "Malware payload (RiseProStealer)", "value": "29e450e3802e7f09a74f1ae8a3780ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243632, "uuid": "ac3beb1b-7330-498a-aab3-f9d49f3e30e3", "comment": "Malware payload (RiseProStealer)", "value": "80521b1682d5e13e9bbeeadfd585ad3bf51bcf6164d378fce34a512056f4fa3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243632, "uuid": "848dd95b-a633-4766-8450-fd4249a7c166", "comment": "Malware payload (RiseProStealer)", "value": "78ecf107afe8135d78792a0c1e268879c55f0599", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243632, "uuid": "7734dfaf-3b05-441e-a01d-1986dc3bd29c", "comment": "Malware payload (RiseProStealer)", "value": "bdfdc7ef874645e1764933c61e67abdd205d0866ce71842e9f6bf8d46cdaa5624c88d939f899f13cd7477f8ef94a8eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243632, "uuid": "db0e3b32-d111-4931-bef0-b3b30e1e4683", "value": "T128752342F5D4813ACDBB67700CF7076B0732BCA2D6259352BE0955AA09B32CC5636B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243632, "uuid": "4679327f-6589-49e7-880f-cdabc481be7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243632, "uuid": "b667001c-030f-44a5-82bc-d87b43ee8e4e", "value": "24576:FyD40P90w7BZ80k0iUgDPt4X6KufesP6y/xLscRuvQJVCC6:gtF0aBG9tI61fXTFsKJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701243632, "uuid": "46731024-a176-4270-891e-224aa3a427bb", "value": 1647104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701243632, "uuid": "de98d044-1352-4c40-9327-898e457a00ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243632, "uuid": "3210096e-d186-4657-81ab-4c8bdcaa0cf0", "value": "29e450e3802e7f09a74f1ae8a3780ab0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69a316b-8e64-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701227424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227424, "uuid": "e8dbb294-fc5d-44c1-b758-fb0275c91f48", "comment": "Malware payload (RiseProStealer)", "value": "1cee3b3db3f9f9798600bede04b55f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227424, "uuid": "160aaa41-8dfa-46ca-80a3-b436d723ebbb", "comment": "Malware payload (RiseProStealer)", "value": "80b1b5c2f74c114ac925ab7daba23256e6822fffc7979525dc8031c769c13486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227424, "uuid": "20de6e6d-bf16-477a-90c2-77778d8cb892", "comment": "Malware payload (RiseProStealer)", "value": "ed807ac9c86ba565b4743373977aa63307a4b3ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227424, "uuid": "6716d8cc-ae3e-4b15-bdba-f5d799751633", "comment": "Malware payload (RiseProStealer)", "value": "17ac7af2dfa24b453ef751e167396d46ca40e3890c20b73d34abfcd173a19f0117c3a973f7715e7b09f3ffae95c65b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227424, "uuid": "e3262dbf-057a-4974-b359-e0577019f604", "value": "T15575234B89D8903BCCB963B01DF613A70B39BCE1CD74A617751A859E08B36E4517A33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227424, "uuid": "68bbad9d-0ad7-4338-b0c7-193b48a8077a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227424, "uuid": "4eef6bd8-0533-4a7d-8097-34b9f62d9adf", "value": "24576:LymDzJkTbpVJiUU5Ii246lKZEnAJVOTvQWq/42CuylOGp:+CJObM8iN6wZEnKgq/42rylV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701227424, "uuid": "7c01492e-50e0-4ca2-ab1e-7bb34fb0654a", "value": 1647616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701227424, "uuid": "69a9f023-fc4b-461b-ae47-16b98c773f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227424, "uuid": "aeadeef1-b552-43bc-9611-27f93cbe7df0", "value": "1cee3b3db3f9f9798600bede04b55f65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bae1e0a-8f03-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701295400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295400, "uuid": "8a53cabb-dbcd-428d-a596-4473d68bbc1c", "comment": "Malware payload", "value": "e2557e6dc21ccdfb9c2004f97fe03a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295400, "uuid": "9954f07b-da2e-4c3b-bd4e-60246296a69d", "comment": "Malware payload", "value": "80ccc5b03bcbf6f96f5a68989000dd9697800a42667c6d4ca3052fc3974e615d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295400, "uuid": "a20ccf89-035c-4343-b00c-2ae2368dbb9a", "comment": "Malware payload", "value": "eacdabc2277e7c4605cf847599064328352cae17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295400, "uuid": "d90f2206-0e7b-47a4-960c-93c7a3548b05", "comment": "Malware payload", "value": "d662dc2c5c781294bb033a99dca5b5f93e777acc02871b9abd11689ea5b843006b91d17113d2b7ecbd8d4b3a4f5e0ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295400, "uuid": "98933c43-27ab-4d10-839f-f0fcadced373", "value": "T1FD34CF2176E1C033E127593489B1CA654B37BCA29B3195CF27A42E7E5F306D28BB9347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295400, "uuid": "aefb1732-3a70-48ea-acfa-749ca5f944a5", "value": "10d5222eea59eee664433b569e6134b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295400, "uuid": "c91f2cb4-153d-4b20-98c0-f90718f30f2f", "value": "3072:TXfN0mLEo/136ZsLFN4axl5q8hPU9SMy+B6hp+WY/7fHQCz/ee+B:jfNCokOBN4axLq8BU9SM56js7ok/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701295400, "uuid": "88630c36-557c-4b15-b92e-9d37c9c09066", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701295400, "uuid": "2c8bf391-3d56-47a8-b105-1cc2e7a554ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295400, "uuid": "02c2cd59-07db-461a-988b-9aa90b9ef854", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b773f49-8e79-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701236183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236183, "uuid": "a39e6d6d-1bfa-4786-86b3-694cf7c245f7", "comment": "Malware payload (AgentTesla)", "value": "8b3c33c7be97c9d001832c916baa0fe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236183, "uuid": "aef0a2ef-3dca-425b-abd4-3c41b8a9f7ae", "comment": "Malware payload (AgentTesla)", "value": "80e0232bc7ef67d1bc5281120d0f3a98acfdd37de178b40ad2ed8b91116acf25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236183, "uuid": "a6f8b9cc-16fd-4eb3-96a2-7dedb6335d71", "comment": "Malware payload (AgentTesla)", "value": "b3862a519b78690783dbad4a2ccdd03d4ac3ed26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236183, "uuid": "22a826fa-eeb0-4278-a8eb-afe5f4ec55fb", "comment": "Malware payload (AgentTesla)", "value": "00926dd127bfd952dd9beb595edec0c9c5d2f2795bea924d5221ddbd34a7d95a0a0fba823cc6b5f6ed9d995b68ac23a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236183, "uuid": "0151df06-3bc8-4ead-a909-925692a9650d", "value": "T101C423FC57766A89483329F60B7970F4FD8B6657E19A053791A23E0BE14383B3F89124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236183, "uuid": "6ba1abbd-01cb-4edf-9bc3-c7968b655f81", "value": "12288:MqoYI5l9RcY1VggWoYxY+kQkkMGM24wvKX+jgZuPx3XxVZWT19hKV:xoBloY3CoYK3FkDMHwiX+drVZWTVKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701236183, "uuid": "ef064687-a2c2-452f-ad8d-420b2011cd62", "value": 587296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701236183, "uuid": "8cc513cd-4dad-4d48-862a-96c358daf014", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236183, "uuid": "14bcf7c4-8c20-4d60-8197-caefd77a260c", "value": "INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf8540e-8ed6-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701276345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701276345, "uuid": "ed357f7b-65b2-4cc7-b648-14eaa824e170", "comment": "Malware payload (LummaStealer)", "value": "ce5c7c478280b4cc382c972504b15150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701276345, "uuid": "f675e98c-0c42-467c-8d93-d17fc172ad5b", "comment": "Malware payload (LummaStealer)", "value": "80f5837dfb02ea54f365938ee30d6a58ac832c1ccd4a6d6edffd05e89911357d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701276345, "uuid": "3b9fea50-aeba-4e10-981c-275cd4fe3f06", "comment": "Malware payload (LummaStealer)", "value": "03c531bab0077094d3d9d9a952db31b12279085f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701276345, "uuid": "c669d19b-1a06-4862-98f7-6ab139ca349a", "comment": "Malware payload (LummaStealer)", "value": "f92244ce21386c89e99702344d81ca05dcc44bd7ba529f00d22b9b629596c54e8d6d8d9b48ef3ce64b773dd2af852a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701276345, "uuid": "b316e6ae-965e-4df9-9aa1-7ba2090eb977", "value": "T1F4752316F7E4D237D8B0037055F626D3573EBC9799B543366A28E61A8C709E8A43832F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701276345, "uuid": "dde6654a-e15e-4e3a-8453-7fd7c3fca493", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701276345, "uuid": "696332cd-0fdd-4ccf-ae39-2e5c50d5d321", "value": "49152:1BTQR6qoKpk8zgxlp9u4OUtoCCAYTizV:3TQBSP9OnCdYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701276345, "uuid": "16f21d3c-3ae2-48bd-b34b-fb1e2b9c83ce", "value": 1580032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701276345, "uuid": "94cd0313-d763-4675-9b2e-b38123ad69c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701276345, "uuid": "64f23884-e827-4fbb-922f-94bf32c21e48", "value": "CE5C7C478280B4CC382C972504B15150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8331ef3b-8ea0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701253054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253054, "uuid": "3d655a67-3b0d-4008-ac2c-5e3d241cbb28", "comment": "Malware payload (AgentTesla)", "value": "31cd31968f6962160feeeb54859957fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253054, "uuid": "a2cb7d84-ef8f-4b20-bedc-7e573b1997e2", "comment": "Malware payload (AgentTesla)", "value": "8101904c3eb3b0c053183fa8ed93da3c401fc4d8fd64dbd952f94a3619f65976", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253054, "uuid": "9b92d74e-7b78-46a1-b846-4e4f8388c93e", "comment": "Malware payload (AgentTesla)", "value": "7d03f78833504888afe6edf52a7af344d8243728", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253054, "uuid": "8ea3c34b-0efb-4f1d-aa52-7381d2e5f774", "comment": "Malware payload (AgentTesla)", "value": "9f004c28185e5423b31d4b5f421266bf26dfb0c4dc500bdc49fd3baeccfb9bea6b8e304c6cb574d18468a41400b97e4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253054, "uuid": "21da797b-0390-4217-80bb-b1e865420e73", "value": "T1FCE423C1875601472CB94A42CADFC332FC551A0866FD6FF68617D2D403EA95BE3605BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253054, "uuid": "7822b3a7-8dea-477d-bf6a-74e42564d353", "value": "12288:ImZqCvXVOmyxuYazS1oqhwfs9Iy28XvqkGJjD8Y50+Yk/c+EeE672XHGO5Si+ebL:nZvHeuY71Bh+85Xv4JhuLmcvq7tGjbcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701253054, "uuid": "48070f94-f149-4d80-801e-0a73b4c35be7", "value": 659443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701253054, "uuid": "7e971c72-7f15-467c-9a80-14e76501a7bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253054, "uuid": "2a59a993-b037-4e99-9203-ae9fca3ffb0f", "value": "SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef89f215-8e6d-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701231331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231331, "uuid": "ca90ba51-7131-405f-9e82-77dbad43a9a0", "comment": "Malware payload (RiseProStealer)", "value": "1c51520788a376844831fb3bfd55015e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231331, "uuid": "13ac9d03-1048-4636-bf34-383bcbbc7061", "comment": "Malware payload (RiseProStealer)", "value": "81a1d77fca365fcf24d423c48a333a79ef780362b5ebdb3d60680225c14cedc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231331, "uuid": "e3207924-2332-485a-b434-011dc67ac1d8", "comment": "Malware payload (RiseProStealer)", "value": "0eb4fb262041d8eb8a4642ef6ab75c12a0fec70f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231331, "uuid": "8ec71650-20bf-4210-8d33-a9d0396c118b", "comment": "Malware payload (RiseProStealer)", "value": "fc0431abfcd9efa61abf58922b558e08d2ed403e09d6a0633ffc1a5f16ed89ecd1e6712b2f548700383c3f1055fa16b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231331, "uuid": "40424bf8-621e-4643-bcbe-22bb22532262", "value": "T165953302BBEA4132E5B42FB049FADBA71675BC11797073A91A51C919EC76604E2B033F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231331, "uuid": "1acb579c-4b39-4b80-a69d-0403c723e105", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231331, "uuid": "3e32125e-021d-42d7-a946-c74960526839", "value": "49152:hF3kGZvaiyHND2wyP5ByqlJOyihSOa1xDZgppMy:ztVyHNDVFsrDipm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231331, "uuid": "f57c07bf-8653-4065-88b9-9fa7a5b36ac6", "value": 2024448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231331, "uuid": "159ec3c0-b86f-4aef-b21e-a35f9d26fa70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231331, "uuid": "0c48384b-442d-4939-9638-a11ff1ffe931", "value": "1c51520788a376844831fb3bfd55015e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4e567e-8e56-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701221238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701221238, "uuid": "d37a4170-b7a8-49c0-be1d-ac08de5fa6fe", "comment": "Malware payload (Smoke Loader)", "value": "8fbf48d8a1a3256d1ed7a7d11714987d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701221238, "uuid": "2a33b119-62d6-4e9b-b4ab-d865b1263087", "comment": "Malware payload (Smoke Loader)", "value": "833c678d8f91fd027e0e54a56e653312c413e9158dd8e326a62c50c92dae6e47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701221238, "uuid": "e3fe7e84-196a-4ba9-ba8c-47a02809c80b", "comment": "Malware payload (Smoke Loader)", "value": "e6c98ede927cb32e612b9363a3fd92101be125ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701221238, "uuid": "a54dd15c-a8a8-4182-bb61-73e7d95edb65", "comment": "Malware payload (Smoke Loader)", "value": "72b70774546185708735045b684246a8035be2f4f32d1d234435e24dfae2bd42fa2aafd5a04915f7132d056b4f60e7f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701221238, "uuid": "e0337635-c0aa-436e-b943-75c68af0cbc3", "value": "T17554D74382E13D44EA269B729F3FD6EC770DF6918F497B6922189E2F04B1172E263714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701221238, "uuid": "da0d6098-b11c-4ca1-92cb-32ce716243f3", "value": "4dbc83cc54bc51fb114f9cf586b5210c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701221238, "uuid": "314c1f5c-14f9-4731-88e6-68ed01af714a", "value": "3072:SUVoYl2/0SYHdYtnBd2hy0cTVKjTIK35rvQ5LlxG:XoY0Y9CnB4S4IKFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701221238, "uuid": "db308215-a16f-4c04-b621-61f11bbe10d4", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701221238, "uuid": "57a16efb-86ca-429c-b154-d7155969bbc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701221238, "uuid": "9b2c2d33-f68b-42e5-ac4b-65b2bab397e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366a076f-8eed-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701285996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701285996, "uuid": "e355c72b-25d2-442f-9ef2-517ddeeb4f79", "comment": "Malware payload (AgentTesla)", "value": "28594990ba6d4f212d31c88e5c34c540", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701285996, "uuid": "ceb7bf99-dd7f-4a30-9325-6f783ee67528", "comment": "Malware payload (AgentTesla)", "value": "839e99379a8b401715d4d172895e7d901a66bfe643bd9be96a56f6d3aadc7773", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701285996, "uuid": "51d825e9-25a4-41d1-8d4c-f4455c4c8e65", "comment": "Malware payload (AgentTesla)", "value": "f9dc41bd7d73c9d4351d23e9ef891049543dd3c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701285996, "uuid": "b924e185-74e4-4b33-8506-d15e71875bbf", "comment": "Malware payload (AgentTesla)", "value": "39572576dae4515650fceb1a18e0105c181b7f0e0d2468db16e5b1656e8cc39d2ec2d1d7649ac2d02f293576f323a460", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701285996, "uuid": "b3b948e9-cedf-4eee-be7f-c3d8fce8861c", "value": "T1A3E41215A6BD3F26E47A9BFD5475104047B9A53F6036F6A85DC230CE2BA2F400BA1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701285996, "uuid": "e0c450ea-fd26-45f6-a15d-34c42a2e06f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701285996, "uuid": "073af489-fc96-4101-9f92-2516c41e2527", "value": "12288:OH6wSoDWsXEW1tY8YurUxYiPoyzzqw8of2gewJlJ9LifsCPR8LguDQj573opox:oSoDzXEW1tYOJiPaofRLhcfRe8uDQ97O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701285996, "uuid": "db14a065-dedc-4471-b3d0-cd47efe1e235", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701285996, "uuid": "4a1968f1-d3fb-4521-90f8-136678888ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701285996, "uuid": "f4084078-da7c-4806-8275-192fb1521483", "value": "SecuriteInfo.com.Trojan.Inject4.59820.31752.5653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c56f943-8e6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1701231943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231943, "uuid": "5fc11307-9ab8-4c93-8a49-d3c4303affe3", "comment": "Malware payload (Loki)", "value": "93fcdbdc88b1331060cd070f569e3e93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231943, "uuid": "6c6d2d95-c2cc-41cc-8171-cdc9db62aaf4", "comment": "Malware payload (Loki)", "value": "83e2ffe6b128ed3d1aa198c0ef32edf87e13242263788d0fbf18848f753e51bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231943, "uuid": "0a72fd07-7bba-48b0-ae60-c9e228feb53c", "comment": "Malware payload (Loki)", "value": "8575cf2dc7aaba8c1a63381b0a054495e255d5d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231943, "uuid": "4bafd328-85f0-41e6-b98f-865f389b4ebb", "comment": "Malware payload (Loki)", "value": "600eb3d7c7da2f1ce9d9522d9985ba8c20c5d8548fce036e5c3468561084ee8483990f56420a226c7c4d4f56a1cc5dfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231943, "uuid": "01ae337f-e8f1-4141-a19e-9cb2c5859922", "value": "T147B4128632BD92A3D6BFD6F9102410A047B07F6A21B1F6C92EE466DD4DF6F504312B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231943, "uuid": "aaf7540d-4aaa-49c8-b1aa-cda80d6b6883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231943, "uuid": "27432d09-172b-443b-a057-47c42f176dcc", "value": "12288:MsCQmbCppX9rEDvyvsX2zY8Ri6xf0EwCw/VaVLs/9pKzh2Sr:hzroazYSsEVY/n5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231943, "uuid": "797be016-b0f7-4631-a1df-6b124e03e96c", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231943, "uuid": "4c457af8-18a5-47a2-bee8-06acf998912b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231943, "uuid": "12f421d7-38bf-4dd5-bdb7-8e6aa1d6f085", "value": "93fcdbdc88b1331060cd070f569e3e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0fdf35-8e91-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701246442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701246442, "uuid": "d973bab6-a2e6-46a6-9772-d17f2eda5d43", "comment": "Malware payload (Smoke Loader)", "value": "45156b00dc83ab313360f5dcdd07da35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701246442, "uuid": "502bd806-07bd-4f62-b5bc-05e4c0a293d2", "comment": "Malware payload (Smoke Loader)", "value": "8451898d2d2fea969444d88a4375ce675b8bc76165d0d6dab43272353c40b996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701246442, "uuid": "6360fec1-2126-409c-ae05-fe14b43c6eec", "comment": "Malware payload (Smoke Loader)", "value": "41964f92f396180d9c30ea5a7219a3830e4e1f14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701246442, "uuid": "bfb89d2f-f58c-4d78-a84a-2055a0264dc6", "comment": "Malware payload (Smoke Loader)", "value": "7604e9bb53cca4195d36a6c24a61eb4f1882256525da198b15fbc932f27f9775691ff45ea3ce7ded2a2f8cf460313555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701246442, "uuid": "4e15b450-48f8-49bd-8b2e-920ebc02216e", "value": "T164547C1266E97861E5174A33FE6AC2E8671EF9914F253B9B33546F2F49701F2C262303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701246442, "uuid": "c7727c88-d738-4c23-995e-16b519d0ce3a", "value": "99e733edb40d39f08a07658473c3f554", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701246442, "uuid": "606a4e58-39c6-4ff8-9caa-c9876be1d707", "value": "6144:te0vmUkqm4m3EwBdElNDVgIwDzqudL7Z6VK:tf5m3Ew/INDT4dL7EV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701246442, "uuid": "43e04fd8-5ca7-4aaf-b589-dbf08c9673eb", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701246442, "uuid": "7d5ff150-0ef0-4e3f-83a9-2b1011a7ba0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701246442, "uuid": "94c665b6-5c84-48cc-8ada-5a56f817d735", "value": "SecuriteInfo.com.Win32.PWSX-gen.24135.19028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20184313-8eca-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1701270926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270926, "uuid": "8977a834-c5a5-4b7d-8e3a-1036cb5b901a", "comment": "Malware payload (XWorm)", "value": "1a4f225bd217b7adf526496ad0dfcdc4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270926, "uuid": "0acf3ba8-4821-4726-a377-278a9e6fba10", "comment": "Malware payload (XWorm)", "value": "84c6c519c17da179b5d9d969a57a67e710168b83323e7afe2a9dcda50979d9db", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270926, "uuid": "8ae0ff91-169d-47f5-a206-ab4f04d25e06", "comment": "Malware payload (XWorm)", "value": "13dfdf61333089f8c20ee39f4c2cc5dd32e11c4e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270926, "uuid": "fa612d3d-5a8b-42bf-8a73-f3f445004f48", "comment": "Malware payload (XWorm)", "value": "baac0387872cb6e0b28709384e8276e85c5a33992c16937776270c5f64eff9a8fc79f29d16360091e258b500362fe2d7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270926, "uuid": "7e77db6f-6bad-4b5f-9646-48838f030939", "value": "T154842B1026FB500CB1B3BF555FE9BAD94E6FFAB1553994AD2048170E4B63E80CDA1B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270926, "uuid": "aa1c3788-3126-4a59-9ee2-f3bdf5d7a9e6", "value": "12288:wBEBEBEBEBEBTGBEBEBEBEBEBNBEBEBEBEBEBzBEBEBEBEBEBABEBEBEBEBEByCO:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701270926, "uuid": "1c3ffbbb-d24a-4595-a2de-7a64e6e56cb9", "value": 404668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701270926, "uuid": "e7202ad3-8f3a-4596-82f5-3a11b9bce133", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270926, "uuid": "94c7977c-3f95-40ee-9aa0-eb6dffaa1d8d", "value": "linkedinsecure.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800cdd17-8eda-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1701277959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277959, "uuid": "21362834-1a48-43c5-a75d-8f8e46506b60", "comment": "Malware payload (NetSupport)", "value": "c5b618e626966bdb75b39f1a6d81f98e", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277959, "uuid": "874737c4-f625-4e8e-9d71-41ba9df03dba", "comment": "Malware payload (NetSupport)", "value": "84fb181c369359060a49ea2c0304878a2e201ed9dac4c17560aea307c17e5d17", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277959, "uuid": "27175032-ca77-4bac-91c4-3649539c4b44", "comment": "Malware payload (NetSupport)", "value": "0ba0de2f9d9f25fedd30b04a41465da781c48c26", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277959, "uuid": "38ac2d00-a22c-4503-8ea6-108fa472e3d2", "comment": "Malware payload (NetSupport)", "value": "cdc3aab475b77cd7695cd66cf93955af3813bc7cd400f3061ee1d45d7aef0d446f6d8d76568c5625c3f72b3c290fba4e", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277959, "uuid": "811ed88c-98d3-4bdb-8151-ca4af2de1e13", "value": "T14DC533516A83F76BC0E1F1BBE4ECBC562D2D6468E4FB36A7093FA4A2E535421C47E401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277959, "uuid": "d36feefa-a70e-4cf3-9641-cdfb9ba6ef45", "value": "49152:RlAQumelDlEDThXBJOhHLw6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7WIqR/rl:Rl7/FXamhRFY89YYc9jh23redpmQR+tU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701277959, "uuid": "27499bf2-98b8-4ca2-912d-afc6e4a4051c", "value": 2562078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701277959, "uuid": "91a7f20e-f1de-4812-891f-b4f972546146", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277959, "uuid": "60c0254a-96e0-4c39-994b-4234b9682033", "value": "rtr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f7b373-8ed2-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701274538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701274538, "uuid": "1d6da1d5-bd45-4165-8a9e-ec823498ced8", "comment": "Malware payload (RiseProStealer)", "value": "23178fd674e0857fd28c3f1062e84348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701274538, "uuid": "3cc8c916-9d4a-4a59-93e4-a5b30a0c824f", "comment": "Malware payload (RiseProStealer)", "value": "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701274538, "uuid": "fd5fcc5c-35dc-48a8-aaba-b9ce28701321", "comment": "Malware payload (RiseProStealer)", "value": "f3a19fd33ff34cb7f2b448e0b703d25e5a789d3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701274538, "uuid": "cc3e3390-ae39-449b-a8a7-388724341718", "comment": "Malware payload (RiseProStealer)", "value": "a66ca9b9e73a0f475291c6c51babfe858acb3fe249cdc20e7ca00c911ef83569fab54070b27f031e1277cd89f5f5b725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701274538, "uuid": "b3289413-6631-4b27-98e1-4d956a73ab00", "value": "T1EF853327E7D85473E9B927B0ADBA15EF1F71BC940E78421726985D4A1CA3A84F433323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701274538, "uuid": "0d5426c6-0b64-4b63-8cb9-9aeacd04688e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701274538, "uuid": "7c3eda64-4fc9-4d54-811d-eadbbe149714", "value": "49152:jzjNftH5O+e6fus2HiaH5e8/VYjcBTTTZF/M:RtZOUiCq3kcBvTZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701274538, "uuid": "b5689584-d4b3-434d-a42e-e789e743182d", "value": 1826304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701274538, "uuid": "b033f948-b31a-40d1-8486-b9cfb101ee6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701274538, "uuid": "9f08f2ad-ddc0-4d59-89a1-62f016c584ba", "value": "23178fd674e0857fd28c3f1062e84348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d3e8c1-8ec8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701270340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270340, "uuid": "5b4faf62-4d37-4ca1-900a-e4343c7f8ade", "comment": "Malware payload (RedLineStealer)", "value": "96666e098ba9bd84ee3b85e85097b7c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270340, "uuid": "1cd8bab8-54b2-493d-8c74-a2ea25ad4967", "comment": "Malware payload (RedLineStealer)", "value": "86c5161f5f85545822b070a1062971091fc638b8a8ea6bd5472e5208656279b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270340, "uuid": "767447b1-0856-4a4e-aeb4-13f9d1f4fc88", "comment": "Malware payload (RedLineStealer)", "value": "e92fc3b5c3fa9743f25880d2260035313742baab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270340, "uuid": "ce15e287-417a-443b-9b10-14f4ad8c33c9", "comment": "Malware payload (RedLineStealer)", "value": "f5c0092b8ad92b943b7eaa19714308420611f2111702b65c18551a0e5c437402a9c3fb6dc76265bcac5514137d738992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270340, "uuid": "69d29a45-1192-4de0-a32d-c7ca3d4842e6", "value": "T10D943BF4A9B791B0CB6382F9977CA2C3DBAF15500181DFAA77A422F1244D4D853B6378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270340, "uuid": "4533e848-6fe6-49c0-a4a9-28c691a1c592", "value": "87350e5122fe833f08b84b2991544fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270340, "uuid": "8f7b9e1c-081f-4f9a-afa2-fb9bb0ecf122", "value": "6144:KpOkLGNN5qmeLjgo21QmE7fkcJwvpXe9aUff+HcV:KpOkLQLoBDkrpsfxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701270340, "uuid": "1afbcd06-cdab-494d-8d60-9747108e7386", "value": 418332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701270340, "uuid": "26e73e48-9a79-44a7-b59f-19d8d5a69208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270340, "uuid": "330ff694-77e9-4201-b90d-fd273b1a457f", "value": "96666E098BA9BD84EE3B85E85097B7C7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852fff5d-8e7a-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701236736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236736, "uuid": "afe365b9-b9a8-4015-837d-3c19588615ff", "comment": "Malware payload (LummaStealer)", "value": "49f4b13f62f843ae67ac8c26ecab79c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236736, "uuid": "ed5306cc-713c-4b7f-bb1c-2ac5aa268e85", "comment": "Malware payload (LummaStealer)", "value": "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236736, "uuid": "c4babcf7-8b23-4628-90eb-c86f3639be73", "comment": "Malware payload (LummaStealer)", "value": "c35e2035f7597302adf895775a6a1fc29ad4426f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236736, "uuid": "5fc04e22-09fb-42d9-9078-aa0a40596db6", "comment": "Malware payload (LummaStealer)", "value": "dfd5d29638adf523df8806ccef47039bfe883264be9d1093f453e18ee1e8fa486f14abd878c96825f0807dc66a9fbc2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236736, "uuid": "a2c6fb08-e567-486f-838a-ca9e32e5ade2", "value": "T15695334153CCC026D9B42F348ABB07A30B36BD90A5F092A56796FD985D53A84DBF072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236736, "uuid": "a6a6e9e2-6cb4-4e78-baef-4ab9dd56158d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236736, "uuid": "09c94ba5-1a5d-40d8-9415-9c93847551c6", "value": "49152:aijbEO2ny43WcAnT4BvSQUIU8ZsQuvLK3R:WO2yIhUI1ZYe3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701236736, "uuid": "c236c7f9-729c-48bf-a33a-80fb855cdd71", "value": 2023424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701236736, "uuid": "44f1acba-8009-42a3-834a-6c798f9c476d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236736, "uuid": "d2453df1-ef30-4b7f-8a4d-89a392028e7a", "value": "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf4710c-8e94-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701247834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247834, "uuid": "f329b500-de4d-49df-9809-7bf9cfef0aea", "comment": "Malware payload (LummaStealer)", "value": "3882bea80091c8ef2377ef7dbbc8b4fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247834, "uuid": "7b19ff6b-afde-4d88-9824-a1f0adb12c43", "comment": "Malware payload (LummaStealer)", "value": "885a30af9979610c90fade79c9ef455ce89d30a006b3821a2ee5d36ac34fecb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247834, "uuid": "a6b9a1c1-9aa9-4bc3-a7cb-7f8a6adc970b", "comment": "Malware payload (LummaStealer)", "value": "62f70ececf3fcc8e5d663c7248d4045a0fd643b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247834, "uuid": "8fc986c4-94ec-4dea-895f-b94e22fb4e54", "comment": "Malware payload (LummaStealer)", "value": "e1b35dd7e53d215fea57d81402c324fe03307b2703eacec84ea211d1646a91fa6bfd9e16cff71a88970d3f881d814745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247834, "uuid": "b0c4b644-1851-48dd-b147-c100fa4cdcbc", "value": "T1E0252342A6FDC023E6B42F3058F796630A367CE5F6B4925B3756AD4B2C13254E1B132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247834, "uuid": "f2f4045a-8465-408a-b443-a39b24ea864f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247834, "uuid": "d64a095a-09a7-4111-8e23-0429f89f53f6", "value": "24576:dyiQaDIY2DSBNRzj8TJdsqb0vdLeDhoA0:4U2ENiV+qgvdkho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701247834, "uuid": "4133ae89-bba2-4242-961f-6b3dbd9c8f9b", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701247834, "uuid": "55b63150-8af7-4c6e-9e81-6a6fcf553633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247834, "uuid": "f88e287a-3f15-4738-8fb1-90310ff765bb", "value": "3882bea80091c8ef2377ef7dbbc8b4fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b543898-8e96-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701248772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248772, "uuid": "890257bf-0310-4b4b-951c-43900ccf1145", "comment": "Malware payload", "value": "7a53a19db11351fa7a0751ec7afd6d19", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248772, "uuid": "20cd0178-c874-490a-bb01-548ffa4051be", "comment": "Malware payload", "value": "88a7d32830a0a2e9a971fd47daacbe9f1c6fe85e5062c92adb6899cdb420103b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248772, "uuid": "504d0334-cd68-484e-adb7-0d78d81f6a18", "comment": "Malware payload", "value": "1f38a248b638f6d9c240e85dae66d2f3ddfb60a8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248772, "uuid": "bb8b2309-86f9-4af3-b64d-ca2a7c07a0c4", "comment": "Malware payload", "value": "9c829a570d7534ec5fcd6cae7e8cf652e9fc1489d474ce856c465296680b7aef7f97a3b8aabf2f40a01ad07a7396815a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248772, "uuid": "8a3fc89b-a3cd-498d-96c3-4f9496f739d2", "value": "T17D653365DA76483325C100D2EC7E37609CB172EA1F4B5A7B38A46219606CFD99C8B3ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248772, "uuid": "0949855b-8346-4e4e-b553-57f40c94d5cf", "value": "24576:d1gdQirjgT+urpfmeue22hy/joPOgNljoctDGx5qsy8Eim9LaIJf/gvvEHskeWom:odQtT+Oc9ehy/juOgHjoSDGx5qSILhwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701248772, "uuid": "82472449-a1da-4f08-98d6-1d85be67a53a", "value": 1539639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701248772, "uuid": "17746e31-eab3-4327-8b29-ac43cab445d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248772, "uuid": "856211f1-4028-4462-ab00-2384d79811dc", "value": "PO112301-Quotation-november order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7d87b6-8e5d-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701224431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224431, "uuid": "83e9ef20-f3b5-4b80-92c9-7b7b206ba2e6", "comment": "Malware payload (Stealc)", "value": "d05365d877807f6864ca1bf2d1b909a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224431, "uuid": "123de14a-5684-48e1-aefe-c8fe79bf62ee", "comment": "Malware payload (Stealc)", "value": "8c174645df206ee38045bf7768a094fbad3d6715252e8c23d23c438ae2b04a2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224431, "uuid": "ae78dc9e-b3b0-400f-b4cb-06446b23b499", "comment": "Malware payload (Stealc)", "value": "4d2ca7f1acc973461036ed4a5344083a67c5c50c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224431, "uuid": "5983ceba-de45-41a6-a605-ecfe21c22afa", "comment": "Malware payload (Stealc)", "value": "1b4f98915e9691430a491cfc82bbaa6ceadf4e2a8a86e731870c3c21f62d9d6b9204ab61142c760bd9b6bcf26fae8005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224431, "uuid": "96c89120-483c-410e-8969-8750166e4acb", "value": "T10054D64382E17D44EA268B729F3FE2EC770DF2918E497B7929189E1F04B1176E163718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224431, "uuid": "9d0d367e-eda8-453f-b554-a316b60a3e6a", "value": "11c9fcb70393a93c4fb8b893cde399ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224431, "uuid": "77635a95-9109-4743-b050-8edf1dfc7a2d", "value": "3072:wnA0N2BtcFaeiMJKzPaAldFXPUQ73u5ugc257PYQ5Llet:czgpeJKGALFXPf3u5V7Pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701224431, "uuid": "d85dc471-1140-4a33-b1a3-5cdbbfec611c", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701224431, "uuid": "b586fb5b-2575-4bb0-a6a0-ffda961b5edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224431, "uuid": "7f974f7e-be0c-40cd-ab8c-33753e3b1f54", "value": "d05365d877807f6864ca1bf2d1b909a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fae59d6-8eff-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701293877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701293877, "uuid": "a9052497-c75f-4a14-a017-52ea6a40f223", "comment": "Malware payload", "value": "f3ef38368f17bc14f4ab23526967c06e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701293877, "uuid": "d0ee5cdc-7f0e-45dc-8302-eb0946c8c9a1", "comment": "Malware payload", "value": "8c1a70f531214ad5bdbdbad57d27456fefbcf4d1a0e6b4c19f95c98e397520f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701293877, "uuid": "8c44ca27-c74f-4f80-8a9f-085f175aadcf", "comment": "Malware payload", "value": "10427da551edf22edb2b3d05b231fc5918602ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701293877, "uuid": "cd35b1d0-8595-41db-9b12-1cdbb04dff71", "comment": "Malware payload", "value": "f690172d2c4ea181bc6400a68b63972faf3eeffc6530f8bf1d31f871925b4a6f1cc66b6c88f656b031ae367b5fc23b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701293877, "uuid": "165c0611-8b72-4c5a-a5c3-70e240a3aff5", "value": "T1B2859E19316EB0B6C6471A3CF25413A6CF2424B037297C977B962DFF8C33198A6C576A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701293877, "uuid": "8a426fc9-aa2c-438d-8d27-c4606b007c20", "value": "becb59d6c2cabee1a77fe54131d4eacf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701293877, "uuid": "9e0822d9-a41a-4230-a398-7b0f5ef262c1", "value": "49152:7fsBoUVlM0JIUHMdUHkrFG2Qx3qsN+uichDC:7fkQF92x3qsN4che", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701293877, "uuid": "2652e444-54bb-419f-9555-346e4be2d640", "value": 1726240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701293877, "uuid": "e198675a-7fca-4819-8fb8-9cc6846e3275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701293877, "uuid": "7273f0df-f51f-4c2f-abab-693db1970745", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77c0649-8ef3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701288817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288817, "uuid": "aa3b9dbf-e5aa-4e1a-a541-2daec3f3c45b", "comment": "Malware payload", "value": "7935e0ce45cd8a98c2250b092844f611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288817, "uuid": "7988a421-667d-4eee-ae21-21faac6b6e32", "comment": "Malware payload", "value": "8c5858fdc6044de48a8f22b1ae51eb6bfa45befe91c3a854b2b0a99b79d41581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288817, "uuid": "a3607140-4024-42c6-b6be-7737ab4d0124", "comment": "Malware payload", "value": "f50be915343de05ea7be649db2efe0afca4a9101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288817, "uuid": "594534a7-a3f6-4bdd-8f91-0881bca90cf4", "comment": "Malware payload", "value": "1273c2bca531d5e2739f19f01bdd2f868f1dc3396e893a1d30d93d0922a864f8ff831b2e14e1d8fe849cff191ddc24ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288817, "uuid": "e4dbcc81-2d66-4bbb-ae37-627baf369fee", "value": "T105647C02A3E56861E5264A73FE1AC6E4275EF8919F157B9B33246F2F09712F1C272313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288817, "uuid": "d373847e-07c4-4c53-9543-41423361250b", "value": "a5ba2e63e413ae40c0d8efc223d7976c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288817, "uuid": "eda0ce56-21ca-4fc5-9b9c-aef2342948e6", "value": "3072:grsos8xUSncSFEfu1940Po0ZYJsnZTXCNa2fUOkpWDUbVvAnQqF2gD5AsMV:KscUSrYa940Po0KJsnFCoQOV4QY2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701288817, "uuid": "9da8f308-4880-499e-8979-20e6f8c7dbdb", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701288817, "uuid": "8c690ddc-6561-48f9-a0a8-b18f0c3ff3ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288817, "uuid": "79551d21-4c0d-49c9-809c-9a2fb45d3de0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a052825-8ecb-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701271534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271534, "uuid": "904d5a12-dbd9-4b28-b643-ae964ed1ee4d", "comment": "Malware payload (GuLoader)", "value": "75fc7889d6c8ac7d5451e9cfa5b84eb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271534, "uuid": "94c28655-a4da-4ef9-88c4-aac4582ee2c4", "comment": "Malware payload (GuLoader)", "value": "8dad0ef65c746ec356540dbffc3345927aa59eace76b77c0ac9d18d13247abc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271534, "uuid": "733fd04d-fd02-4286-89f3-58e760803735", "comment": "Malware payload (GuLoader)", "value": "b96079b115fe19503a059c8c98d59995ae6f4aad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271534, "uuid": "072111c1-465b-4423-b54d-b3eeb17b10fb", "comment": "Malware payload (GuLoader)", "value": "04e62d0f45810607905e4874ac80d113b2917b09173e36ee239018a93545078af307b17f339d463531ab04eba88fbe4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271534, "uuid": "751cd167-cd47-4d80-bf2c-50cc3b63dbbe", "value": "T122C4F1192328C80FF74789BC546AE66E957DC5008C753A423BB32EECFDA7196BC16247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271534, "uuid": "ce53df44-b9a2-493b-bdf0-203b2886edd6", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271534, "uuid": "13efba33-8449-4067-be1e-978815d8393f", "value": "12288:Ac77o6IWnccrCA0G+FRIIkDQ2s4Hbjdm17zOckylak7iI/dKX0HOd:AhlMcOCAGGnJsSCKdOT73dy0HOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701271534, "uuid": "8f9b91e9-9ab4-46da-8cae-83f42d0dec59", "value": 561648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701271534, "uuid": "6f841b3f-aaac-47e5-ae8a-5e7d803e2e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271534, "uuid": "e9b3f2c6-bb94-4572-ad11-757395b8699e", "value": "SecuriteInfo.com.Win32.Evo-gen.9086.10042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c29d01-8e92-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701247211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247211, "uuid": "bbe62c09-a675-4fdc-9474-62e261d143ac", "comment": "Malware payload (RemcosRAT)", "value": "34c634ae5c2ac812bfb0d077139833e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247211, "uuid": "c9d6a1ab-ed45-4d43-83a1-62a0271b4f12", "comment": "Malware payload (RemcosRAT)", "value": "8e84eb89c2ca0fccc13699791058e680f9ab4e58104ef6a630b3de113b63c9b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247211, "uuid": "c3c71538-c3ad-4abe-9cca-5c859729c27a", "comment": "Malware payload (RemcosRAT)", "value": "c081c700656b9256a499a82ebb4e100f2313df0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247211, "uuid": "f41e5db1-9eb7-4d6d-a4ee-969891ab51e4", "comment": "Malware payload (RemcosRAT)", "value": "d94d530fa43acf50194845581b8c33bca2a5d574c03d35a886e0ee1dede15ac1433684f3869e9fb1ad6ace22ebb5ec02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247211, "uuid": "27a288f3-b080-4923-a499-77b97dc036d7", "value": "T15734126820B0E5AFEB3B10348D36A542FBE6EC1514DC47573FA8E76978352C1590E78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247211, "uuid": "3af702a4-8c0a-463a-8c92-08b87d3c1115", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247211, "uuid": "9846688f-ae16-49f9-ad12-28471ca3c6cc", "value": "6144:YDfe1yG66vswZ0uHycZF83Lm77yqmH5mg1BpNxaumB+/AJgqMWVuMO:gwp6aswpTF4GyRwg17NxIB+oJX9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701247211, "uuid": "b4f7a32d-ae28-40f2-9dbb-e3d8148446de", "value": 249629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701247211, "uuid": "fa838e0c-560f-44ab-bb18-b3022725a3b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247211, "uuid": "d2479f60-fdb0-4575-affc-6f9ddbb8f00b", "value": "GR& T. Ekstralam Proorma 1& 7687429--&.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6739b9bf-8eac-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701258161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258161, "uuid": "2eb87e2c-fafb-4aa9-afd0-18b20c5168f0", "comment": "Malware payload (AgentTesla)", "value": "d4c4a135a30ddab42ccb75465d71d898", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258161, "uuid": "21c19642-c469-4131-b35b-453d09077fab", "comment": "Malware payload (AgentTesla)", "value": "8ed2fadc10bfd74e8f9c063d3bf4e8c4d3a9a1655745d7da86503dc03fecee0f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258161, "uuid": "1f09276b-91f8-44aa-9482-ab701583ffe6", "comment": "Malware payload (AgentTesla)", "value": "5bd07da1b1b7111d8b8d2e6f39c705b6366614f9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258161, "uuid": "865e821c-3b53-49ca-b346-e4160c7e1f73", "comment": "Malware payload (AgentTesla)", "value": "514a98279d546ed88f2b0e78855066015b7a389873f07df53b6a6fe3ce9f0489af85656cb8b31f6a2c65e0c20143aff2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258161, "uuid": "dfa16b23-846c-4c8a-96bf-95ba5a5e02b0", "value": "T17BD423F44B29BD3B20ECDDD75A526894B9B000BA82B1B7FA5B17156343EBA5F04630F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258161, "uuid": "f2722ef5-8b4f-4ca7-965a-8c86609f8b67", "value": "12288:0sX+bKpQDIyBwU56GgRdrL/PBNitrZw5Btkspgr5mrGZ+OK8I:0sX+upQDnCUY5zrj/iU53tpgUaZ+h8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258161, "uuid": "bca97c84-92ed-4ff4-8d65-5f807f1495c2", "value": 649223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258161, "uuid": "94100873-8976-472b-8399-6c7187fcc06a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258161, "uuid": "2832ac41-624f-49cf-b17b-ce828ff832f5", "value": "payment status.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb898b5-8e69-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701229530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229530, "uuid": "b0f8f2e4-2bcd-4ba9-8d2f-ae71347f57b9", "comment": "Malware payload (RiseProStealer)", "value": "f5f489663997d5c7f303889ed47f53a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229530, "uuid": "2244112a-485d-4679-ad2d-9915e28dd6b9", "comment": "Malware payload (RiseProStealer)", "value": "8f682183913956c6d0414d2ee9165d9f31957934507b4fb010e1eafd29b3cf0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229530, "uuid": "30d48d64-8777-4b20-93b2-234eac5a030b", "comment": "Malware payload (RiseProStealer)", "value": "40e4ea5dce0a787fa04d29372aec81482e7fc8d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229530, "uuid": "2780fa1a-620f-419f-a154-61cbccda8ae8", "comment": "Malware payload (RiseProStealer)", "value": "654383592e20d8c2570d1c0bff6fb99b3f0b354f7023bd0c35990f26b82d78d79f6381d187011f5f4bc07bbbc6c353fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229530, "uuid": "4d9b66e8-63f9-4162-ae81-b549f8928cde", "value": "T1F4953342E6DDD065D5B42FF0E4F62BE31C773CA26FB0575A26597A4A0932A10E53033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229530, "uuid": "57be2d50-bc8f-4f95-a651-d08907ddb26d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229530, "uuid": "eddf6c67-b830-4e48-a4fb-24742e3a3c2b", "value": "49152:9ZbPIozeJmS5jTbHgY11txCrvSQr6Kvmb9/GdYLGD0y3hs:DHumS5bGvSMBvmbpdloW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701229530, "uuid": "15db3f90-2592-4982-8c45-cc773effa5d3", "value": 2024960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701229530, "uuid": "c95acb8f-881c-4d3f-900b-52a0fa3bea23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229530, "uuid": "143fe00e-3e07-4e37-8130-1cb3dfa6a913", "value": "f5f489663997d5c7f303889ed47f53a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0abc1c-8e58-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701222331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701222331, "uuid": "b7161f65-91d9-4021-80d2-a1c087cf0da4", "comment": "Malware payload (Stealc)", "value": "fd72250981f4893adf7b46f44d41444d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701222331, "uuid": "084bd41e-c20e-451e-b11e-edafa5e8063f", "comment": "Malware payload (Stealc)", "value": "904911e002a065b01a16fe92c9f86493bb9af9ba08b554c3da4011ade98a9936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701222331, "uuid": "5308a144-2bf5-432a-ab62-62f018a84568", "comment": "Malware payload (Stealc)", "value": "0afd8363990942e1c78250e9e0915d70c168a30a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701222331, "uuid": "96a2a38b-b4d8-47ac-b7dd-549980e42121", "comment": "Malware payload (Stealc)", "value": "05e24ea8defe3ce98abbf58fc5877030251b8acd8f8198b3b394ee2d14fc5376550957176e376094e8222765a3a5555a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701222331, "uuid": "56ff579f-4625-443e-a151-288a10a910e7", "value": "T1BE54D65382E13D44EA268B729F3FD6EC770EF2918F497B6921189E1F04B11B6E263714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701222331, "uuid": "d7a30e03-692c-4475-b492-20ccc53d2312", "value": "4dbc83cc54bc51fb114f9cf586b5210c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701222331, "uuid": "5db68fa7-ce62-4189-aea3-5b4139bda514", "value": "3072:jtc2Zh4jyfnyvnPLPB5X7leh5bQ5LlxG:7ZkyfnoPb7leh5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701222331, "uuid": "49d81368-62bf-43bd-a69e-ee79638b1b06", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701222331, "uuid": "ab1a3966-1230-46da-b827-a1c7dc18abc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701222331, "uuid": "e3ca03f0-caef-4e7e-a053-b97177343537", "value": "fd72250981f4893adf7b46f44d41444d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0900065e-8e95-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701248124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248124, "uuid": "2a23cf01-db52-4b2b-bbbd-06a89eae6041", "comment": "Malware payload", "value": "a2cb216bc5d367e21e88a1b3514bb80f", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248124, "uuid": "95ccad24-72e5-447d-88cb-064274712f64", "comment": "Malware payload", "value": "9085492cb286de93e5827917b70ff0766d2428b6f7fc3048f832a21fb48d0c0b", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248124, "uuid": "c9738948-5486-4ddd-a402-38f87ed71b33", "comment": "Malware payload", "value": "c110a62e0923270c55837ee204d135cb1463f76a", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248124, "uuid": "d1371898-2cdc-4761-9d5e-881a62f343fc", "comment": "Malware payload", "value": "b0eb128b6cc33485a2739f06ff370e491eea40d03491c27a028749e90cc69b89792476906d0235eb3d936771247c5efc", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248124, "uuid": "4e527e35-49a8-4e81-a794-e63dec68cca3", "value": "T146619F932151B8EA415283BF3E596AFB807FC224954A7044F78C4F99F9DDE633A8D2C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248124, "uuid": "b558f607-cbd4-4eff-9cf0-bd670c5fa236", "value": "96:IGtz+v44CHuSf+1INCfh5L0HRmAiBrVM2Wsa:36Q4JaRHRmAiBrVysa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701248124, "uuid": "34e60f05-5444-4dc6-9f6e-334bd3a4dbb3", "value": 3249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701248124, "uuid": "39f7f803-c368-4131-95c0-21ef68291124", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248124, "uuid": "8740e745-c098-4e5f-9a78-0af442f681df", "value": "J8dgYwkt.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901cc9a1-8ec4-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701268537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268537, "uuid": "ae666841-283a-4e58-afc5-88c5798e062a", "comment": "Malware payload (RiseProStealer)", "value": "ab8692644d2d4895a58c5362dad1e4de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268537, "uuid": "0a326169-dd88-45da-94d1-7f43e3283fa6", "comment": "Malware payload (RiseProStealer)", "value": "914fb27e6fcc06d274cb0803c948b798f24a89133b07089c4c5d1c5d1330a492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268537, "uuid": "e664e0ad-31b2-4b56-bd7b-89dc3c816bb6", "comment": "Malware payload (RiseProStealer)", "value": "c6de0b9e5eace4e57ad8fbad593ddd39c5a616f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268537, "uuid": "ae01c884-e2ea-4b18-92ad-f0bd3d7b8794", "comment": "Malware payload (RiseProStealer)", "value": "ded280423a407b5f659ce36758c2a9e8465da0cce892060cc3cd4888b03008e6869d518154f2c4e1c4a06cc1b63fedbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268537, "uuid": "4eded6eb-902f-449a-8617-afbc1a78a81f", "value": "T1E2752387BAE8F876D87723701DF6079B07357CE1E578C220360166CA19A3AC8953677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268537, "uuid": "a2adf5e1-459e-4efa-9b31-55c0f38a43e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268537, "uuid": "7dff6215-8729-499b-bdb5-2a8f411f6fc7", "value": "24576:Bys8k2RFBRJxKOfiUyEuOBv6sxWEEdEqEh9bglmXv1dTYMsKEkNnnho:051RVjw1ON62WEEZEhecfHTYMKWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701268537, "uuid": "876b6fca-66e2-43be-8fe6-e9e2a3556e0c", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701268537, "uuid": "8c5b23c0-6a4f-4fc0-8ccd-214dbf5fe68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268537, "uuid": "8a669319-a681-42db-91e9-bd863a8bd97c", "value": "ab8692644d2d4895a58c5362dad1e4de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bfa9b1-8e99-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701249949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249949, "uuid": "642d9479-118e-4b80-a699-672c359cd2dc", "comment": "Malware payload (Formbook)", "value": "abba4cdac262004dd9bb616597f2e1f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249949, "uuid": "7da206b6-9988-42ee-a649-b528a08173b2", "comment": "Malware payload (Formbook)", "value": "949cd20c34db89cf95e823fb570c9d6454516ab2aae306a5a5e47a96edbe3f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249949, "uuid": "3203781d-0e7b-4336-8a44-2301da20517b", "comment": "Malware payload (Formbook)", "value": "c90d02568f7475572cb928ece1c4011748446d1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249949, "uuid": "e2fa6d1f-bfcd-4f45-bf71-2810b13aad93", "comment": "Malware payload (Formbook)", "value": "49223d5c4c71692eaa8ffd42398b1c6b5fce4a573e4967e140f2ac42d22533461eb156b2bc10412fc37778cc9b8a1176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249949, "uuid": "c87efd5c-f5ac-4d93-a733-47301a3c1373", "value": "T10005F1A4E394DA9AD45B8BB219B1843263F37D6D8CE4D31D2C89729D0DB1391016FF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249949, "uuid": "74fc0ae2-9eb1-489f-a51f-f5ba3235d838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249949, "uuid": "c07db846-5c85-413f-896e-75594da03dfb", "value": "24576:Bf1tD/z5ReVlJOCKYe9bmIIhB4QR0NeahlM0:BvylJOasbmIIwQRkXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249949, "uuid": "1b782ce3-a9c1-4636-82a0-0d6b2924c60c", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249949, "uuid": "8b4ebca3-0b5d-4adb-863c-da269614de7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249949, "uuid": "f52e3b1d-acf4-4482-be18-8a93ad4bf3a0", "value": "SecuriteInfo.com.Win32.PWSX-gen.26378.24333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2237e162-8e6e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701231416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231416, "uuid": "ff9ad2b3-a495-414a-a6d7-3117792f8183", "comment": "Malware payload (AgentTesla)", "value": "4ccf84f590e6c4dfa22197adbefc838a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231416, "uuid": "8070e56c-7768-4ba0-ba1c-0f1332704dbc", "comment": "Malware payload (AgentTesla)", "value": "95598427818779308437272ced1a1a8e293da280290791c15721d4a5b3e25fb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231416, "uuid": "7b3162a4-41bc-448b-90c1-3fb10c32f13a", "comment": "Malware payload (AgentTesla)", "value": "7c2e288c91fa5d0e7848f4352e992dc19e053ca6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231416, "uuid": "23fb6fce-2d5c-48d4-ad3a-9661c8f1b29e", "comment": "Malware payload (AgentTesla)", "value": "b91804a99a312a02289cc6c78b7abc20da3bfbed54d9d40a403e72b773e96bd41ceabe2eb71e9fec774fe3d1f1f072b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231416, "uuid": "515b1637-ba98-4169-ac9c-dabefd78351c", "value": "T1E6E4129662AC8763EC792BB31974C5B013317D161472DB4E1EFA6CE77B63B104682E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231416, "uuid": "98441771-4a30-4768-9106-728e3c4c98a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231416, "uuid": "a95bdefc-c4d0-468c-ad71-7d9480f2bcba", "value": "12288:/hCCCCCCC8CpCPCCsCCfcopox4W6AMiXi5+zUojlXd0OuUM29cUYnwfC8t5Y8WeS:ZCCCCCCC8CpCPCCsCCEeq6ZaUo5XaNUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231416, "uuid": "6bdf2fc1-ca08-4af2-a304-7f3da4a13348", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231416, "uuid": "215c1f2a-d844-49d5-9301-3e280b494697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231416, "uuid": "a1b74516-4a28-4da9-a3af-aae0168b15fc", "value": "SecuriteInfo.com.Win32.PWSX-gen.26942.1928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af211183-8e8a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701243678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243678, "uuid": "ce93c7d9-482e-4429-8a57-5eff3e6f3813", "comment": "Malware payload", "value": "d1dc542c901b7df84652893e916239e6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243678, "uuid": "5fe50cb6-93cb-4182-af1f-688f8a3a9509", "comment": "Malware payload", "value": "9820b21d74270de61e9c350b7e37f2bad95d6fd6a2ef1faca9f3ea40b04e3eda", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243678, "uuid": "f237f118-f26c-42cb-b8ad-269728b24e57", "comment": "Malware payload", "value": "44a47433b5b27b801d2d9915d07916f80c385c3f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243678, "uuid": "f31ce27e-8301-4127-b84a-6bbf48579020", "comment": "Malware payload", "value": "399460d359dab547f35065895c753e1ffa84b20fcd2eaef1174af034fb36c83fe3ff9cdc00d4649c33e54e0d35b8ee91", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243678, "uuid": "19457bad-038f-412b-9408-65211a84040e", "value": "T11BB2631FD6B3428C2BE06345D3026E6B6682E552F03109163F5CEB995FF9393E5A107E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243678, "uuid": "83c7e3e0-9292-49db-ab7b-0480a431c4eb", "value": "768:sowB8MBVVLMthWqtFHsLSMAw0Ph8zpkJYmLG:soknB3oxMN0J80ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701243678, "uuid": "6def1a49-0e2c-4635-9a44-d554f25db775", "value": 25050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701243678, "uuid": "677f82ee-d106-4321-a4d6-5694af1837c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243678, "uuid": "81fdd317-1431-4387-9a51-e98d5e4ed47d", "value": "4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5331b66-8e82-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701240306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240306, "uuid": "36a20dab-4dde-4dd3-a45c-19bb08c2994f", "comment": "Malware payload (Mirai)", "value": "6cd74d8d1b21e4a36c78ae93c7245f6a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240306, "uuid": "b9ddf4df-cd4c-4e32-b04a-7e70648fc1ea", "comment": "Malware payload (Mirai)", "value": "98535fe089ed72b9a2a156a10c2380f35e8ab937aa9c42aa0421f3a1bcb38348", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240306, "uuid": "ae337005-053d-4fd0-ad8d-653f682881cf", "comment": "Malware payload (Mirai)", "value": "0dfb160ccba46f6b481106cdd425b2295ca8c5db", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240306, "uuid": "8e837a2f-b576-4642-9f34-d354d6c28267", "comment": "Malware payload (Mirai)", "value": "6a95f8bc102c08de9eab6d2e8b69983c7ac5dbb48a573b6c0e6c240bcf3fa7f3c2394f761b53703d08f15a440fe2e2b7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240306, "uuid": "0e4f99ea-8944-4211-83b9-6fa30f693e84", "value": "T16B332A03185180FDC858C1705E7FAA27D933F07D5235BE4E33987E22AE5AE212A2F959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240306, "uuid": "0b1cea0f-1707-4942-90a1-896576bf7d0a", "value": "768:2gOG8Yu6gDyWoqeqJrnXXLliTJlmlLY0IUqYlxU7UklLThy0beLrtd4MuqpW3sKX:zlq2qJrXbETLmlLLbG7UEThy0aH4J8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701240306, "uuid": "8fe7e8e4-8c13-4ef8-91f6-f37914e027ad", "value": 50432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701240306, "uuid": "5255eff4-d485-4ef2-adaf-55d43b770d6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240306, "uuid": "29584122-4fe6-4424-a884-7efa92f72db6", "value": "6cd74d8d1b21e4a36c78ae93c7245f6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39170233-8e98-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701249493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249493, "uuid": "d76259e6-1429-48a3-9a10-c69e37cea6a7", "comment": "Malware payload (AgentTesla)", "value": "311ede1b854dec695a78d8ca124b2c2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249493, "uuid": "1c6d512a-5598-4876-ac4f-8aa8e57a75d0", "comment": "Malware payload (AgentTesla)", "value": "99591cb9a83d89883258daf0941a96afb50325fe18e1422046a2976a47cb321f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249493, "uuid": "4d64b163-5dee-4b35-8ba3-cf98d67513ee", "comment": "Malware payload (AgentTesla)", "value": "7a2640b29b2d17197a564db5686f2ffcefeebb57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249493, "uuid": "7174ee30-890e-4b7e-9e1f-e732b466a962", "comment": "Malware payload (AgentTesla)", "value": "2254bd83c4b4a0a806c12b3b865632b3cb9cf17a202f714f15b5206057c22e51986e442e3a0181087cdea42a1a712712", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249493, "uuid": "1aca3e91-9517-4414-9de8-8f39d281fc8d", "value": "T1D6D423A0A76DE313E93E57F28546A54023F914ABB776E34C5DC420EB0A3E70187A4F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249493, "uuid": "8a4eae69-f6f4-4795-b215-3e017ac5e8c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249493, "uuid": "eb1bbadc-b0b1-42c3-98e6-b88c7f4c1922", "value": "12288:k+tzd7BR6wTXTFwNS4XEI44P0VZAScRCy666JPmGeTh3KPXT9YVcN26:k+tzpB/FwNS4X6VZARRJ666JPpsh329t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249493, "uuid": "33766a99-816c-45f0-8b5e-d3855c280b13", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249493, "uuid": "ede309cd-de7f-4abb-909b-9d45f0736bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249493, "uuid": "db05f441-d608-4af4-89ce-218be07d8728", "value": "detalle_transferencia_2023-11-27 T164016.829+0100_0441490002016857.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01c3856-8ead-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701258739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258739, "uuid": "901549bb-b664-483c-802a-ce35d548e817", "comment": "Malware payload (zgRAT)", "value": "0bb9f2109020fa10a3c8f534ff1376cb", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258739, "uuid": "98399a78-b388-4fa4-8a05-1add7846918e", "comment": "Malware payload (zgRAT)", "value": "99a57739b7d853c2836d11e852c27f91e587f0193d6d160334637463009a3ab0", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258739, "uuid": "86000d6e-c146-4fb0-b4e3-e44610639db2", "comment": "Malware payload (zgRAT)", "value": "5333942d6f0df6eb2d88617b23ace70ebff072d1", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258739, "uuid": "843c78e4-9453-4f6b-a653-d8fdc24b52c9", "comment": "Malware payload (zgRAT)", "value": "0b869ddf6109bada6c4119c3bf1d892ad357aa4200fc4232ec6562c8629ba6021a7c4ba6f34850fc90c1200c33bcf294", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258739, "uuid": "a8279c16-0251-47f4-b991-1352c234593c", "value": "T12F75AE012785C9E6E24E17B1A09B4D603BB8DE4EE166E71F3607A375ECD7325240A1EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258739, "uuid": "37bb1c98-3f70-46ec-a3f1-6c1a8058e7f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258739, "uuid": "e47ea00c-a27f-4f91-b06e-924d9093c77e", "value": "24576:VMRARAB8XkDQC0+qWlI/qQTFAmnLuZ7wbv2b10Fa4qzTDf7dQ:VMRARAB8XkDQC0Jq+Am1kSqHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258739, "uuid": "de097cfc-5b79-4f4a-ba0d-e0420b97ef5e", "value": 1550896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258739, "uuid": "5d6e7eee-1a50-4042-9ed6-10e9ffcf7ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258739, "uuid": "f1613cf0-cfd1-44d5-b49e-a4fbc3996193", "value": "CIPL.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb9d344-8e97-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701249392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249392, "uuid": "0d6fa018-7f44-4e5e-8b14-541bb6bc682e", "comment": "Malware payload (AgentTesla)", "value": "e7685e33c1fa04e9d688a23df0a880f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249392, "uuid": "d9f461fe-0fb2-4423-bda9-1c32fd34ce5a", "comment": "Malware payload (AgentTesla)", "value": "9b5d4319bc8665a9400610280c9422733f1926735a0174f557cf8b28f3a06904", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249392, "uuid": "4f171352-8e54-46d0-ad37-1e0747a792ea", "comment": "Malware payload (AgentTesla)", "value": "7ff0e9552bcfcac4e9ba4959d99d0e73f2f19bd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249392, "uuid": "945d8a4e-2971-4e8d-970e-cb4e29a17d47", "comment": "Malware payload (AgentTesla)", "value": "3b508a9f80437783f1555a22a9fe7860a93eb4e513e7b81c73b011233ea9e352ff414d12139100f2ce4b9749eab0826b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249392, "uuid": "f31335ff-abe6-4b38-ab8e-da56a3c8bd43", "value": "T1BBE4124527ED9B53E27A87F61AA0610007F62956A2B1E3B81FC366DF2162F044F44F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249392, "uuid": "ad994aae-1e77-48d8-9b1d-890552fa5d5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249392, "uuid": "028841f3-b2d2-44d2-be7e-9345a4db0e19", "value": "12288:9r9E7BNagDxjKeW9CRtFfzMdrrkUFVoJbFRkbsTPkDKQmbCp:9riGWjKeW90tFfzMdrkUF2JBRkbsoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249392, "uuid": "05b9859e-e19f-4de4-af00-00c2ada30ca6", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249392, "uuid": "1828ca2c-3bcf-4ec6-b31f-49aaa9f986ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249392, "uuid": "f068080f-763a-4592-bedb-f1ba6c10d35f", "value": "Bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ab30d3-8ea6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701255683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255683, "uuid": "57471166-dc13-4f3e-a867-f0306d7e935d", "comment": "Malware payload", "value": "7a3334d31b484efd274f83591308ba00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255683, "uuid": "96f3db12-1579-4b15-9463-d2285b960ca0", "comment": "Malware payload", "value": "9c2d872fbf03c564452ffd898153a5a869a1210ab27212b8d4952ec11e158356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255683, "uuid": "9a3d12a0-4bd7-45d8-afbb-1943568ba2dc", "comment": "Malware payload", "value": "7b5b879be43bf7edc10d0c456f709cfc71963a7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255683, "uuid": "ae3c2e87-70cb-4a49-8c4e-7caef434fc52", "comment": "Malware payload", "value": "0b35da2113fdc178fb0478d2c9dff5b05207412f26edd11d73372ccdbf94254c1e6fc8f714b6ead827ec489922bddf58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255683, "uuid": "dc48efe5-3721-420d-89c4-fd59721aa6a1", "value": "T11EB62301678AD6EEF34C1371D05418E43BB9CD2AD156E3AF494AA6B0EDD33681B091BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255683, "uuid": "28fbd3c8-2224-4921-ba0f-88f7d2c394ef", "value": "196608:jrd7kWcZDTrPDRRgZkVzSCaUEHcXaYHYPtei4frKIBPMN:jrGnQkZaUEHcK2srgrKoMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701255683, "uuid": "562ba9b3-de59-4590-86cf-303b8552ec4f", "value": 10793112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701255683, "uuid": "d4fa246c-d8d9-46c0-aae8-e1c4661fd269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255683, "uuid": "41e5cc67-8652-4263-acf7-5dbe50f5e73d", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1621a66e-8eb9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701263608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263608, "uuid": "5c87731d-c354-4f1b-85ea-8381b795b5f3", "comment": "Malware payload (Formbook)", "value": "6b8f46acaa48a95adde7df792fc5b3c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263608, "uuid": "797b644b-4f36-4f66-9953-3c55be9af032", "comment": "Malware payload (Formbook)", "value": "9cbbfc870ca06ad6a9140714a7d96086f4b9d153c460b9941eab0d8a8092460c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263608, "uuid": "63e791c1-11c3-4202-93a6-b9428c0e7039", "comment": "Malware payload (Formbook)", "value": "7a81814affb740a99b358e4a693c7a4cff9bd4cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263608, "uuid": "885a525b-198e-46a2-9e74-90a15ddd6f79", "comment": "Malware payload (Formbook)", "value": "96be0ccaba3fb1cd00f12a4b5a56c51e31b75870b232aa79c69e637a47835906e42382b7afb7ec862fda3c9bd3d2b911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263608, "uuid": "92c2fb95-8603-4b16-aef3-712522ceefca", "value": "T14B64233F51E2C8FBD1324B72AEB793BAE3B5421515054F861390DF2F3D719E2A85A680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263608, "uuid": "276199e9-ce55-4a1c-9325-49a6c3f0db5d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263608, "uuid": "76f1c1cf-8f88-469f-a324-70a7e2d18b40", "value": "6144:wBlL/DQOrJ27hlyj4hEPLz0Tct4OaLzfA655CXlpG9OBwdOa3pEem3:CZBi7zhE8GathswUa3pEem3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701263608, "uuid": "b9d9ca0c-f93c-4210-84d2-5bec7192c6aa", "value": 313341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701263608, "uuid": "11f7ebb0-2c3e-4af8-8326-8d4e6a1ea1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263608, "uuid": "8e82f450-e99b-4b94-9bfe-af6db942e283", "value": "Statement pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9621d9-8e6a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701229828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229828, "uuid": "07e9f812-3995-402e-af25-6483e0a2aafb", "comment": "Malware payload (Formbook)", "value": "c0e083b5c2f74953610f37a813df34ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229828, "uuid": "cff30e1a-ea59-4378-8939-6e0f814dae08", "comment": "Malware payload (Formbook)", "value": "9ddd49af996a38fd9c7ed309315ccf9db5f97e75cc58144dc72ca598746df3d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229828, "uuid": "0dc524f8-217e-4b63-9512-cce0eaab40af", "comment": "Malware payload (Formbook)", "value": "af30f5bcdb778eb4f502ba4374812c722bb17895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229828, "uuid": "e01c309c-6fe8-4905-a050-42ef01d2264d", "comment": "Malware payload (Formbook)", "value": "d2e716ad1eefb742651f1e968f0053f0f19a67586deaddf388288619113030fb9012e5261831f2d7221ef1f332d18c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229828, "uuid": "9631e0da-f8bc-4691-93d6-6c916ded8a9b", "value": "T141852302A7CCD0C5D5FD3BB05CB787A3057A3CE4FA74965B275AA95A2D22190F0213BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229828, "uuid": "1b2971ca-db58-48c6-aef0-462797b37f71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229828, "uuid": "418afe15-78ca-4650-8d0c-75052afc0766", "value": "49152:HU6gjKEFa9jIBLE6RLviWXavYaC4cjyZ0:06gjKHsZavY54cjy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701229828, "uuid": "ce5d1d2f-1930-4546-af9d-ce95f0bda2e7", "value": 1723904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701229828, "uuid": "31ac11c4-09ba-4db9-ac6f-d3394eb7c3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229828, "uuid": "7d97e583-8b3f-41d6-9c12-a440ce1dfa4d", "value": "c0e083b5c2f74953610f37a813df34ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6b3f18-8e5e-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701224722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224722, "uuid": "06540fa2-7b3a-47e1-aea8-0031bffd7970", "comment": "Malware payload (RiseProStealer)", "value": "e796e3676c9adc0e629111edf75478ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224722, "uuid": "9c888b66-4cd0-49f8-93d1-fd18e7a3edc0", "comment": "Malware payload (RiseProStealer)", "value": "9e1aada06c334b3d3e9220affa9dc56b5689b1df0615899026510b1a8f0ebb78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224722, "uuid": "4d76cf34-0fd1-4766-88f8-5fc15fef9bc0", "comment": "Malware payload (RiseProStealer)", "value": "3f345185ece4c640313ccfe5a1b7ad76328ed00e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224722, "uuid": "80f5a90e-d556-42a1-bad5-422cc2b92725", "comment": "Malware payload (RiseProStealer)", "value": "097f9930fef6915ba721401acfae19a41c17622eee01871749535e0638256744b99f228bb895f539750283f40e501796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224722, "uuid": "ef22a3df-2ea6-461b-a820-93f8d51aa317", "value": "T18595330662CAA072D7F06F7559F767931137BCD56FB893162211ED0EAD23250E8B232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224722, "uuid": "216dc8c2-0723-40e4-a8f7-c91667c24870", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224722, "uuid": "1dd2c7e7-b7e8-40cf-9232-dac6522c1ed0", "value": "49152:kyxkjls2AjXWZmWomZ8dqTvCcnhix3DqoN85xyPccHe/h:J6s2ATy1dhiMoIxyUN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701224722, "uuid": "718ef982-a273-4a91-943d-3fce04bcaabe", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701224722, "uuid": "c0637f7e-ab2e-4934-bc2f-d94bf4d4549f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224722, "uuid": "b31af469-ff6b-4b42-95cf-4b3d17ce7360", "value": "e796e3676c9adc0e629111edf75478ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac5327a-8eb9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701263670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263670, "uuid": "db6df884-9ffd-4aa1-af34-50a012ed83e4", "comment": "Malware payload (AgentTesla)", "value": "148912416438c5ff9199ce3f60d7963e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263670, "uuid": "939f302c-b63c-4d31-add6-32465768486d", "comment": "Malware payload (AgentTesla)", "value": "9e480e05facb9eae22d1ebe3fcbbf74877cbcbea28123c9fbec58a508be2dab2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263670, "uuid": "797a2efe-577c-40f6-8232-3a7789fb5823", "comment": "Malware payload (AgentTesla)", "value": "71e3bf4c604653ef8245189ae330f84bc64629c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263670, "uuid": "718e41b3-8df4-437f-974f-4496d26d0c6f", "comment": "Malware payload (AgentTesla)", "value": "9e0f545596efab036ddae96ef2ecabbe3c55cdf79d9f312969e928327f33e934f06d39de3aefe756b0fcee768e2ed05e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263670, "uuid": "955fc7c1-5ef3-4627-85e1-e5baa8268abe", "value": "T136E412A9768CD672ECB923F01831C47153367DA929B7C64E6DE26DEF7C633004642A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263670, "uuid": "f395fb61-d4b2-4973-b73e-c7e419222356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263670, "uuid": "a52224ec-ba96-41d1-a38f-5ce9764c573b", "value": "12288:4Z3copox4wwSy1npDKEpQzI6T/0TlinhqVmWRi41vwulX9pDw7Hqp0/cHL:gse9SCnNzGI6TGl2qVmM11NlX9tm/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701263670, "uuid": "74da2e22-ac3b-4b80-9539-f56ad14dcb0c", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701263670, "uuid": "4f4a6ea1-88e8-4c9b-87f0-d57fd0e73e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263670, "uuid": "f62d8365-6c15-4cc6-8a75-d7005f97ad02", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5647f676-8eef-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701286909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701286909, "uuid": "c79f81f8-9647-44e9-b6f2-d367256ba150", "comment": "Malware payload (Stealc)", "value": "8d8105c469880f463b2f2a9adb06a941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701286909, "uuid": "a64c13ca-eea3-423b-89cf-c58c48890721", "comment": "Malware payload (Stealc)", "value": "9e7d1738d15d92b3bcd8838788eedd625ce7914b194696f3e3f448ec2ad6ef47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701286909, "uuid": "099e8003-c575-408a-85be-2b2d5e056c2c", "comment": "Malware payload (Stealc)", "value": "9da60a198b918ee67bf648b44797e9644407d3bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701286909, "uuid": "326fbd9d-0ad6-438f-8fc7-02ba826df118", "comment": "Malware payload (Stealc)", "value": "c462e5ac6dcdcf208a71ad28e67bfcc848c96a2f00b3e06e1e72198a3aa740fc4cc3af822009fcd3116cc2355c13f070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701286909, "uuid": "d026badb-ec0a-41e5-962b-4579ded607ac", "value": "T11634BF2176E0C032E12749324AB2C6651F37BDA69B7146CF27A42FBE5E312D28B75347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701286909, "uuid": "ec39c652-8b77-49d5-b2af-12f406eee2b0", "value": "eebe007c35cdacb43a780348e45aefac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701286909, "uuid": "d30499a7-0762-4617-94c5-b657c80d0ee9", "value": "3072:rFDkGgz9GdZGRakOC4oehxol1X2AcIEjZSc+itRQCQ4SHp4:JDY9/YXC4oQxol1X2RQBityU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701286909, "uuid": "a77543af-4523-4aa6-9453-c40f67439131", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701286909, "uuid": "520c34c8-c666-48b1-92f3-5d37c5286b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701286909, "uuid": "b0d3cc6c-d5ec-40a0-9872-c15e65bc2648", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef26ef8a-8ec7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701269985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269985, "uuid": "c5e995b6-d6d1-48d3-86e8-59b302249841", "comment": "Malware payload (AgentTesla)", "value": "19756903faeed036e6830e9fd6134e38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269985, "uuid": "6f0408e7-4a4b-494e-ab69-f3642452f9ab", "comment": "Malware payload (AgentTesla)", "value": "9f565b620269984af556f3bfa3b6dc117c219f05c66c7ae8311f4bed34a72618", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269985, "uuid": "0f2259ae-8274-4f38-9f26-c4e00b6b3465", "comment": "Malware payload (AgentTesla)", "value": "a147ebb5acc931ed283ad08e7bd0d283961fa90f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269985, "uuid": "08863880-085a-4a37-8aa6-eb8d32948d9f", "comment": "Malware payload (AgentTesla)", "value": "210aaf61159719f27cd1e9de2477ebdd1cebe9b4789f6bafe567d9a14c13733b0d9cc32c9245db33c2eda57c66c5cf39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269985, "uuid": "a9a9420e-fca9-4b08-9e42-5093b5f7b7b1", "value": "T1B21502047B7D9F26C1B147FD89A2A20043B0AD272925E746BE813DDE39B5F841E41FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269985, "uuid": "13543510-7584-4679-996a-abf1bfe05055", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269985, "uuid": "3457c4d8-2913-473f-b133-d3ad99d40b87", "value": "24576:jOpMyBI0FRVGvyFavNafUIfSrbIOodeYNU5C2yq:cM6I0T+afjqXIOod4Qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701269985, "uuid": "5895682b-a2f0-4885-a372-1966cafb2aaf", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701269985, "uuid": "5739e03f-12f2-401a-82f1-24721cc39a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269985, "uuid": "051923c0-8b0b-492d-afbc-3af43ba1a038", "value": "Ningbo-Overdue 974356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3dd73c-8ef7-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701290303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290303, "uuid": "6ee10742-1e47-4f90-826d-193e60b070b8", "comment": "Malware payload (Smoke Loader)", "value": "4ac2de72c9584348d7558ae26d550136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290303, "uuid": "9385a45a-eb71-468b-9e87-a2c3d6fcc6f4", "comment": "Malware payload (Smoke Loader)", "value": "9fc2b5828400d8e69b6525bf842bf2552a8d4528df701e41eac20cf1afa15285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290303, "uuid": "4c1ab78e-7f71-4d10-9816-120d65e3a71d", "comment": "Malware payload (Smoke Loader)", "value": "61e25ae3a4e2fe5c02fae448de9bb640fa577cd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290303, "uuid": "bb1f71df-2feb-4582-bcaa-58affde827cf", "comment": "Malware payload (Smoke Loader)", "value": "ed51fcbdfba4ca94896e827debb7cebee56f6e66e7b9dcdfda9273ba982968109219021bcca51bb8f005ad2eb36aa66a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290303, "uuid": "97bb4a7a-73ca-4584-b910-59601233329b", "value": "T1B334BF1176F4C032E26749354AB1C6A51E37FCB29B3297CB27A42A7E8F312D19B75306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290303, "uuid": "fef07254-79ee-4c06-83ff-661114434dc1", "value": "fc956831b783140e741d0df04dc16771", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290303, "uuid": "c155d0da-5b74-45b2-a797-04dc8c31dc68", "value": "3072:dN29Ke7U3JNK2rlhZ4Nx8Zcqx9uDqYeGUjGFQ0lVNHpLk7FSc1QbBf:e9I360HZ4NxGXBFbyFQ0lVdC7FP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701290303, "uuid": "62373b20-571f-4626-b566-d3f7fb153212", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701290303, "uuid": "a00d29c4-be75-4cca-9662-89a441511eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290303, "uuid": "1b01b8be-97f8-4a34-8096-d11813b439c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31226874-8e65-11ee-8907-42010a9c0042", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1701227576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227576, "uuid": "c6d58302-64bb-46ba-9517-685268d26fda", "comment": "Malware payload (YellowCockatoo)", "value": "4977a55aa956fe1db62c2317c155b17e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227576, "uuid": "5125cb41-d738-4e94-9182-e3aaa9146e9d", "comment": "Malware payload (YellowCockatoo)", "value": "a07b1cf78a54dae125dd8a0bde61dd58f4efcf7a798172613e951ba3a180f2e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227576, "uuid": "a3a10589-ad55-4021-bce4-665ac7f51933", "comment": "Malware payload (YellowCockatoo)", "value": "bfb13da5c8177be7fdbed224424acbab1afa1ec8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227576, "uuid": "bbed2cfe-8bac-42e5-9d60-a4214abf8101", "comment": "Malware payload (YellowCockatoo)", "value": "fa4a18b4aad52190ac697d54c78ade86179b715fc344945cabaad06f4bedeab51b4a6e82a2844886439a3e3683165ffd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227576, "uuid": "7648fa36-1d9d-4d24-946e-93bf8c731c6d", "value": "T161155B0473B5CA49CFEC6BF4689B5B13BB60A2F3C6C18F511AEA55B71B4A935C48C0C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227576, "uuid": "f3b755c7-ff40-4981-9ad7-3c02127311be", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227576, "uuid": "ccf5bf20-aedb-4604-b909-1d73dc4cb5c4", "value": "12288:eaOhG89zv/2F0VSBRgTBZESqvMmi8aWPeY/6Kzseb57PYf/HcqGHEEa24DO:es89z83+B6bvMRcZyBO0fkqiEJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701227576, "uuid": "0f77f83d-fbf7-4e96-9ce0-b64b4362f4ec", "value": 947216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701227576, "uuid": "c0bd8755-fda5-4d4d-9587-568d04f3db72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227576, "uuid": "04939b3e-cfdb-4cf4-960c-348deb24399c", "value": "raduga.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588996bd-8e6f-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701231937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231937, "uuid": "ee5cc203-bcc9-472f-84f2-0b482d143e80", "comment": "Malware payload (zgRAT)", "value": "491310d10c0ea2d217c90a2403c20bea", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231937, "uuid": "3b2b4c64-72a6-4523-b54c-801c188ec5a7", "comment": "Malware payload (zgRAT)", "value": "a20f2623022bc0d5bdc49b235736cc791a3392198d7a601b2478c1974d5d9f17", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231937, "uuid": "7670ed60-2039-4eb8-ab20-9fea99295d55", "comment": "Malware payload (zgRAT)", "value": "5bd371ae2edc0c2cf926e1543e4cdd7d92c83577", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231937, "uuid": "a8349c93-2fa7-43a0-918f-e7467c16fe3f", "comment": "Malware payload (zgRAT)", "value": "95f0492b2a68efec1c2c3e095cd3b71f014eec17ef339ed8e9ce647614a37845e4558ea859f03ed012d3671885d6fbe5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231937, "uuid": "a94a15b7-cafc-4481-83ca-60b8e66dccf4", "value": "T168D53A23FE47C9A3C2492BB7C6D6448417BDD9836713D70A79AE23691843F7BAC4250B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231937, "uuid": "3994a329-f7bc-4878-b74a-8f31647d3fc8", "value": "49152:u2JsT0GBFpz9WN0jJHJR/nd4FcFQflaehCeBQIf2BZphDnY:u2JmnFC9fMpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231937, "uuid": "325c3d90-7d89-4116-9fc8-8b7073bb1552", "value": 2813608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231937, "uuid": "a5e5e5a0-7c2d-45a9-9d1b-3fced8a37c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231937, "uuid": "8e945bb0-f0d0-43e5-9316-595038df6f08", "value": "491310d10c0ea2d217c90a2403c20bea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9028805-8ec6-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701269438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269438, "uuid": "3b9bdeb3-4b67-4875-bb0a-0baa29e7e04d", "comment": "Malware payload (RiseProStealer)", "value": "9dadcb36329348c3632e89418947df14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269438, "uuid": "54fc4a74-21ff-4cf4-acca-3d4aab47c7da", "comment": "Malware payload (RiseProStealer)", "value": "a2a1aa7c9939633566c1449fd70c8f452ac60ad28f4e17bbd303f952b11ef5ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269438, "uuid": "765e5dda-9564-4b4a-a0b1-323b57d6e6c3", "comment": "Malware payload (RiseProStealer)", "value": "a7af32599c5a3bdb838117b6fa6083f495dcfc9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269438, "uuid": "9d108769-7290-46df-9448-fb4a43c9a615", "comment": "Malware payload (RiseProStealer)", "value": "12f3dd98239d21c724a4ce985498cd41f83e03f0d4dd79f9e3b68c7526a9e19da12a8348f1bbd60edb2c424ed4832287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269438, "uuid": "d147c953-1440-4fa9-849a-7f2835484372", "value": "T1EC95330363C44071C27A6FB0927B46E7163B3CE0B5E0A97B2E28F9A95D72945593273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269438, "uuid": "d97760d4-ff12-4ca1-a46e-c1fc2ad87dde", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269438, "uuid": "d03b1581-42ff-4caa-934e-ee5a3b016e15", "value": "49152:xiht3UV4R4q3XT8xn+ENcvrUI3qwIRCNyoEn8zIJ2wPD5:8f3UV4RPN5qwf28zg2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701269438, "uuid": "293b77e3-442f-4c35-85c0-92420a9dc6f7", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701269438, "uuid": "ef0c6941-88d7-4b29-ab2c-f2ec8c02fe51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269438, "uuid": "4aaed56e-fee0-47e0-b811-9d888ae13123", "value": "9dadcb36329348c3632e89418947df14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d920ffe-8e5d-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701224187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224187, "uuid": "3c4231d3-c0a7-4742-8ec8-be31ad226d85", "comment": "Malware payload (Formbook)", "value": "12cbe5d05a529c13fb5eadd0cb9426c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224187, "uuid": "da290cc0-4159-4124-9329-3c708b1bc65e", "comment": "Malware payload (Formbook)", "value": "a308757cedef1e3e5d61e3fb154db2a77c05eea258404f39237b8ed70dd196ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224187, "uuid": "3cda4b88-7cb7-4bc1-90ef-03b79b52b558", "comment": "Malware payload (Formbook)", "value": "bf6b88f4af50c37871e4d7c975d6e65e2a472588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224187, "uuid": "c3ebdf0c-c3f2-46a1-b777-c52a9a5caa1e", "comment": "Malware payload (Formbook)", "value": "b58293125913cff7790e9a948ef18e8f937f47eedd121d1952dbab1745216dc2eacee477506ac92ff236cdf865b04ad9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224187, "uuid": "8957f8b7-866a-4b32-8da6-c872dd369a02", "value": "T1BF049D1178C18172D5B302750AF89B3466BEBD214B766ECFA3C84F9D0A346D2A736367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224187, "uuid": "33d985f4-6020-49c7-bf61-6c21e23393f0", "value": "311fd3f73d2df83ccc26ba1163c75469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224187, "uuid": "138f1c4d-fefc-4d80-a927-72bb545984d3", "value": "3072:8/IB6uP/ne3PDA1ITCsaSAYpfN5RTAB+NVCPJ6PuQcY:8gB6uXuc91GfNTEBaep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701224187, "uuid": "d9bea7d5-4437-4319-9407-ef089828cee7", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701224187, "uuid": "83c092ea-23fb-4f1c-9121-580f7c291beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224187, "uuid": "469813f7-9740-4dfa-9297-790e253bb724", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26992.22695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab679a5d-8ead-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701258705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258705, "uuid": "fada8a02-0fec-4abb-aaf1-17d9840c24f4", "comment": "Malware payload (AgentTesla)", "value": "9c9b1d6d85a85950fa101fd24c23464c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258705, "uuid": "8ae8004a-a065-4cbd-a3ad-3519483e5d2e", "comment": "Malware payload (AgentTesla)", "value": "a30f61fac1e85ef8466d2a06b2fd6462f51b664a2f79101d7460e0f903afc64e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258705, "uuid": "ac946027-eafe-4c41-b2b3-b53fa81686e3", "comment": "Malware payload (AgentTesla)", "value": "73d5898b9935dd788d9b8cc88ef6c7287e14e707", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258705, "uuid": "be0b1f9e-1432-4bba-b220-686a6728c836", "comment": "Malware payload (AgentTesla)", "value": "c979cfd952ab90c1bd9fabd3e23ee493222aac4b21d74d8b2e0229f7faa0b95263b4e5df94ebd8a1d8ef368fa6d766ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258705, "uuid": "04b5386b-93ac-40b8-900f-56cdaa027f1b", "value": "T124150153324465EBCC2E0BB9A443E9B502B47F76B7B6D18E69CAAEB33443702055F079", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258705, "uuid": "62ae7f49-b99c-40bb-bba7-16bfcb461691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258705, "uuid": "b6ad312b-af48-4be4-a2a6-bc85d6b72fe2", "value": "12288:uvcopox4iRF2UVrqF7Q4F17Xg0GJIQeukDiFXhyOMZnRghSGp7fG+0oypplPZKS4:he8VSrXGF9vRxnguf9TwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258705, "uuid": "69c44e5b-8d8f-403d-b1e4-4a0d4b255a31", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258705, "uuid": "7e4db049-9e54-4861-b5e2-859a5f1f3af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258705, "uuid": "b377229e-b70d-4e6e-8ce5-22ab97c0e597", "value": "Ningbo-Overdue 786542.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6bc457-8e8f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701245637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245637, "uuid": "97df1b60-29d4-4704-b209-d4ff5d0bb442", "comment": "Malware payload (RemcosRAT)", "value": "b5c03ebdf8243660018bdfabd4a1220d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245637, "uuid": "46389e95-db19-4ecc-a137-c77d19c03191", "comment": "Malware payload (RemcosRAT)", "value": "a5341c3c97b9d44c87585da52e04c4f04f385c2505114b84ea93902188d8d9d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245637, "uuid": "48933102-df48-40aa-a365-e388133780f6", "comment": "Malware payload (RemcosRAT)", "value": "40e61f9b02e8a43fad8ff993e826075e1bd2525c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245637, "uuid": "c059ab43-9ac9-4dd6-a349-a8eddabf1a6b", "comment": "Malware payload (RemcosRAT)", "value": "f044f4009bfd3f0eb85659363dcbb4ebe00dbe2163b81d38d444a62762c97c24548776b4847e46f5b4be783c579f52b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245637, "uuid": "fe4b816c-287f-4cb2-83c6-2bcfe493e85f", "value": "T182B5BB31B7D1ACADC251FA31277698004D165F5E3F38464E3F8BB5262FF6E0A2099D4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245637, "uuid": "99a35785-24fc-4b3d-9ead-f26d7709985e", "value": "a68d8e2dafcb38cb88133c6298bff5cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245637, "uuid": "7bef14cc-64f2-44c2-9a35-09a804cd862a", "value": "6144:MT74ZKA8lvBnpiz9iDiDP9KVdh0uzohH/+K/UReCVxiOYpraqCLN3WYfKMRP94TS:k4ZKSzsDGyDaH/+K/Ub31MR6muOQrRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245637, "uuid": "7def91ad-d1c2-4e19-a208-a1e2d423a135", "value": 2393432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245637, "uuid": "1bfec898-8907-4a01-bb38-d4f59295aa85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245637, "uuid": "a819b31e-731f-47bd-91f5-c910f3256a11", "value": "BgService_Gap_v5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475e03ba-8e99-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701249947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249947, "uuid": "9621afdc-f125-446a-b4b1-1b0d833655dd", "comment": "Malware payload (AgentTesla)", "value": "f89cb3d560d388aec194dbda65aa9fc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249947, "uuid": "1e4051c1-c2d6-4a3b-acbc-e19e8fdbfe0e", "comment": "Malware payload (AgentTesla)", "value": "a7198e30b7476e90ade4fe4381b80aad3d416198d00a453ed1b4b465df2962e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249947, "uuid": "b9dd0d51-7dfd-419c-933d-a1edabc877b0", "comment": "Malware payload (AgentTesla)", "value": "bdfd818af14c3fe7098eb33a06c9ef3457f9096a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249947, "uuid": "bfdf9cb8-dd39-434f-a6bb-975e9053321d", "comment": "Malware payload (AgentTesla)", "value": "452f4de309ff38451f45e1e9e1b47ceeab11ba59259554559ceb51365c8ff0c2d595de9cc4e20bf33c9947ef1801a7c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249947, "uuid": "830a5fd2-c864-48e1-b739-cb5dc7b42b7c", "value": "T11BE413A456A8ABEAEE3793F44A31900087F67C3B9135C3286EC1B3DA96F5B114D50F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249947, "uuid": "4435bc15-f466-48cb-b10d-f4d714d0240d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249947, "uuid": "898e8939-1598-4311-8886-43cde22debdf", "value": "12288:1Yv1E6jD/ll/wzTzCVHWf2R/c1nEUdGKapyAdbOjuUv8gc3uEopox:qv1tD/LAYHXRU1EUKlsjuU8gKuEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249947, "uuid": "a3040a8c-364c-4e22-bf74-d11fe44b41a4", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249947, "uuid": "71473307-a4d4-48d6-aa85-e2053238be53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249947, "uuid": "0f414377-2cea-43dc-a3e5-9d23ded88cb9", "value": "SecuriteInfo.com.Win32.PWSX-gen.17017.127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c1d0cb-8ec3-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701267879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267879, "uuid": "c0c1ea7a-e94d-44ad-89f2-8ba5b896d6a0", "comment": "Malware payload (Formbook)", "value": "88b0c932e404501921d7e88757bf82b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267879, "uuid": "7635705d-d5bf-4a58-891d-9a1db0f28170", "comment": "Malware payload (Formbook)", "value": "a8149ed051ce39e0fd94eb4f6af6934cc9e5860242aec44c3ea3a36454af69df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267879, "uuid": "02388cd9-5d81-4211-b96e-26becdd1a6e5", "comment": "Malware payload (Formbook)", "value": "41eee5ac71d6c03fc58ba38bc1a47ae6557086f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267879, "uuid": "9c360df7-202b-4e05-b528-d08f943a2423", "comment": "Malware payload (Formbook)", "value": "72de0d7e2a2bfe06d8d16e5f2aac0087036248fb6f51b88312879d4dec65966d6ad9f4e026c928169a9541f57ea85a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267879, "uuid": "d235a53b-8571-44a4-b354-123774bbd6b8", "value": "T1D3E41201A6B86F2AF5365BFE1865265047B1617F7230F3A95EC231DA1BB1F800B91F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267879, "uuid": "771614fc-1300-47de-b0c5-c765e78f48a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267879, "uuid": "2a22d1aa-d91e-4ae7-8f7d-3e4139918172", "value": "12288:eHS21pfU3JaSOyI4/V4ERlG1pv1cUme+NhLuMvz/f1goq2BuqQopox:O/c3RISOBv15u31Q2JQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267879, "uuid": "058bd123-8d0c-4e9f-b2b3-57d7598e0733", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267879, "uuid": "076e889f-35ed-47f1-a989-9fb4874d545d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267879, "uuid": "a393d273-849c-4e0e-8163-e3b614462ceb", "value": "zackzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b22935-8e64-11ee-8907-42010a9c0042", "comment": "Malware payload (RevengeRAT)", "timestamp": 1701227241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227241, "uuid": "1f9c3b77-66ba-409f-afad-0a44834bed1e", "comment": "Malware payload (RevengeRAT)", "value": "1af7a2e45f20ad74e091fc976be0492e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227241, "uuid": "9a49ef2a-fe3a-4ee8-8b81-7b59d95d139c", "comment": "Malware payload (RevengeRAT)", "value": "a851d4ab461d793a24ef9e1e58d6ae5bf6b27bd0ff0b5a0f470b301b1c00a949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227241, "uuid": "955b2297-8423-4e7a-ac14-0e43772e32df", "comment": "Malware payload (RevengeRAT)", "value": "2f38c71b292122b5c8f3c9141d7009440de93c9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701227241, "uuid": "cea537dd-886c-4565-a5d8-4c941ded34b7", "comment": "Malware payload (RevengeRAT)", "value": "eb9a33f77827c97aa67c78e3cec9f32403ede5c29f1a63409fc9c4dd310a7a9385931d175a2727e8d4146b58e3b2b859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227241, "uuid": "e06ced52-9a05-49d0-b3c0-fa6f6052f332", "value": "T1B1622909B3EC0339C5BD07BC0CB242256371E5A39A62D71F1CD890FE8992BD55B60BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227241, "uuid": "38c9343b-1a10-4c5a-bdff-abeecfcc32b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227241, "uuid": "de2510ba-d977-4160-9b33-751ce05933fd", "value": "192:7+8C+EKS0O9ejYTDG8bcp4Ll7GnieXubWyD9JEBkGxVXzqoNNRJc:7NVjYTDG8gp6leXTyD3Enx0oNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701227241, "uuid": "8584a354-15bf-4205-9726-2bcf70bb5b3f", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701227241, "uuid": "5fc6b33e-9343-4267-9443-4dfa77d8d835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701227241, "uuid": "3922f937-89fc-4978-a5bd-56cd26ea9627", "value": "bRXs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5895c086-8ec2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701267585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267585, "uuid": "a671df8b-0ede-4cc4-975a-3117b04d429d", "comment": "Malware payload (AgentTesla)", "value": "ad4c085ac897d3c385b76e6111054e9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267585, "uuid": "ac12a1cf-15de-4c6d-b389-168cf7c02660", "comment": "Malware payload (AgentTesla)", "value": "a988d3605915b2f831729ebcde7d9ef7d169a549f3d3b7b1de604a9c07abee14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267585, "uuid": "a08b7261-ac33-4649-98f9-19baeff3378a", "comment": "Malware payload (AgentTesla)", "value": "59e88ff5d0ee59bcced620419fcbbd7c37608ef3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267585, "uuid": "3b9c4aca-7070-4064-8017-2ef18cefab85", "comment": "Malware payload (AgentTesla)", "value": "065deb715cb64b44752e83a72af35ecd51948c8575790381e740b76b50f23541760f17e4c5049fb0710aa7b0679b6551", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267585, "uuid": "7b82efec-b2ff-4cba-9789-306d2acbbc28", "value": "T11BC41208B2796F26E8798BFB14A21194C7B5B87F1231F3A91DD130DA1261F484F81F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267585, "uuid": "9e8d3743-323f-49ed-9525-a6b2772eab9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267585, "uuid": "ff80f198-f866-4673-afd9-c90e2b6cf90e", "value": "12288:Xxyz9/yhPK2j+1zASyTLxzRNgN6n1comPZBpGOW3YDg4opoxT:hyz9/yhPK2j+UHtRNv6omPfpGOUY1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267585, "uuid": "e92d7eda-0025-4936-9957-5daaa0e0ea07", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267585, "uuid": "438a2ff7-adf5-45ba-9d3e-4bb3a2fa118e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267585, "uuid": "5c20f231-a150-4f40-bf15-3e6e1a7432d5", "value": "New Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18724cd3-8ef0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701287234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287234, "uuid": "d5e3d469-87f1-4101-8a33-fedbb28b782d", "comment": "Malware payload", "value": "fccb9889e2ce33254aa96c619f246b92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287234, "uuid": "a00acb2e-ce75-480c-a430-1f6850185fd3", "comment": "Malware payload", "value": "ab587ec77a9e94dade364297b62bc9f7c121351e5d86acd86ffd0c85386e5ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287234, "uuid": "001ec9d1-e612-4fba-a1eb-ceb2fce496cf", "comment": "Malware payload", "value": "58c798d73858a4b04f05529bbc7974fd87ed601a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287234, "uuid": "2a65f8ea-c741-4831-a757-d205b73c722f", "comment": "Malware payload", "value": "5cad6ee8bec0aea0076a4331ae80259cf90c394d96a1e4deec4bdd480340b51acba4d9cc22c7cc5e59a090d829f6cb15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287234, "uuid": "dbfff68e-e361-4e5f-aafd-ecf4a9f7672d", "value": "T15AD5337939C68804CDA79BB0FCB0D7E993ECA035D89BA305651D9096FD2B312D387693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287234, "uuid": "79a3ed65-7c05-4257-8630-4cf1c3f58856", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287234, "uuid": "48faa54b-6804-49d6-b539-31c08255b7fc", "value": "49152:a0qjOcAPQ/gOjiUMkdnzYdqeXGqC1dJMDEg6fa2akCBaqCwwTdwZtNPetncDNkg:aTjO5Y5ckdi7WjZpCcrlTQNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701287234, "uuid": "c597b628-99b4-4e84-8274-512c76283f88", "value": 2838792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701287234, "uuid": "a158aa90-7378-4bb6-8d13-c11b72e50fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287234, "uuid": "490d5560-830a-4197-a2ca-0a8167854138", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dee2d7-8e75-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701234531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234531, "uuid": "362a644f-cb48-4860-9c02-58d45da676dd", "comment": "Malware payload (RedLineStealer)", "value": "43fb57c316cf7207ce6eb521fdddbe27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234531, "uuid": "322bdf76-95eb-44b2-90ba-e174b02e4fe6", "comment": "Malware payload (RedLineStealer)", "value": "acbf503fa1bf50405fa0b4a75bcd33fd20122aa2770fe59523631f3756a4f4f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234531, "uuid": "5445622a-273d-45ab-aafe-48d2cb7ac96b", "comment": "Malware payload (RedLineStealer)", "value": "55ff8f9a5f71b60e7930ddad0096df75cea85b36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234531, "uuid": "fda98201-2b43-4e8b-8ac3-4d003f7a2b2d", "comment": "Malware payload (RedLineStealer)", "value": "c2b8a6144b1d73e5b35f62eaea3fa5c0c257b15709e38ba20c28b91448655a2a20331988b61997e375fbe409bba8974d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234531, "uuid": "f25449ce-a9af-4793-86f8-b0b4e91f44fc", "value": "T100A35D20679C9F19EAFD1B75B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234531, "uuid": "e44f531b-8fe4-401d-b892-9566a25b21ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234531, "uuid": "85f5e713-3fc5-434a-be8f-4c7eeaa61cce", "value": "1536:1qsklqWWlbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed2YteulgS6pg:zEReY/+zi0ZbYe1g0ujyzdAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701234531, "uuid": "074a1b3d-1368-483e-8ff8-a545f3d8fae5", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701234531, "uuid": "44229493-3d75-4aac-b6d3-33d3c2e55584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234531, "uuid": "3f0e65ec-5aa0-47c6-8c88-9d014b6ab1cd", "value": "43fb57c316cf7207ce6eb521fdddbe27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84e469c-8ea1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701253653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253653, "uuid": "519aefd3-2fb9-4e39-86e8-618805938ec0", "comment": "Malware payload", "value": "e78ea0ac0c831556dcd34999425fabad", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253653, "uuid": "8074e3e4-38da-43bb-9987-83d0ab21459d", "comment": "Malware payload", "value": "ad0f4c7a345a29537a5bd30bb91712310af763c90cafaaba6f8de17ada756671", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253653, "uuid": "fc509ffc-7437-4ddc-b1ad-d834f6b2c3b2", "comment": "Malware payload", "value": "2a2182d184ead1f710cf37db304bb058037aa938", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253653, "uuid": "faff9312-48a1-431c-82b8-93bb1eeaae8d", "comment": "Malware payload", "value": "148840969f882a656f961c188fb87ce97c8de827e23f10788ad580de0290b37304beafb52638a02e1853aff78016565c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253653, "uuid": "3ef207c9-0bcf-48b8-9e93-3c100e91d1f3", "value": "T10E137252B3D6AF26E26326B488F3C295B325BD049F77871F2298371F7C725701A42726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253653, "uuid": "f4442eb1-50ac-4d71-992e-fcecfa0e69c6", "value": "384:SOyaaI6bXOFdTuO/g047NCCj9UUZpF6lcT76PSmRqiOe6giSwvxjk+tHvoK:SOyaaINhKj9Uo7USHBeOxw+tP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701253653, "uuid": "0eabad33-6f5d-4ad2-971b-494be9386320", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701253653, "uuid": "fa6656af-29bf-403f-8388-7c8f7afeb1a8", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253653, "uuid": "15903aff-d013-4276-bbbc-ab156e8177f7", "value": "DY PACK LLC TX .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f441348c-8ea1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701253673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253673, "uuid": "851eb726-5061-479a-8c6c-f6f350716a40", "comment": "Malware payload", "value": "b718526c6306f57dc97ae5ec7f32e0bb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253673, "uuid": "adfdf269-ec7a-4f3f-85df-d1cc8955ad54", "comment": "Malware payload", "value": "adae6d48363148c1d0c484f7c4d56e3ccc6ce05a883d1ad874f1be18f9690887", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253673, "uuid": "98c1e813-9b72-4cd1-9c0e-403771770205", "comment": "Malware payload", "value": "e8cd8d5dab024d1e42e67d6e2d4a1369bd428ccc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253673, "uuid": "590ac1da-08ed-4593-abc5-e12a43950bcc", "comment": "Malware payload", "value": "5debb66d78212ef7f69fcea6b3bb4cb36df7d486a78c3ce2c816a21c07e65914e5592616679acd89c585196639a1a419", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253673, "uuid": "07fac8b7-f382-4cb4-90bb-f4b83cfe59e9", "value": "T100139613B7D76F26F12726B489F3C299A324BD068B76872F2158370F7DB15701A82762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253673, "uuid": "41956570-7d9b-4eab-a57c-9f6191088066", "value": "384:ul4CRQluIGeb+o6TYOSL3057dLCPaPZ8j9d46mcBPSmRqiOe6giSwvxjk+tuo39K:ulz9sDLcEaKj9d5dSHBeOxw+tuG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701253673, "uuid": "ab2995b9-250a-44cb-9cdf-a65a812590c3", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701253673, "uuid": "31b41aaf-5044-4553-af65-165f513e48ce", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253673, "uuid": "0ddaa21c-fc2d-48a5-a26d-9cee9ff926be", "value": "A TEAM TRENCHING HDD GP SC .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77020639-8ea1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701253463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253463, "uuid": "5490d66c-e755-4a72-9a85-38013cab8182", "comment": "Malware payload (AgentTesla)", "value": "2727fefa807ceff4415eadbf67dc4c24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253463, "uuid": "981a7be3-7645-46e5-8f00-b8b0e4d207ea", "comment": "Malware payload (AgentTesla)", "value": "adbc699b2512be0b3041382f7362d33b004c81cb48402297cab53b81e4a34527", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253463, "uuid": "71f03e64-f4aa-4aa0-b1b2-5fc031470a42", "comment": "Malware payload (AgentTesla)", "value": "d8fdb1111e1da872fd0f553326547f41a89a9ce4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253463, "uuid": "f4fe2f5f-124c-415d-a94c-5e1df5cf4043", "comment": "Malware payload (AgentTesla)", "value": "25e380bd4d84033ee55189b542b136706ce9440111a50a1cc127eee9eb36dc811e823a30b3e11e82e160a39d8ba7ce68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253463, "uuid": "4da0c4be-cc25-41fd-b554-223b354a45b2", "value": "T118E41229B6794BDEED3B53F48A2081055BB2AE2B5476D30C1EC4B2C716F9B406E51F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253463, "uuid": "4199c49e-06f1-41db-9b7c-a3c66254288c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253463, "uuid": "df918a76-d425-4968-8717-cc060d72cfbd", "value": "12288:2LT1E6jD/m6rsXrRKdA6tAGbEu/XG+G8Rjgied+9MUvj6BeOEuLtk7SQI9opoxl:eT1tD/nrqrR+tRXlG8RgaveEOEuLtk75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701253463, "uuid": "27faff8b-f09d-4467-9e60-dcd31e1c179e", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701253463, "uuid": "aca18a13-a63d-4b0b-8c7b-4c897b0b389a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253463, "uuid": "e41531d9-fb5b-4fcc-98d6-31bbbb5c8087", "value": "SecuriteInfo.com.Win32.PWSX-gen.6174.27930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c67297-8ec1-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1701267277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267277, "uuid": "42aaf914-b561-45a9-a490-dfed2e63d30e", "comment": "Malware payload (NanoCore)", "value": "eff79cccec3ac8ee1f5b44d6190b51b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267277, "uuid": "855024a8-34bd-4849-8f18-55236473573c", "comment": "Malware payload (NanoCore)", "value": "adc77c376bb24286de600515aae37a4d4e1136c9c349ee6c36531e397522258e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267277, "uuid": "48a22ead-4185-4e56-82e4-4233f055c974", "comment": "Malware payload (NanoCore)", "value": "669380f4d5e30ad225d89d85ddece6ea70b5f2a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267277, "uuid": "eb4570f0-6543-496b-9ac0-df257dc60122", "comment": "Malware payload (NanoCore)", "value": "9c9a9b3e7cf250981b5d8e1a79e5802e1c1595f5bda9a303e3ebf473ba948acf3912b498aa2b34ff1d86cb037232fc7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267277, "uuid": "9c3f4459-02bc-463f-801e-77df3a7d8ef1", "value": "T147729FAEE58400BEC70748F814112153F7E8D5B7B9B7992BA2307759C47A7AEC780B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267277, "uuid": "1d3c5c3f-27e9-4005-974a-6968c21c855f", "value": "384:zyXeZPhWLs8PL8wi4OEwH8TIbE91r2fRpJYqviiO6A0MuS:zcef05P3DOqnYJnzvDO6A0Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267277, "uuid": "7dc0679e-2e2d-411a-b64c-226a5bfd7219", "value": 16437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267277, "uuid": "b50779a4-a0f1-4cf1-8735-860c4420a302", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267277, "uuid": "974edd51-8704-408c-b876-8d2461953777", "value": "Order_Spec_COSMOS ALUMINIUM \u0391.\u0395.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6da84b-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701283164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283164, "uuid": "4683848a-80ec-423b-80f2-3c64d9edb8ab", "comment": "Malware payload (Mirai)", "value": "ccf0a1bb6c5b7dd2e440c0fd5ad5f530", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283164, "uuid": "f6607722-4eb7-43fe-a24a-2959789ef8cd", "comment": "Malware payload (Mirai)", "value": "adcebd3eb23cf33dc566a788b5ca60439c759cf35d7fb5ecb5ad72724e816db9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283164, "uuid": "2e60a372-7ab4-44b6-9484-23e85d2392a8", "comment": "Malware payload (Mirai)", "value": "eb1fbe75394fad12a4d12d4dccae148c351e4a3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283164, "uuid": "8173709a-cce3-42ba-83c5-6535fa9b6e22", "comment": "Malware payload (Mirai)", "value": "562c768cb0326877c32ea225ba495000763dfc4050fd9bcf816ae795fb5d3461e8ae43f2fd86b518a440b52b6c0608f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283164, "uuid": "30822886-8b7d-4fd9-a3fd-877cc6328370", "value": "T157D30845FC405B23C6D612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283164, "uuid": "ad831d78-4167-414c-bc5d-a7782d6f70df", "value": "1536:VHQeHIjFlGz/r56Qpn/lFcAPWZf4VTyqsTgDFYAvTTu2/oAdmlN8Vwyw2FR40o5M:VHQeF6Qt9FcT4YZMDFYA9gAplNibw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283164, "uuid": "e3e5bdbc-dfc2-4ebe-93a3-9ae447b82f2e", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283164, "uuid": "adbd88f9-9f5a-41c9-9d93-8e6cd1843a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283164, "uuid": "153e0c44-e57c-4f8f-97e0-140710894017", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0742ab-8e96-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1701248748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248748, "uuid": "69d2f5ad-9d2c-4b8e-823d-d3bc6aa48345", "comment": "Malware payload (AveMariaRAT)", "value": "64b87304f4c35bc393dbac32681f90c8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248748, "uuid": "c0359866-6b90-4cac-bab8-bef3b5b183a8", "comment": "Malware payload (AveMariaRAT)", "value": "add081b89a77bac44ed5454a50e61ba7a858b86570e0654b3bf68a75e3dd3cc6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248748, "uuid": "e516212b-a2f4-48f7-8beb-9a083f977fa4", "comment": "Malware payload (AveMariaRAT)", "value": "c9469b87b76d2188f8544a9e9a4b47ae070fdd61", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248748, "uuid": "6b9774dc-e691-45b7-816d-5dd705860ffa", "comment": "Malware payload (AveMariaRAT)", "value": "513a7528ad4d3c4cf88a63b94dcc9e6b4e3070c73f7e05098412d3a40b063b025114372993591d9267ca149d4b202799", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248748, "uuid": "750f5b83-9d69-466e-982f-c22fcf4bdc8e", "value": "T19955333E38577C6A32B004232B38E6C86AB97C88AD5D33528139747629DE31CF56DC6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248748, "uuid": "9ec06ddc-f9e8-4c9b-9620-5ffe58457754", "value": "24576:jhtD3EZcIQ1NJ551Hg93nSgwyrkOBL2rwTl5tLBKRKHA3XSKsIu6j1:jhtwZcIa1HgkgwElvT7/HASwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701248748, "uuid": "2186aeb4-7731-4b7e-abb0-c8bf2cbaf96d", "value": 1342368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701248748, "uuid": "338ef3c6-3641-48f6-a413-f946cd645dac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248748, "uuid": "b145ad92-9392-4ce1-a7de-5dfedaf5e81a", "value": "RFQ_New Order PO1140810.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d37a0c-8ecb-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701271718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271718, "uuid": "eef0e37e-95fb-474e-aeb0-8f086aa2c6af", "comment": "Malware payload (GuLoader)", "value": "b45e428f86c60736f83bbcf4662a0deb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271718, "uuid": "77a4b414-7b63-410e-9026-24ff109725e5", "comment": "Malware payload (GuLoader)", "value": "b07907ce3ee14b8128039ecb8e635976fc216c77035d5bf38f42ed900197c879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271718, "uuid": "73afb0e7-7ed4-4d16-8419-3f568eb1b139", "comment": "Malware payload (GuLoader)", "value": "c570e0cec229a601331ff9c0d9c302bba0d85af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701271718, "uuid": "82570609-4876-46f6-87af-d8d9e28ec27c", "comment": "Malware payload (GuLoader)", "value": "7a8be4378360c9e113cd73eea6fcfc60883be5594525ccf2e9d7256e24b82bfa094ce6ffc3dde441c4f566b1ec85cbc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271718, "uuid": "bd25eddb-72c6-4d88-b19e-729991a7e6f3", "value": "T18164126317E5A0A3FBC642B41B7BA933D7B0A7F8103258EB4B345F747A131265A09277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271718, "uuid": "d4bebb57-7336-4a68-8f47-03c67ace857d", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271718, "uuid": "e86e2ab4-cb6b-4341-a49b-9977a91ea610", "value": "6144:ZjpfVIVK/SZ35l0SWLLzpSAGIyRM7wJ1wpxdMLkPiP7zo8Xq:H94KaZr0sTLJ1wJo7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701271718, "uuid": "696136c7-37c9-49db-90a3-7df6a6baa868", "value": 334208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701271718, "uuid": "4f3d73bf-2f0e-4342-a3fe-e93d384393c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701271718, "uuid": "2f1e5ba2-4230-42b5-b707-0cebaf403d73", "value": "Semiconformist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dac0efb-8e53-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701219920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219920, "uuid": "53a585b4-eb52-45cf-987a-248ae1b9a4d8", "comment": "Malware payload (RiseProStealer)", "value": "0d8125ff9d03eb80682c6f3eccdcd1c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219920, "uuid": "f418fc37-2e12-4458-9a27-749f7381212f", "comment": "Malware payload (RiseProStealer)", "value": "b2ce4969d9a32bb0825f61ae01a0b789f6fefab7cec1cd3eb155c2d098ac8b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219920, "uuid": "62b5a9ad-3fb6-4975-9291-4fa807b77073", "comment": "Malware payload (RiseProStealer)", "value": "f8a36374eb780eb48d7dc405ad1e0ffdd204def2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219920, "uuid": "92c89a57-2c0c-49ec-9034-5f757707163e", "comment": "Malware payload (RiseProStealer)", "value": "b1c013ffd44b182a8a4caa160f3c5ea7f13146b483a36e3b4b499f3e1c5ede7a446798cfd47174885ecf2e649a777ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219920, "uuid": "bfb1521d-db4f-43c8-9c5b-dc28feb69e44", "value": "T15D352287A6E58077C9BA63301CF207472F38BCF2857DD3A7651A5A8628B33C49631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219920, "uuid": "f848c33e-f9ca-482a-aa60-dd806ce36a7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219920, "uuid": "cf5cd62f-3104-4051-98a7-ea006c1c716b", "value": "24576:Yyd/16AH01iU4DhUaO6Op0gZ7H3frxpfgr8:fd/16AH1fUD6OXjxRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701219920, "uuid": "c8b6a6da-7f2c-4251-917c-d234aa05d8e8", "value": 1156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701219920, "uuid": "73da6a28-2ecb-4a99-8ce0-4f42d4e688ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219920, "uuid": "03f51d65-276b-4c11-8b8a-16929bd734ac", "value": "0d8125ff9d03eb80682c6f3eccdcd1c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5170f26-8e8e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701245433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245433, "uuid": "2d01ec7f-4ce3-40d7-9b6f-4cee581e8791", "comment": "Malware payload (Formbook)", "value": "2db80c5d3cf620962bbf7dff7a33807b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245433, "uuid": "816ceb91-e78b-4d1b-bf94-19ad381104c1", "comment": "Malware payload (Formbook)", "value": "b3d01af7218404d907c6f54ff026cea45c13d19aade0d191b179b9664b035088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245433, "uuid": "3f6e3346-8abd-4fb6-b191-9b99624652f8", "comment": "Malware payload (Formbook)", "value": "5f105eebf30c08de7fb5e48fc3bcbe3fdb40c539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245433, "uuid": "a2b547fe-10ef-4a76-a43c-c92ed389a976", "comment": "Malware payload (Formbook)", "value": "9ee64383f45dd81ea26865912dbfa1a8ebaf8d93b6cb2bf7aaf40f674dd549ae68ddf64b1fa4f01ad41ccfac0e09a0b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245433, "uuid": "b60194f3-4065-463a-b1e0-849ecdc33982", "value": "T124B53382A1D8D037DDA043B148B5739B0B39FE219F31A26937DDBD990962648A1FD337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245433, "uuid": "3471b679-99a3-4365-99ab-cffeaf34c8b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245433, "uuid": "4b3f2c8c-18d0-42cb-aeed-b17c68849c9f", "value": "49152:U93hP0uXtV5zqp9IePk3MoUtkkJUW/8FzNtrtZu01JePf/:mtV5zSGePAMEcCtrfuoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245433, "uuid": "dba32c91-c46e-4e00-a7b0-66f14c102d3b", "value": 2338816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245433, "uuid": "bdef376b-30f3-4660-8033-84371e0d0ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245433, "uuid": "4bbd76a3-daed-4092-8965-dececadf4dfb", "value": "2db80c5d3cf620962bbf7dff7a33807b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40921370-8e5f-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701225025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225025, "uuid": "7cd32f68-3b79-4532-9004-bd76ef6f1591", "comment": "Malware payload (RiseProStealer)", "value": "0cfbea6221ec219b5cb85aad96cff2d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225025, "uuid": "97266d45-de52-4822-b87f-bf58d1309ccc", "comment": "Malware payload (RiseProStealer)", "value": "b467f4f038aeaabd94eaa3341e578cbd36b1062a50d24098a4edebbe798f4a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225025, "uuid": "36155e7b-0b33-490d-b7a9-48870188def4", "comment": "Malware payload (RiseProStealer)", "value": "6e604624887c82494db4b0668a6ec3b1efe71a80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225025, "uuid": "24836d41-ce6a-4c4c-a1b4-a900b126d3fa", "comment": "Malware payload (RiseProStealer)", "value": "efbd40b048b7eca12c61a62f7acb2497fa94ab1cefe46f4f7b8fa814e5ba3837c8ba1e4c482733f0ffbb12cd7a852862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225025, "uuid": "ffc26712-ef29-4ba8-8ba4-8e6708f89013", "value": "T1A6752353E2D8C152DEB567B088F6B7A31E79BCE3FDF0526A2309550A1C12790A4B2737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225025, "uuid": "8bc4ae5e-06d6-426b-9e2d-1fbc14c03ed9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225025, "uuid": "fbb147c3-12d4-4592-9625-60dbdcd49d79", "value": "49152:JpO7XlKyt4fbANSJRFb7lfA5DZ7u+6qaZgFD98d:zO7XwTANSNQ70Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701225025, "uuid": "9de85b58-f6c9-4116-baa2-e15c9d8b786b", "value": 1647616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701225025, "uuid": "19ecd3ad-1e9d-4807-9d83-eba57d09fd70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225025, "uuid": "54c42a67-1cf2-425b-ac75-73c8a5b171bf", "value": "0cfbea6221ec219b5cb85aad96cff2d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c001bb-8eac-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701258257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258257, "uuid": "b13ed1f8-5587-4ff6-b456-ef6f2fdd2a4a", "comment": "Malware payload (Formbook)", "value": "a236b6aaed97415cc214f31c72641705", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258257, "uuid": "2ffe8cae-eef5-4bc1-a901-1c590418bc99", "comment": "Malware payload (Formbook)", "value": "b5b48456d763fc563b9037d433745c45bf5962c87e7593c49c45f299e0a4c955", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258257, "uuid": "162104ff-3362-46ad-8fed-834894e22f5b", "comment": "Malware payload (Formbook)", "value": "145b9d707f9ed04d0d044565dd5781f9061fd721", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258257, "uuid": "22f82d44-c3cf-4a6d-bd8a-3ae32271b861", "comment": "Malware payload (Formbook)", "value": "d04767a2d9ef2fd34e3eb6156f937103f037dbaedb2f7272a86e1d061e995e695c74de63b80c047bf896a465a50a2fb9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258257, "uuid": "aa0f6a2e-ccf9-466e-acca-27276fe0cce1", "value": "T103D4238085B5E2DD98B4AE1F3D60BB9EE7A0C509CC117148D3F43720B567622C9A76DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258257, "uuid": "dfa3de3d-8008-4f99-89f3-52b0e8383d32", "value": "12288:H91BxEjbpZN0zXiXNU93WttlrtkvJxwCQf4hwv002BYqZ:HTBxEvpZqzXwH+wsz08Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258257, "uuid": "1da835a7-2854-473c-8812-cc856a0a661f", "value": 630070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258257, "uuid": "5e37ff42-6fb5-4d46-bc22-7198d4eed670", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258257, "uuid": "2cb0e2e4-9a99-4d2e-8d9b-64719631ff29", "value": "PURCHASE INQUIRY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9417984e-8e9c-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1701251364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701251364, "uuid": "09db5f48-abe0-47d3-9d39-b792a978f142", "comment": "Malware payload (Adware.Neoreklami)", "value": "0d49e846415edcb36e4e0f4c2b2a40d5", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701251364, "uuid": "b66c894f-1a00-462d-9e32-af63ed127b98", "comment": "Malware payload (Adware.Neoreklami)", "value": "b5e4b3765cd493c657eefbf22a8198fb0dc11d5ce79f153f00b559dc7fa73d71", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701251364, "uuid": "1c57c7dc-80d1-4a9d-9cf4-cacbda2e5983", "comment": "Malware payload (Adware.Neoreklami)", "value": "b1031a92721f3fe3a6374ae98fe119020d80a719", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701251364, "uuid": "cf59a0c4-8e31-44c7-9bf6-e3be853ff61e", "comment": "Malware payload (Adware.Neoreklami)", "value": "3cf6ef355720debf39457bb590b47df44f6ac232bfc28a01ac754ea660925e90e379bc5e74445c2d07d396d576662d1c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701251364, "uuid": "ab5d6b32-1804-481b-b267-418eff42b5a3", "value": "T1FA763312BCF7C1F3C25AA476E17867E0A199FBAD0E9440636343D68C5CBB36DC267660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701251364, "uuid": "6b51835e-40d8-45f4-b84f-38e11a1e1788", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701251364, "uuid": "b613a9c2-c48e-4189-8da3-2dda5cd3c182", "value": "196608:91ODodh0fJ4t/kI7Fyq+Nsd/a+vljZ/KTPhZRf5:3OUM4/6sE+NjZ/Kxf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701251364, "uuid": "56d918a9-0287-4213-a810-3d929b8454f7", "value": 7509466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701251364, "uuid": "36ab03b1-1cf3-4167-8fbd-4f07fa69079e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701251364, "uuid": "f78628b8-51e7-4ff4-8c1f-6b412c155479", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173de8ec-8e84-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701240847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240847, "uuid": "d99e7c56-d077-449f-a6f6-4b23f2ff03d2", "comment": "Malware payload (RedLineStealer)", "value": "b0704cc7da3aceb2fdc4b61abb7e3e65", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240847, "uuid": "f5c33afb-66ee-4a49-8ef7-845267bdc401", "comment": "Malware payload (RedLineStealer)", "value": "b8db3a7d5b5d7d55f6d617ba85da2e1c410da19ba2b37a8530660e82c14362e2", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240847, "uuid": "a96eb105-7d29-44dd-911c-f2fe699a6e00", "comment": "Malware payload (RedLineStealer)", "value": "7c69ce43f507f5061c5e5cfb5a1dfa2d96c1b200", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240847, "uuid": "6ed4198e-729d-4201-992d-08e95543db42", "comment": "Malware payload (RedLineStealer)", "value": "f363eb5e9b5d00fb597fa8823338e4a97746f3929999df2e7ccdbacaf38ab51bb31afc1d9dbb6b74cc921422294e7443", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240847, "uuid": "2b923c77-b505-491c-becc-7d87b5949c6f", "value": "T19BD5BE1A35CAC636EB7E82306679D77A61BA7EE00BB104DB63D43A1E1E305C11276F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240847, "uuid": "392f9ac2-1153-4406-a135-21c8edd85a1c", "value": "49152:K5lQ14uW8zBQSc0ZnSKnZKumZrFq4Fb6HXr1iWnYs4ntHurpllQ6acuxtZJCNi2y:l490ZnpKNFnWnpuxMi2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701240847, "uuid": "75247576-455b-4df6-aa84-e096110a502b", "value": 2886656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701240847, "uuid": "2c289fb5-ea48-43a1-9aa4-9669852a73db", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240847, "uuid": "e97ddff8-7c01-495d-8381-5d4a7f1ed462", "value": "Cheat Space 1.4.3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9380830-8ece-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701273009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701273009, "uuid": "f5ae34b7-ca21-4afa-ad6e-6ee8fdb7f7fc", "comment": "Malware payload", "value": "9b363c90df415c89e09392c6db438724", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701273009, "uuid": "46c54f15-a91f-4a8b-9581-c6ae38c3d9eb", "comment": "Malware payload", "value": "bb1562461a2811390dd7b41105252977f513ac9b02c9b2a6c8baa9721e2223ff", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701273009, "uuid": "13aa781f-ca6e-4628-b71d-9c6a11a2de3a", "comment": "Malware payload", "value": "3c5914f42f42458cef168957ff65e0f154997020", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701273009, "uuid": "3d09f2aa-9780-467d-9c41-c8ae329538d3", "comment": "Malware payload", "value": "1dbaa1184d7857008bfe77ccb28d2baebaeef18906812bf25cf43237c896bea70a02c5c5f565e70395cbc0d8b58f179f", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701273009, "uuid": "cce75bed-87f2-41ae-a861-6e6a8a66d51b", "value": "T10A4187F2F727C0C48876A6779CA7D089AE78806D002145097ADCC9D9EBB1D606275F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701273009, "uuid": "092aab56-d9f2-4aef-9b9c-1de783ab893d", "value": "24:WJYcgZLAsEANr1Vje1N7GFuNKOfvIPyIHWb3zlb19EZOVxD1cWyPsc3/FFO+gfji:1ccAsr1Vje11Z9IYb19Z/cPFFpgfqpg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701273009, "uuid": "4898c30c-8c0c-407b-b548-19feba0b8370", "value": 1958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701273009, "uuid": "3ac9debe-e165-4549-acd8-1175dee3c2b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701273009, "uuid": "3360760a-8c31-4896-ab65-4acc1475c195", "value": "5pY68q6S.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be4cf3a-8e5f-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701225017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225017, "uuid": "6fe28b41-64f4-414a-8fda-8442bcab243e", "comment": "Malware payload (RiseProStealer)", "value": "e1a38e213e47c456dc399784637d6a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225017, "uuid": "4333a2bb-9745-442e-bba0-ca7b48a6fd98", "comment": "Malware payload (RiseProStealer)", "value": "bb78cf9601e04cb4c59fc9b86b31cf7a627dd34a6b2ba1d1799210a3a534f8ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225017, "uuid": "eb1f6117-49cf-4e72-a926-852518a3f106", "comment": "Malware payload (RiseProStealer)", "value": "8031e61446f1ef7987ce22af93c460d285f59220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225017, "uuid": "ae574c0a-4e15-43b6-9892-4953b7bff05c", "comment": "Malware payload (RiseProStealer)", "value": "1d4036bd3e5f0f509a395d346ca36ceb9ccec2a78d657baea09f94655424a204217701c83ad3628c3081460408586c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225017, "uuid": "17c04f89-ece9-4169-8c67-6edb8a5d7d04", "value": "T15F658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225017, "uuid": "d7816aeb-edab-4a3c-a186-e36bbfd3a962", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225017, "uuid": "cdd1c20f-7eec-4627-9cb1-b573ce712f80", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WtI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701225017, "uuid": "d6e02cce-61d3-4408-9a55-dd8909bbfca7", "value": 1539916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701225017, "uuid": "aa3e4ecc-a32e-4228-9268-4df0fca2358e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225017, "uuid": "f668fdce-624c-4132-889f-ae32b95387f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2831f05-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701283171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283171, "uuid": "6448e6a9-4aea-4d2f-a9e3-457703049f44", "comment": "Malware payload (Mirai)", "value": "08c95fccfd2eb0caa60b43f3200ef040", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283171, "uuid": "7b3a3c78-8944-44e4-a523-b377916be70f", "comment": "Malware payload (Mirai)", "value": "bdacd3d8f11586f18853a2ac1e77d571a77be5dd556a495d70f0f5b8b48a16f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283171, "uuid": "f667e602-5b91-4425-9b0d-8f7ae170d180", "comment": "Malware payload (Mirai)", "value": "15ebeb956da8e8cc80934d800eca682fbc8cfbe1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283171, "uuid": "0b488119-ef29-4c9e-ac86-721bb46ade5e", "comment": "Malware payload (Mirai)", "value": "81de3861eeb3997403b1b83f3e02a6b55537ca8d08374339a216e90e103435079f8dd5de5f3fd456f25e25a6325a993f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283171, "uuid": "fc6834e3-e820-4c54-a951-ff204e2505e6", "value": "T1D3E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283171, "uuid": "b3ca8d54-ea91-47d3-b826-75c59ee4d9a1", "value": "3072:pUkePnTUPX1JJXJUwbY+a9scgTbOCm3DoVRpT:pUHr4jJXuwbjaPr/3DoVRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283171, "uuid": "a7f51e6d-79e3-4f76-9169-ff263544482d", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283171, "uuid": "e9d072ee-4b54-4933-be29-63e4c624f59e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283171, "uuid": "0ef5b22a-b6ad-49c7-890e-864075ab4e8b", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71351e9c-8e53-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701219952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219952, "uuid": "5dd3dbdc-ed0e-426b-a6b8-de41c3a6efcf", "comment": "Malware payload (Smoke Loader)", "value": "2be7a0159598b25a93079bc251fdc89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219952, "uuid": "3fbab439-d811-44ee-bca2-d9c25e1d0447", "comment": "Malware payload (Smoke Loader)", "value": "be46242efa2a9ad3b33005c9a1bb90197953c22c9799a9bffb9478f4e7c9af1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219952, "uuid": "71650286-365f-4a8d-b72e-8ddfdebf9220", "comment": "Malware payload (Smoke Loader)", "value": "6cabc858b1f5bfea8ad4df055176de939a031bd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701219952, "uuid": "29bdac92-5ae7-49d9-9107-22b0a0441f77", "comment": "Malware payload (Smoke Loader)", "value": "cddf96e00965115542f35ce31a0d416fa7cc0345a6dc99a2b11e346d42612dd5b0befd991086c569ab1e9bba404d252f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219952, "uuid": "0605dab2-619a-4dcc-898e-1d7f841663b6", "value": "T13254C54382E13D44EA268B729F3FD6EC770EF6918E197B6922199F1F04B1172E263714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219952, "uuid": "2d76f634-98b2-4858-b27a-16c21e04133b", "value": "29febc0919e45955d8257576c2c564a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219952, "uuid": "e6b58d19-8c46-4f78-94cf-323c6750aa78", "value": "3072:1wjqLfpIoYdb/vRqM66SUhXl+ixaI5n6OeQ5LlxG:1RLRtYdTvYuV+ioOfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701219952, "uuid": "4851c1ba-fcff-46bb-83dd-1032012fee2b", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701219952, "uuid": "c597af02-a1e7-4492-aa8a-c162644c508b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701219952, "uuid": "4c992bdd-6ad4-42b7-abcd-50bbd5f6fe1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2365df19-8edf-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701279951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279951, "uuid": "33b5507e-cb05-49c0-8ca0-3909aa8fd787", "comment": "Malware payload (RedLineStealer)", "value": "700f4d83d871b0a8ceb1d5a303ba408c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279951, "uuid": "b7d84eac-e559-4e70-85b6-94c96b1a9c69", "comment": "Malware payload (RedLineStealer)", "value": "beaf8a27e330baa29d07f8cc8151d1846087966d41cb524170205974b31cfb00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279951, "uuid": "90962823-a416-4659-8901-2f22724b1341", "comment": "Malware payload (RedLineStealer)", "value": "c0683b09d4ca34d21327ff1328f76244953c9f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279951, "uuid": "b9af5282-2eca-4eee-9226-245d21b99931", "comment": "Malware payload (RedLineStealer)", "value": "d5f2e98bc2c516eaecc8b8e66c5af048569a251f98b5f19ae5bc2da9db3cd2753a39e13cf02fdce74416a8e93673dc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279951, "uuid": "ea55b7c3-c8fa-4e7f-8cc5-1da93f8e1429", "value": "T15A944BCEF6C83072DED6057F11B65631713A99120F5AC4B36B8F87A42A251E5E23273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279951, "uuid": "57cc1981-fac6-4b65-ad35-2cecb78689ab", "value": "becb59d6c2cabee1a77fe54131d4eacf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279951, "uuid": "25fc0902-22bc-4f4e-9018-0d9f8f849948", "value": "12288:v3xV86YZb4HAFDPZUW5JAMs4dvYrDm+8ORWFU/pE:/fmrCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701279951, "uuid": "151e6bc8-125d-4211-8d29-c2ba870e596b", "value": 411424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701279951, "uuid": "2bee2eaa-70be-4d8b-9558-91e910465a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279951, "uuid": "066431f4-6011-45e9-b887-1dee1469e592", "value": "CheatLab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841a2519-8eba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701264222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264222, "uuid": "477442a7-32e6-4d12-acb1-c4a052b6ad28", "comment": "Malware payload (AgentTesla)", "value": "c2f122e1ed4c0c23d97586ab4cb01361", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264222, "uuid": "c867113b-52b5-47a9-b9a0-110ce5dc95aa", "comment": "Malware payload (AgentTesla)", "value": "beec4720902c29ecfc298e50c8ff24f96d78feff28b3cfe2feb7b4ab05d4afce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264222, "uuid": "15d9f3eb-19ff-41a4-a40a-ef6eb7d992d8", "comment": "Malware payload (AgentTesla)", "value": "5aa94de158499af8fde16110582470ed65ddcc55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264222, "uuid": "e9a70b11-0ccc-452e-b8fc-1ae1aa5a7eb5", "comment": "Malware payload (AgentTesla)", "value": "197c29086c3b2fd43d9ed2043e7397105aa5678260d1b0f991f9700148b41a1cdc8726303cf6a499c11e3f0fc6ec88b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264222, "uuid": "f155a31b-996b-4503-bc53-73ae0d535224", "value": "T1A2E41209BA7C2F66DAB68BF615A8128043F5E57F2635F7A50DC130DE06A2F840B51F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264222, "uuid": "9645a249-5017-4a1d-88fd-7e37927f1ceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264222, "uuid": "c6224c93-af25-407c-8f09-8802d65ab11b", "value": "12288:nH283lnfGd1+GKkfabnluUP0e2qdv+pUS/y68W9aJ3kCopox:W8xed1+GKkfaDjP0et+V6FWee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701264222, "uuid": "f27b928b-889b-49a5-82a2-19be50d864f8", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701264222, "uuid": "b33dab3e-f637-4f19-bd67-9ba167c40baf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264222, "uuid": "e941d3fb-8f19-450e-a260-b4f772cca560", "value": "SecuriteInfo.com.Win32.CrypterX-gen.27035.20948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53982a94-8e6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701231929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231929, "uuid": "9b7562b3-c46c-4f6d-9678-bfd1f108d4cb", "comment": "Malware payload (RiseProStealer)", "value": "d5351836a61a59984080fb82aee42a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231929, "uuid": "7776a6c5-b41c-4ecb-a096-a2e1af9244a1", "comment": "Malware payload (RiseProStealer)", "value": "bf513791b9fbdd123aa6ec497c2c01edbe629a195ab486a6be52a22a50afdeef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231929, "uuid": "d1044708-e47c-41f7-b02b-33ead12a4462", "comment": "Malware payload (RiseProStealer)", "value": "bcd713c21584903e2f1c51be3a3aed9ecec7bbb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231929, "uuid": "9a3eccfc-0da5-438d-b990-467ee9736aed", "comment": "Malware payload (RiseProStealer)", "value": "c433c9f7482b577b96e2c8e2a5506017016f7b355e1509e40d4f12a520dffb53850619435af60a847b2b91bb94f9c260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231929, "uuid": "9c7cd796-7800-494b-995e-83e4ac6f489a", "value": "T10B953396B3EA8062DAB42BB048F7426355387CA2AF74610B7B16F45174237D8EC6173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231929, "uuid": "8c5f59aa-580b-49f6-95ca-267d36c5d365", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231929, "uuid": "517f9822-ce0b-437f-97d8-5ff7391c34e1", "value": "49152:vtD/PALq/Zfn8W+JBbCCp6/6hviOREmiCC/buXO7Vk9:VDU08W8pKOARue7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231929, "uuid": "f73c5069-4142-4df1-b1bb-fbebd0d45818", "value": 2024960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231929, "uuid": "7e028d65-1394-4619-a6b3-b1c6fc50a450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231929, "uuid": "bdcbf2a6-f917-443f-b84b-9f56bd3d9026", "value": "d5351836a61a59984080fb82aee42a44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054bbfeb-8ea1-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701253272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253272, "uuid": "9a40cbb6-966e-4c4d-9596-98570f30cf8e", "comment": "Malware payload (Formbook)", "value": "3e59ce67b0b84b39f1c57c09598d3d77", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253272, "uuid": "ff704dba-bb2f-4c4a-8e67-005d50543a22", "comment": "Malware payload (Formbook)", "value": "c103b67c7185c6166ae8c73eca0a3a1db1c353a7d577f2707188cf3d4ac679d1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253272, "uuid": "76054a7f-bf96-43c2-9c17-60a12cce97b0", "comment": "Malware payload (Formbook)", "value": "51117cdbcab50f15a02dca8ccb6c162180abc6ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253272, "uuid": "c0d070a8-0f87-447d-834b-acbe15b1c5e8", "comment": "Malware payload (Formbook)", "value": "4dfe6becacb24ff1c6d628809fa1af3d5cd856661959107c9cd5844a2962809bb21fd24ba1f810f9b72a4ef110bb645f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253272, "uuid": "af90ed86-f08b-4195-ba3e-64430a1a7e2a", "value": "T117D42397161DE18232F5A29BDA6A2F87D80F2F7D8B0E73283A763494574B61B0F410DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253272, "uuid": "9a7071ef-8cb1-4d0c-be6f-e5fcf3bc0a95", "value": "12288:6C7n2kzQXaCEG70Trui+T6Aiqhap5bG9IYUQUzPQiia0NwT29+wZ97+:6gRGEG7viFwhGb7XrTiDNAs+wZ97+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701253272, "uuid": "2a272287-f844-4fe2-89f9-755d090a90c8", "value": 633206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701253272, "uuid": "b7562f7a-e2fc-4b4b-9631-12c406cb9d4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253272, "uuid": "5f6572f7-dd15-4044-b6b0-a3c416153a20", "value": "3530568 M4 - Orders.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908ae1a8-8e89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701243198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243198, "uuid": "216d7337-5036-4a2f-8052-9c5bbcbd9db4", "comment": "Malware payload", "value": "ffca06f03eceaaf9f484b731f741c665", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243198, "uuid": "fab26e1c-5511-4d7d-844a-c9ef1c3756d0", "comment": "Malware payload", "value": "c313306415bff7fd03a75ff370b47137532437f2f83b5e848b0ba6d6be247015", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243198, "uuid": "8c6faa83-9c34-48f5-bb23-1c38abc0619f", "comment": "Malware payload", "value": "e58f436d33495a90a56e46ecbfcab4edcfda3fcf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243198, "uuid": "1da8c295-e5f5-4537-aa5b-1831cae33af8", "comment": "Malware payload", "value": "cef0e96e0d1dfeffd07fdd0554d93f29a0a4f7764d272d479492020e144b4915ccb2f7c976821e039ddc73fa5a47b971", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243198, "uuid": "af696589-0d17-4e27-b917-6e6f8e0919a9", "value": "T10C05E958E7DC240242737078989F94C9AC3CD41A919DAC92FD0CC294AB94AFD997FECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243198, "uuid": "3f5664d4-4832-4943-8b64-dad4dc459fce", "value": "24576:iKCgo+ogQc5WfNnZmD/nkEeq157eI5eTNWpyQTdEFNE3NEr:iKCgo+ogQc5WfNnZmD/nreq1YBWpyQTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701243198, "uuid": "3f878622-04f5-4612-ae70-173e32f7c168", "value": 864966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701243198, "uuid": "20b1ea18-292a-4ded-b1be-681eb88d8111", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243198, "uuid": "9a0f4a69-52dc-4da2-8849-07b23cecbfc5", "value": "1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e6f4ac-8ec7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701269975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269975, "uuid": "795f18bc-9c6e-4d59-938e-ffe68f0a2dbc", "comment": "Malware payload (AgentTesla)", "value": "a73f82e8e43014c23505102402915651", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269975, "uuid": "81954d27-e9b2-401b-9e09-f9660db9de02", "comment": "Malware payload (AgentTesla)", "value": "c3a6a362321edda4e3268a97a8d24a78d136207e55043c91adf4c3482e74d9cb", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269975, "uuid": "54a6dc03-3a5c-4493-99ac-095ec10f58cf", "comment": "Malware payload (AgentTesla)", "value": "40825c3b11dee9337b3e2ad1c58a1273d965d917", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269975, "uuid": "ab0d3d24-24d5-4e31-8e7a-751eade6394f", "comment": "Malware payload (AgentTesla)", "value": "28cfb6a6ce1b73d505938fef3901bc43d253e8ffce1d7661a4d31c1b955d898b93188cffb143de19b0e8673a3c80d52e", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269975, "uuid": "1ac84765-3694-42ce-a86b-92f91e327d87", "value": "T1041502047B7D9F26C1B147FD89A2A20043B0AD272925E746BE813DDE39B5F841E41FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269975, "uuid": "f25f0ff9-1ee1-4bc9-8502-c36e2717db9c", "value": "24576:jOpMyBI0FRVGvyFavNafUIfSrbIOodeYNU5C2yq:cM6I0T+afjqXIOod4Qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701269975, "uuid": "fe04ffaf-e3d6-4161-92f1-55658ffea64d", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701269975, "uuid": "4b586e69-0f26-41ec-91dd-b4c1688543f3", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269975, "uuid": "adb0ff1e-cc5a-46ee-bb35-38b34ff4d26d", "value": "Ningbo-Overdue 974356.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cbf5f2-8e9f-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1701252822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252822, "uuid": "2d9895aa-3094-40d3-b915-b537d94d5bb0", "comment": "Malware payload (XWorm)", "value": "64b1cee9efed4fa29171fb63ce256e09", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252822, "uuid": "415451d7-5c46-4a4d-a252-dbaa99b98966", "comment": "Malware payload (XWorm)", "value": "c3cb97881c98a27b0ee0d1a0b75ae9e9fe0aeb63a10bfaec4ed0b00d5259d554", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252822, "uuid": "76848d7f-f05f-4bc6-a089-481bb897dd1d", "comment": "Malware payload (XWorm)", "value": "a4eeffad4c863e5cf76c279d1645635285940ff8", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701252822, "uuid": "1464ebbc-f7ff-4d6d-b4b4-a5ed13557b8d", "comment": "Malware payload (XWorm)", "value": "a23bdc643557319cab8b36dee4f07f9911e588d5f4a84b6ff0d4a1a76e7187864ee367962bdc25c75144b3c54b957ab8", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252822, "uuid": "5e87c0e1-fe7e-4f45-a885-0eab9d7007f6", "value": "T1E8A2E1C43424EC94E22969EDC22303A99F720DA55F2638974CFDFEAC6DC14FC958409B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252822, "uuid": "6cd8e1af-a95e-49bd-b87b-efb651d79c09", "value": "384:4QO9/dc6OkvDzQ20KiUqYXyDC6kDrL8EuIRDQ3rPiY6KCTJVIFY7I92BTML/W3pc:4QO9dc6z4209UqYCGDrLE3raY6K0JS3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701252822, "uuid": "9d82e8a8-ee12-4b7a-a31a-2750b8c55094", "value": 22628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701252822, "uuid": "74121c02-ae19-4e95-862d-cd76e5347248", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701252822, "uuid": "d3a2fa5b-ae4a-4a3f-b5d6-80316c9f19e0", "value": "order90.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de852170-8ea1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701253636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253636, "uuid": "8cda658b-b5a8-45da-95b5-654893c297dc", "comment": "Malware payload", "value": "8add02835b2fbce82cbf816286f826e0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253636, "uuid": "17b99da1-ae17-4874-86fb-e37f8e67698a", "comment": "Malware payload", "value": "c4c0cb17c7deb92fdb43eb001f075ba507ece5915af284ea09767efecfb86b73", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253636, "uuid": "5194aa35-8a46-4cc4-a8f1-eb00ebffbc64", "comment": "Malware payload", "value": "c28aea78e5f933330a629a42a5a3f5bba75522fa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701253636, "uuid": "90bd748d-f1ea-4c06-b962-4bbce6d7f431", "comment": "Malware payload", "value": "115d549564e22c52ec3d10ae1e9763423bfafb695f118bc0b924fb59919bff7ead906dc18db4da103b91f5838a9f79ca", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253636, "uuid": "17fb8f5b-9978-4d59-ade0-13eede3e2922", "value": "T155138412F7C6AF26E22366B489F3C295A335BD049F76871F2258371F7C725701A4272A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253636, "uuid": "434bf722-a7c2-4674-8394-e30d11e7be8f", "value": "384:YYEaawDbvjuTCOv40057aCkj9SGZx6eaKhGUIPSmRqiOe6giSwvxjk+t+ovEs:Ylaaw71Cj9S+GUmSHBeOxw+t+An", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701253636, "uuid": "47e8b760-7777-418a-8dc1-e6c0ae7e912d", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701253636, "uuid": "c230b024-f245-45b1-a090-2f9af5713f51", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701253636, "uuid": "0cbba6cf-693f-4be5-ac26-6f469a76f122", "value": "PREVALENT LOGISTICS INC CA .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f538490c-8e66-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701228334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701228334, "uuid": "8594043f-0e05-442a-8d1b-ace11b266cea", "comment": "Malware payload (Stealc)", "value": "94a5c959239a6cd8f580e5f088552369", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701228334, "uuid": "b5c2b899-7fcd-4c77-a244-20b446886efd", "comment": "Malware payload (Stealc)", "value": "c4fb74adbe02c3469b66e3e007c312a18736a343a8dca3f4c051a32de8ae135c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701228334, "uuid": "8f16c96a-cab4-4736-a156-5bc15b0c1d29", "comment": "Malware payload (Stealc)", "value": "2398d896ca536c0d79d758e1de9e2caf9112c891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701228334, "uuid": "1607d503-94b2-404f-96e6-cc1c9aa7fad5", "comment": "Malware payload (Stealc)", "value": "b08a6bb8a6a6005461de79b9c8563c088614c9e6e74b1ed167d057b36ca98452da14df5b35c3d1647b7824e084f09a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701228334, "uuid": "b3234a08-307c-4f8e-a8e7-49b3051b3b94", "value": "T14D54E64382E13D44EA268B769F3FD6EC770EF681CE59BB6921189E1F04B11B2E163714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701228334, "uuid": "1c7469a2-48e0-4d57-9fc8-d61dbc263781", "value": "29febc0919e45955d8257576c2c564a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701228334, "uuid": "b69bc080-87f8-432a-a0bd-b915d137e187", "value": "3072:SoRQvmccXT5muC9Wg4AqLbgfR5W4X/3Q5LleQ:teQ0uZgJ64m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701228334, "uuid": "1fcdef6d-c515-47f6-9cbe-2ba5b9e57f81", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701228334, "uuid": "a5db2264-5409-431e-b0b9-892140af1aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701228334, "uuid": "19170a9c-b71a-483b-9014-26ffc6b691fc", "value": "94a5c959239a6cd8f580e5f088552369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00f7c54-8e69-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701229534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229534, "uuid": "d1782633-e411-4cdc-b18d-dfc53ae66675", "comment": "Malware payload (LummaStealer)", "value": "f0b1208bd2cecf8f172f07a904fd00c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229534, "uuid": "0d0a3fe1-77bc-4abb-bf4d-15b6ff0f04a0", "comment": "Malware payload (LummaStealer)", "value": "c56085ee871e8eea85eb269f98c711fd2f7a395f5b054309a0e59047f9605ead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229534, "uuid": "e72ac7cf-5e3a-4cca-bb8d-9fa799fd3377", "comment": "Malware payload (LummaStealer)", "value": "b94f76b4d6b3554a4d9ae843772279b63cafb059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229534, "uuid": "f9e50196-437a-43a6-b3ff-14ebc3bf6f78", "comment": "Malware payload (LummaStealer)", "value": "4e7f5fa0ec7ccf85a66ad8951cc6a52101c474b726dc445424c98949d5f011175464d44301d52752b345ad8a5cc4944b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229534, "uuid": "081a3e2a-1bfb-49b9-ad61-cd0aea5cdd9a", "value": "T1A2852346D7DE8112D5B02B3049FB16D32D397CD3EAB09AEB272A6C492D21394A57037F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229534, "uuid": "30b60844-ff90-4eeb-acff-16b793a8406a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229534, "uuid": "2dc726d2-0f9e-4b36-aa80-297f75d3d9e4", "value": "49152:jla0RUmTuXQ9TYK7WJ2pjvm0cUDphMcGnwEl6A69S:+mTu83+0cUFhMIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701229534, "uuid": "cdaaa0bb-0f9f-4f00-b8cf-631a182c4b3b", "value": 1722368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701229534, "uuid": "41b4c6da-4e55-483a-91b5-0adb5025065a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229534, "uuid": "0f8ada0f-6fb1-432f-a38a-33249c7c9a0f", "value": "f0b1208bd2cecf8f172f07a904fd00c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913844fb-8ed6-11ee-8907-42010a9c0042", "comment": "Malware payload (SocGholish)", "timestamp": 1701276270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701276270, "uuid": "a01b75e7-1586-413d-8590-479ee622ff17", "comment": "Malware payload (SocGholish)", "value": "5cff8061367f855b5386158f54eb39f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701276270, "uuid": "7ccbe74f-e938-47cd-8b9a-384b5146b378", "comment": "Malware payload (SocGholish)", "value": "c5e2e5af5b75b11da97e4e96e94dbc4e694ace6503e25ead473a05496e9519ec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701276270, "uuid": "8530a49e-87d4-4d0a-98c4-49a4b5ae62a5", "comment": "Malware payload (SocGholish)", "value": "5e143bdf88f4c79814910b23a58f6ed04060ef1d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701276270, "uuid": "51a1ba9d-cec0-41f2-89fe-450abcf51097", "comment": "Malware payload (SocGholish)", "value": "8c45fa56a8fee049e9fee294f4727d9b54172f129fc2c059f59a6844181a99b8b88660a4b94bc454abb44b3427531fae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701276270, "uuid": "a4f3d1f1-13cd-4431-b3fc-cfee969c3f06", "value": "T163C102919BE0A49823E76713BF3DF1E8E80D684DB670089BE5515FE02D1541BD9E6F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701276270, "uuid": "3d3f3067-1c13-4e2d-8ca6-3f8ed0f2a30e", "value": "96:ZvymAJPiUvka0xrBcy6wrB4y/HpyxqQ3ujQhLpyoa21CE42amqywKJjkRWC2Tpfk:Zv4JtvkagBQ+0bs324QWWdTpfWdkc4JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701276270, "uuid": "508dea2b-13a9-4eb1-935b-623e8e560710", "value": 5951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701276270, "uuid": "ddadf7c0-1b5a-46e3-b036-dde952e6dd34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701276270, "uuid": "12f76222-00b6-4a06-bb99-bd3be52139bd", "value": "Update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67007ef6-8e96-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701248711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248711, "uuid": "95791809-0313-4387-b4c6-a92cc27e4141", "comment": "Malware payload (AgentTesla)", "value": "e5599030827e8b7a4a5925a9d5d67d53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248711, "uuid": "bac3ad03-3b2e-4b23-9bcb-15633d6d20c0", "comment": "Malware payload (AgentTesla)", "value": "c6155e4180036fbbba05651479684f4abb88a1616f83172bbd3c8b5f1bb38c82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248711, "uuid": "c73bf00d-3655-40c7-83d2-374d41465f6e", "comment": "Malware payload (AgentTesla)", "value": "2da949c94a95f4090a83adff66b37d563ce265d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248711, "uuid": "86f9c8c9-d512-4477-9dc8-44c87bf3c31d", "comment": "Malware payload (AgentTesla)", "value": "b727c4c5ed4f79e2560f26451f16706905157967399076b8c0fc7dd6b4a1934a81d36f0d2befb90308bfcd300d798c5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248711, "uuid": "1e6137a6-0742-497d-98ad-d167d2627156", "value": "T1BAE4124AB2DD1B9BF93FA3F8492090059BF2BC2A6571E3581CC432C696BDF115A61F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248711, "uuid": "d8a9698d-336d-438c-b98e-84b81f3ddc80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248711, "uuid": "a9e33228-6dc6-4fbf-8aff-0d9f77834d94", "value": "12288:LOD1E6jD/+6Y4OwXRgOTTLS+mo/ejRMNYVdDpoNRVW9nQqhopox:qD1tD/+2OwhgMm+mDSWdlCYHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701248711, "uuid": "5af01503-a329-4327-8938-5dc2a76c19df", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701248711, "uuid": "e1f919ba-4a5d-46f0-9023-6da2a6054352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248711, "uuid": "c96108bf-ce0c-4392-b270-0db7dcf25aed", "value": "RFQ_20231129xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57229ee5-8ed8-11ee-8907-42010a9c0042", "comment": "Malware payload (Kinsing)", "timestamp": 1701277032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277032, "uuid": "5bcab836-33b7-4159-a3b7-96e360a46978", "comment": "Malware payload (Kinsing)", "value": "da753ebcfe793614129fc11890acedbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277032, "uuid": "9fb82846-2985-414f-878b-901f1a55a594", "comment": "Malware payload (Kinsing)", "value": "c6fbd6896d162a12d9c900056781eb82f44649945808b7b009646b5397bcf6bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277032, "uuid": "147e7ecb-1b86-4b57-bf7c-c98a1866b77d", "comment": "Malware payload (Kinsing)", "value": "ee458e526125d60cc1a387b4163376be8e9bc689", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277032, "uuid": "ac66aee3-3511-470e-af4a-10ab2af18e24", "comment": "Malware payload (Kinsing)", "value": "acd1d908544cb10381488f8f074694103831f404c013def2468ff137e97c745ef2b2111ec876e8e37ac46f3c87c04d45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277032, "uuid": "62d21d5f-6db4-4da1-b20d-cd06f12bdbdf", "value": "T178564B02BC5DB563E9CC7630777683D9323E7588CBA14233AA64EE7D99F13688E17121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277032, "uuid": "7fd48b3d-4b14-4e0b-b137-b5e4a0413342", "value": "98304:Slds3UPXBQSH14vZh7pIDhG9By8uCGUGan5UPiK/AF7XlzcKGYH0ye8nanVFflpu:ZUDIaLbI+ED2iJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701277032, "uuid": "4d563360-8ced-459b-95bf-18deb584331b", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701277032, "uuid": "743debcd-356d-436d-b6bb-0811dafc1710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277032, "uuid": "99b345fc-c5d6-4d0b-9666-1fe9aa1f67c1", "value": "kinsing_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6275732-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701283177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283177, "uuid": "d008ea25-cb1b-433f-b56e-64ccadd63922", "comment": "Malware payload (Mirai)", "value": "5f18230da3de87d2b4ebeaa54a74cd76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283177, "uuid": "f1e984e1-29f8-4c11-baa8-5c0bbb25b46a", "comment": "Malware payload (Mirai)", "value": "c75a9a13fc8776963d675138a3029bd81de02e7aed9758962e3bcd03afc53fb8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283177, "uuid": "5f34fd2b-cbe9-43c7-aea5-11c22f7428f9", "comment": "Malware payload (Mirai)", "value": "6ffb925f51a17af293ad05f9cc18a51aa03c54d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283177, "uuid": "3a956477-55b4-47e3-94bd-bc2af16188b8", "comment": "Malware payload (Mirai)", "value": "3ebf4562d79a64a40669055f87b6419bb018d66c7cbfc76ad28133aadff5acf177e0528a90011232493af8e31a60458a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283177, "uuid": "72c4872d-7c08-4491-8c70-b65bdcd77674", "value": "T131C31945FC415B27C6C612B7FB5E428D3B2A17A8D3EE72039D216F60378B95B0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283177, "uuid": "9d715bf5-1a05-4c6d-8c66-81e45f61be08", "value": "1536:JCDwI4fG50nVg/QDEK9+19jAd424V8G2TTZtt1qLj2x1buddLqlEmwyw6FPRbxGw:MDwLYhQDJ019jc4r2/Ztt1qYbu7wSbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283177, "uuid": "159446ba-8d81-47bf-9cf1-af58e51bc145", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283177, "uuid": "60e8b1b0-799d-4547-82e9-2d5e58c6b1c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283177, "uuid": "05975fd5-c110-4ba5-94d4-bebae55616f7", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238ce862-8e6e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701231418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231418, "uuid": "e94face7-c7d5-4307-a269-e050b83275b5", "comment": "Malware payload (AgentTesla)", "value": "6a090fd887381926cf0eb77b1e1fa00e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231418, "uuid": "e950a6a7-9991-4883-af13-67b83af17760", "comment": "Malware payload (AgentTesla)", "value": "c8cacf3cd84fba343f2c5a563a18972127c8edda4945650e9ba5f44bb75e02a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231418, "uuid": "9d3f2037-396a-4085-8996-909da3be2932", "comment": "Malware payload (AgentTesla)", "value": "842a69aac157146dbb7b171897066fd8af74edf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231418, "uuid": "12c44067-dc69-4aa0-a295-48932c8d5ef5", "comment": "Malware payload (AgentTesla)", "value": "c61ea2f2a384cda5b53384cf370a0b2dcfb4ab4f19aa4c85485df30e08e0bdcadad75f540a671100d31a9e47ff14ff51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231418, "uuid": "cd7ff44f-1726-43b1-a9cf-73bc0f4230eb", "value": "T112E41296B2DC471AEE6C23F64521C0B46332BDB51976E24E29D83EE73923B244E50B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231418, "uuid": "cb7ddfea-af81-47ff-af57-2bca4f6c26ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231418, "uuid": "2f2bab47-1c4f-4350-b10d-b9ea5d046ccb", "value": "12288:7m6copox4gWgVRy60vQL8waRLpKl5SAAI4MW5avdzX4EzBWuN6lLPfLBv2:Ee8Vo6SNwaRFGSg7W5Q8EzBWuNqrfLt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231418, "uuid": "04b84d06-df0a-475c-9c82-386c3fc2e87b", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231418, "uuid": "704e0460-829b-432b-a237-83f8f8a6cce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231418, "uuid": "106f4e0c-54de-4a0a-855e-16aaea2c26ac", "value": "SecuriteInfo.com.Win32.PWSX-gen.7960.17411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83e0225-8e59-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701222622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701222622, "uuid": "7eac16a6-5388-4489-b572-5c01821a99bf", "comment": "Malware payload (LummaStealer)", "value": "9ce01fdabd737268e2c5fe3da55fc969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701222622, "uuid": "cb819a49-79ab-46a3-90b8-d375d3ab4e0a", "comment": "Malware payload (LummaStealer)", "value": "c92353fc93904cff5198ccddebdd3381d94a9a4f05e8256cd96fd4c3b00bddcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701222622, "uuid": "bde477ca-469b-4580-b1d5-57e467d284db", "comment": "Malware payload (LummaStealer)", "value": "8aff850c4b1972e8723575b7c97f6bb07fc5ccb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701222622, "uuid": "c19580ac-e5c7-404f-a60d-90b565af765f", "comment": "Malware payload (LummaStealer)", "value": "9b11dfcbd9cf972dfe13c39f0790e6e03897d7f9a4bd69116e55d59752a8c75675bc584639f5ae6a8d89813b8b2fe167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701222622, "uuid": "6191554f-9767-4ac1-acf7-fa74091345cd", "value": "T1289533A2A3E9C031D6B5677448BA59630F32BDA1F6B483D3A7529D494C122D0F67233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701222622, "uuid": "ea162312-16cc-4b93-9867-2fb60b673efc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701222622, "uuid": "6f5cc829-0838-4bad-a1c7-52a114e0796b", "value": "49152:lFDC5JswTjssfS9eLjYNEDbB+56vv6XrCuZFJYrM95WPCXZF4igcg/A80:TwTrfS9eHzcfrz95WEZF41cg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701222622, "uuid": "a837845b-8506-4b91-ab6d-8084af67a740", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701222622, "uuid": "ef794a3e-2d2b-4545-8c10-6a956355fa92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701222622, "uuid": "444677e9-772a-45da-84b7-d88d8e28472a", "value": "9ce01fdabd737268e2c5fe3da55fc969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235f8011-8e6b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701230130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701230130, "uuid": "c5e35fc5-bfdd-47a2-92e3-adccaf92bab8", "comment": "Malware payload (LummaStealer)", "value": "14c826ccaed122568e6df8ad22e03847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701230130, "uuid": "8aa6674f-6f07-4226-a29c-8ec53a887359", "comment": "Malware payload (LummaStealer)", "value": "c9787d0e39bee301e56e16b4834799f8ada277062bcde961b2f46a355fe5a8f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701230130, "uuid": "7e4aba14-67b5-4f66-b797-e8e8702e424d", "comment": "Malware payload (LummaStealer)", "value": "db73f429b58e000cbb4264fc12ab0aad3a900eff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701230130, "uuid": "a1de032c-c23e-4f98-891a-7b12d2055266", "comment": "Malware payload (LummaStealer)", "value": "4e3d87875f7d3871106ae589364206dd79621da2b4a834ef146bea400b43cc4045ba6b746dc1d0eef7b1b50b8029ad82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701230130, "uuid": "fd246c47-f979-47c7-a56a-704dd99487ee", "value": "T1C595331657EE80A3FAB41B7184F623E315F7BC62FB780782560B898A2D62654D53433F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701230130, "uuid": "64ef6ce1-4e5f-49b9-a6d3-acd091a6e364", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701230130, "uuid": "ad81c321-dd65-4c8f-ab47-05f1a97aad50", "value": "49152:nbw2uMuUL8O1ztZHRrnrvAsEU85Imm8BVM+8qJYjuyAyaEG:b6MuURXy3ImTtcjuyAyaEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701230130, "uuid": "0a8211b7-28c9-4b7e-8742-7327647b2038", "value": 2022400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701230130, "uuid": "66cf9d3c-3ea4-4a8c-b11a-9c58f4748b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701230130, "uuid": "b0d155c6-59fe-4c06-8fab-30c92060dba5", "value": "14c826ccaed122568e6df8ad22e03847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af2f412-8ec3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701267884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267884, "uuid": "cbea940a-7807-4b9f-b2e2-7f5d722cd790", "comment": "Malware payload (AgentTesla)", "value": "d765b675efff45163962b4e283665bbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267884, "uuid": "2662d781-d96d-4a3a-b1a4-bf81d844ea1f", "comment": "Malware payload (AgentTesla)", "value": "cb844340c7b60d5093381191f8f60a5b768638019670f58eeec09c2288ddabea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267884, "uuid": "049146b6-43b9-49ae-aff2-55fb773572bb", "comment": "Malware payload (AgentTesla)", "value": "7eaf7d4322e82d2771cb94e68426309b1082fde1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267884, "uuid": "8cf66a64-3968-4ebd-a7da-c4af15888b99", "comment": "Malware payload (AgentTesla)", "value": "d7c3cbd508ea20af5f659b464c6572b925fb07b30439f35bded7b22b8786a73a3424b46b869ba842e637257197cd035e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267884, "uuid": "44f1bbe5-7789-4b8e-94fb-ea1ac7762cf6", "value": "T100D42386036117133A5BE36ECC5382CC9ABE96964DCC7863707DFA9CDD00B5A8DA185F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267884, "uuid": "f3679ff1-eb0f-444f-8b81-e2b12dd0f64d", "value": "12288:lUCx9f15TPCdMBeSQUryatBUP4+z99RcXEZL8Wl7ShAPMrqqFgeZw:5x9fzPkseSQawg+zjRcXA9l749+qFgeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267884, "uuid": "d925b92a-280c-4a73-b831-410c69b8f5e6", "value": 643840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267884, "uuid": "bc8068e2-534c-4b24-bf7a-50f6cdd7fd83", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267884, "uuid": "a6aef39b-b6f7-4c38-b967-2dc457e9b2c5", "value": "nSWIFT 0044FIDB230077.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b301e1ff-8efd-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701293077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701293077, "uuid": "e7cc48f6-4478-4679-807c-36893d8356ed", "comment": "Malware payload (Smoke Loader)", "value": "2e75aae19df9757fb02df8b4ef681273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701293077, "uuid": "0b9b99ff-b6e9-4839-a005-8bce139961cf", "comment": "Malware payload (Smoke Loader)", "value": "cb91a21cf617b5bf3356ee4ff69ac82fee292ce9bb8ae687affc2ca666f44241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701293077, "uuid": "44b6ed36-33ee-4ad8-9f46-3b30a88520f7", "comment": "Malware payload (Smoke Loader)", "value": "ab0b4bc1c96183b41ec0473ee2c4c10fddfc4ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701293077, "uuid": "a667b278-1390-4b06-bb66-8221a746fbfa", "comment": "Malware payload (Smoke Loader)", "value": "230b12eb8280bde706ba3d05f1741001661ac9f753b1fc42cfa38bd46ce092ccc84b49ab78f4142a182df793f2aafb5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701293077, "uuid": "94025cdd-44a2-40ae-82a9-37876321efc5", "value": "T1FB34CF2176E1C036E167593549B1C6A55B3BBCA25B3185CF3BA42A7E8E302D2CF79307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701293077, "uuid": "d5daa9b7-0d93-4d1a-8731-e59931eb3d47", "value": "048b096be44b05bf4b925a53be1310a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701293077, "uuid": "78ad97e1-e2e4-4de9-bc1d-b369ba9152ca", "value": "6144:oEPdApwt4txFNVsw1LL+5jvRRRNXAiUV7zUg:oK2txXVsw1Lq5jJRv92E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701293077, "uuid": "9efadfdc-41a4-4305-b6d8-e5cfd5df2186", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701293077, "uuid": "94e44cda-8152-41fe-9ded-4103dda063b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701293077, "uuid": "1e8d86c9-a762-466e-9188-fe16f7fb63f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7dae557-8f03-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701295716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295716, "uuid": "717242ea-5630-4e6e-94d1-a51b41da1b8f", "comment": "Malware payload (Tofsee)", "value": "030e48abc89de9fcd19a1af1e03d44b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295716, "uuid": "7431e467-a4a0-46ac-a32b-fc8093ae3df0", "comment": "Malware payload (Tofsee)", "value": "cc5dd82a8212925a8e1e615ad1b51d4f9ca966eb904cc449f5d1476dc11e25d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295716, "uuid": "c6688453-7d31-4bd5-8c6a-0886806372f0", "comment": "Malware payload (Tofsee)", "value": "f2df612c4d224070fedb5bd2d4d751f83fb3a4ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701295716, "uuid": "cf188695-8b00-4b06-b17d-2f6810110228", "comment": "Malware payload (Tofsee)", "value": "da6eac75a32bb89d0946a4dbcc58528532a9bcc7c93919b8f3663a4ecbfdcf126b2e8bb225bac178eb3faa65492a2141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295716, "uuid": "104c35bc-f393-466f-a678-d93debee3583", "value": "T1D634BE2236F1E032E1675A3449A1C6655E77FCB29B2186CF37A42E3E4E316D18F78346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295716, "uuid": "fb8ddb91-4af5-4e24-8825-d45077fb1719", "value": "10d5222eea59eee664433b569e6134b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295716, "uuid": "727789d1-de85-4ea3-8c76-7d9c617001c4", "value": "3072:U7qwWrOY0tKmWipd4Zx7eJplis7cHZpaEp2XerVQCJjve+i:mq8YVByd4Zx7Kpj7c54Epnqof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701295716, "uuid": "b7cdf3eb-9298-49e8-bcab-0289a8ad2ced", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701295716, "uuid": "7522b04d-9524-4e42-bb6b-f13b4b09d11c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701295716, "uuid": "c3090083-b6f5-4dfa-b7e0-17823079b2c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91383fb3-8ec4-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701268539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268539, "uuid": "bc307e31-90f3-4459-b7f0-c864fb643537", "comment": "Malware payload (RiseProStealer)", "value": "c3f91b46a22380f7d299ad9bc1857650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268539, "uuid": "2ae2afd5-fdf8-480f-87da-54247bbe0813", "comment": "Malware payload (RiseProStealer)", "value": "cc6a9c67aab8b828de9342bf348f131b8d255a5d3a88bfd439c76717867a58ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268539, "uuid": "fce13d55-2542-499a-a4cf-11b0fc9dcbc1", "comment": "Malware payload (RiseProStealer)", "value": "ba39251b7d152d1b1c8377f63df47ed67ce04113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701268539, "uuid": "c8c8a188-d504-4843-b8ca-51f1053b99b9", "comment": "Malware payload (RiseProStealer)", "value": "8d0bf45084de1d19e8eeb29a04503004c03dc1f6fb706876b53388bf4c58723171821c3457fe96dc6a748d852fb81614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268539, "uuid": "c1fdd5ff-22a7-4962-b1fa-edc0ca422876", "value": "T17D953313E7D8C112C9F66FB914FB17AB0E3A3CE6FEA493365B49A5451820560C96233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268539, "uuid": "ca31f108-2952-4d92-8b3a-a1556fa5d359", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268539, "uuid": "db8c3492-57e3-4c7f-bf48-3d12ca135e42", "value": "49152:XQzVwBriUH9kJtyrdzf7fvKcpw5+W93EHPgfnF5J9u1:seBriUHO0FwAC3EH0F5J9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701268539, "uuid": "7eedbc26-8bea-436e-96ca-3a4b94cda7a9", "value": 2024448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701268539, "uuid": "2c1a3f99-622b-4a1d-8e46-b97d9ecfaadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701268539, "uuid": "abac697a-211f-4549-9fc6-bd4d9402bfa8", "value": "c3f91b46a22380f7d299ad9bc1857650.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b62a678-8f12-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701301950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701301950, "uuid": "55564c80-f7c8-4afc-a966-668e8b3d5456", "comment": "Malware payload", "value": "7bcd1415efc8744ba8a0a5b71199af5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701301950, "uuid": "5d98a277-b832-450b-bab0-51975f717ef4", "comment": "Malware payload", "value": "cdf05d78f3a588cfb721a36c6ae43365c45858a26a9145b719d8e98eee69e3fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701301950, "uuid": "28ad1737-741a-4a8a-afe3-03c6fbf53889", "comment": "Malware payload", "value": "e4d0a4fdbb0d4014a042ae5c9549e5ede1d7aba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701301950, "uuid": "e8ea40b9-47e1-4196-974f-969d12eb8adc", "comment": "Malware payload", "value": "6ed257df7ece1fdd6b15bed4c794d5899980642a25f82ebbf03ced3364bac3c66193c92596a7ddaf8516c7cdf121dede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701301950, "uuid": "be475650-adc0-4dbd-bba3-51e0fb56bf34", "value": "T167063342A3870031F8669E30A1A54594FD633DE85DF0255A2DBCF70CDEB62E6CCB6716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701301950, "uuid": "71e241a3-f381-4056-a23e-229290106f84", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701301950, "uuid": "e9d663f4-6589-4669-846a-6dd0c1a4b22f", "value": "49152:WXC/uMaPD/SRt/+Ve/YM9W9MEFv9USUlWlysGJ4GIUYBM0H03ToRubjXUCl:Suu7UtW20xV2CMaYTocbwCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701301950, "uuid": "72f3cfd1-5fe5-4b09-9475-43e6596338d0", "value": 3945850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701301950, "uuid": "878d4915-ba86-480d-ae9d-8e5d220cb732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701301950, "uuid": "be3d937b-bd69-4e21-ab72-ab5514b83314", "value": "app-version.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833af7c8-8ef4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701289131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289131, "uuid": "7b468299-9704-4e9e-bc83-87656dd130e2", "comment": "Malware payload (RedLineStealer)", "value": "7522f2c8e8b5b8ee871de8ee5bfc14c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289131, "uuid": "6ae48f47-f5ec-480d-bbfc-5702865dd0f7", "comment": "Malware payload (RedLineStealer)", "value": "cdf64a111349a82f90434e360e6312f107a45a6dafa24f8fcddb497e1584ee79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289131, "uuid": "6f239231-b7b8-4227-acd5-121c928d0cbc", "comment": "Malware payload (RedLineStealer)", "value": "9804c020680bd185fc86fa01e983adf36b398558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289131, "uuid": "f8fa8cd7-0d76-4996-bb0f-2dbf92ba2044", "comment": "Malware payload (RedLineStealer)", "value": "7ee3066f214692a3a934c2d44c72a65465c64f3c238923e7e49ed18b49b21057073b35b44f6509d2bc8fbb1df040066e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289131, "uuid": "d80c07c6-e2ac-465a-b8c0-4fc38362d0a2", "value": "T18155F131F2D05637D1233BB98C1B57E85837BF103A38649E6BE81E4C6F356913A29267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289131, "uuid": "c8e1680b-c328-4e96-83d9-e8672c357a4d", "value": "09599dc2546051162a1974f3fc487194", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289131, "uuid": "d4ed7983-5461-4f14-a68c-3449a2d9936b", "value": "24576:dh+70C2aQSMpAa4jkSmD99LErIkkUITV5yNktIX8pr:di2x4gdqQnKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701289131, "uuid": "13fde21f-1257-463c-818a-8311ef5ae18f", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701289131, "uuid": "6000d811-04a4-42e2-8122-28320fb6ed76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289131, "uuid": "4417002a-f461-4797-a3f9-00c3982e069a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3610ffa-8ef8-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701290930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290930, "uuid": "bbe8ba38-0553-49dd-ad28-eb40f4a2f439", "comment": "Malware payload (Tofsee)", "value": "978deab620bf20b13c873af53ef77b75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290930, "uuid": "0faa5453-545b-488c-8f59-8241893abddd", "comment": "Malware payload (Tofsee)", "value": "ce7a61bb96459aa19c81170f6b082ad67093ceb3510392a14bfd2cfa35bed27b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290930, "uuid": "1be8c6a3-f5c5-43f5-bcaa-2346f0334b96", "comment": "Malware payload (Tofsee)", "value": "139fa8f3784583482aa73c992b2d1cba2004183b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290930, "uuid": "bd7f91e9-4955-4601-8f11-4a515f2018f1", "comment": "Malware payload (Tofsee)", "value": "d0819cd4337eda8d3cf654031df40cdaa48d627bab7aa8574a1ae053690d340d0b746eff4ba9fa8ef31af393f8f23f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290930, "uuid": "bbbff5a6-360e-42fa-ba21-8f7eca94c3b4", "value": "T10334CF2176E0C073F127493549B0C6658A37BCA29B7186CF27E42A7E5E316D1CBBA317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290930, "uuid": "3780d84e-8466-47bd-b15f-0afd83878505", "value": "048b096be44b05bf4b925a53be1310a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290930, "uuid": "831e5e41-5ce6-4049-95ad-fc4f967479c8", "value": "3072:WmkxaDeg4xSLmfpN4UxhAu+1dNNIXWBziq1xRN95Lk75kDK5dSOi:RkZgF6hN4Uxh0w0iqT79y75am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701290930, "uuid": "d3c49594-8eef-418f-bcd4-4eacd1e66139", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701290930, "uuid": "93f4051f-9228-48d1-8907-d8e5d58526a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290930, "uuid": "18ff98e3-6821-4a5b-8d3d-66bc04d0994f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4febb5fd-8e9d-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701251679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701251679, "uuid": "a38d17dc-cbe9-4c05-bd77-8e54e03316b4", "comment": "Malware payload (Smoke Loader)", "value": "11d22bd63584dc0ab01b0dc957f9ccb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701251679, "uuid": "4914979b-0d71-4386-ac4b-725eb46fa9bb", "comment": "Malware payload (Smoke Loader)", "value": "cef85a8d7492297af26aa650e4eebb8bd4a7095224a21b4e19b6d9a024ddb9f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701251679, "uuid": "69d3569f-b5ce-4a93-b8dc-89f6e6b221b6", "comment": "Malware payload (Smoke Loader)", "value": "566dae3d9cbc8c38b3279336a7c3b2b3ec7e75f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701251679, "uuid": "e8e0313f-b55c-40a3-a1fd-39f0ae153f2e", "comment": "Malware payload (Smoke Loader)", "value": "ac8f743a1467f139b10c841d5f21e947be4ad8a67e0159074d0791d3bfc94844632f3b7f5bfbf615b7b0f1f38d0a216c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701251679, "uuid": "260fd36e-13f0-4caf-8b1c-3038dcad8048", "value": "T117546C1266E56861E5174A33BE2EC6E8271EF9909F156BDB33586F2F09702E1C673303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701251679, "uuid": "0500c523-d8cb-45ac-95a3-93dab4e0c4f9", "value": "a5ba2e63e413ae40c0d8efc223d7976c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701251679, "uuid": "5c9d6d90-8deb-45d6-a4f2-f0f263b3938e", "value": "3072:npnueQXO8umxzhCS4y/a9QsqD+ALEwtWLh1RlsNPWK/X0NwSAQqfTeD5lsMV:pn2Omd8S4y/C4LEwtcUEwSVu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701251679, "uuid": "29cf6a98-ce94-4119-ab37-ee58bea28d9f", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701251679, "uuid": "ea05cc42-fab6-4892-bd50-d04772f7b9bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701251679, "uuid": "33e1eeef-875a-40e4-bf21-010862b1204f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d167333-8f0c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701299295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701299295, "uuid": "74bf398b-dec5-44ac-a6a1-f8d08c8c3e62", "comment": "Malware payload", "value": "6e880cf85afeb77416dcc9e68438af46", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701299295, "uuid": "dafe7ec5-3aea-488f-aa1e-719d579c23fc", "comment": "Malware payload", "value": "cf45aa17bfd7ffccd08bcd0bbdb2490666068c42df1983f811dbb3290ef66c01", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701299295, "uuid": "b8f889e5-f6ea-4d08-934a-67040b8f51db", "comment": "Malware payload", "value": "15e5e318cefedb19c222880eb6b5c79a176aab45", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701299295, "uuid": "e79dd3d0-c203-4ee8-a1fb-e0c83c4a5b40", "comment": "Malware payload", "value": "4707a9bcdaca7e214081881fae2e1d2d2093220397b2775766e6e2da13cf2193619fb827ed1611d0d4907b14cc384ef7", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701299295, "uuid": "01995454-054f-4a0d-8c92-f05b6a8a6f3b", "value": "T1B41723C7D5E997EDC493474069C223C664C4706BC9FE8A2C3ECF1C027565C698ACEAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701299295, "uuid": "7dad9185-c3a2-4895-8145-815665f56b47", "value": "f2d710dccfaea919f61f44c5d206a81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701299295, "uuid": "193a8e37-7e42-47d8-acbe-5e2c1de275a7", "value": "393216:STe76WrSxSiGGbnCfCteUQqZY7pmVoRyNLzEZYpuh/cE5SVQ:SePrSxSEbgIndVxNLzGEuXuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701299295, "uuid": "eeb69f5f-0b49-4d9f-ae53-950d49c62fa6", "value": 19625272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701299295, "uuid": "57cd488c-fdda-4355-af39-aba002ed770d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701299295, "uuid": "d547dc20-e732-4f59-b1e2-204c84907f47", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe3a604-8ea6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701255833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255833, "uuid": "3658cd04-a868-4ac7-a8ef-112025f09871", "comment": "Malware payload (AgentTesla)", "value": "66c6c9672ffad343944b0f8b6b4e3dcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255833, "uuid": "76ef3b5d-24b2-41a4-92b5-47af6cd528c6", "comment": "Malware payload (AgentTesla)", "value": "cf635bc1b437c5c12aac8dd5dc92c4a3f30647f8b1f49633b787c92e3cc94047", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255833, "uuid": "3e00f510-0bd4-477d-8e13-02c233acc3a9", "comment": "Malware payload (AgentTesla)", "value": "d55d6819f3be2bbee0710fe5cb17f6a42c464c59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701255833, "uuid": "33462b05-2ce6-4a5c-9ef1-4edffae8c638", "comment": "Malware payload (AgentTesla)", "value": "a19f7af6726fd522ce1f9694d95c4aa83c867fb1710dfc122c8e75779c2c665729c57d04a4f6e4869ca3c006dbb1e923", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255833, "uuid": "2f566535-81b7-4a3e-ab97-7cc30743e793", "value": "T18DE4128139D99E27C66F25F828BA640113F7849A7D95F7CA6DC1F0CA5AE1FE0030169F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255833, "uuid": "d6d8d5b4-e93e-4086-89a2-832830cdefcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255833, "uuid": "f618a30d-d5ba-4e39-b03c-e2316e59dfd3", "value": "12288:1h6pQmbCp92iNWgkjYa9U5NKl6Bngsvjzzpb6LDurVFk1ggb:1l1TkjtU50mbzF+/8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701255833, "uuid": "133517f4-0e36-4480-af20-377fedc9dafb", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701255833, "uuid": "2793c65c-92f1-44b4-9040-7e927304f6ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701255833, "uuid": "5c09f932-6557-44be-be09-80cbc1e70018", "value": "PO#23-0196 Soft Shell Nylon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b81e864-8e89-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701243028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243028, "uuid": "f0a12812-b7de-4c0a-8279-7d2bd9744aed", "comment": "Malware payload (Vidar)", "value": "45f0ef6f974ff1a0d8b03d5dbe743ef5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243028, "uuid": "f4ae5062-228c-4fcf-9523-59edb6e4ed70", "comment": "Malware payload (Vidar)", "value": "cfa7e9a5e2ebccf9086d41007f2612d7aee348f17ff75b0ec093d3f5c5436e6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243028, "uuid": "8e17eb2d-d62a-4675-9fa9-49529edac6a8", "comment": "Malware payload (Vidar)", "value": "4340b3e46fd6bbac91c0873411062414e9f9eebb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243028, "uuid": "09087244-50de-47dc-9707-0c2388e73845", "comment": "Malware payload (Vidar)", "value": "db87f4fed4f909c7ca04e499cb9bf13291cb384fa97d7c7aece9793edd14a146da914b9652ef611b15e525bc53e2fd61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243028, "uuid": "e02e8dc4-4b18-4466-ac01-d50cba3740c7", "value": "T1A5749D13A2E46C61E5264A33FE1AC6E8671EF8918F156BDB33146F2F49712E1C663703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243028, "uuid": "6a99b9cd-5d9a-4c10-becd-a4f8daca1605", "value": "99e733edb40d39f08a07658473c3f554", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243028, "uuid": "de15af34-fc5b-45e8-a40e-0f9f8f3f6644", "value": "6144:HXtOufURE41aBMaaOC1bG32oQO5mgts7s:HC/1wVaOdQOEg27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701243028, "uuid": "13c51dd1-a9a0-4175-954c-ab24ec0652f5", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701243028, "uuid": "60eece1a-3590-4dae-9094-2d1278b3bb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243028, "uuid": "8f0fd580-7c4f-4b95-a31d-967192c46b8f", "value": "45f0ef6f974ff1a0d8b03d5dbe743ef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae19e3f-8efc-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701292634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701292634, "uuid": "bfad9e66-25d8-40c4-bd0b-b19041547698", "comment": "Malware payload (RiseProStealer)", "value": "5419a29f7eb293b9c9ae03228631e53d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701292634, "uuid": "889488eb-d928-4183-a25a-79043d8679cb", "comment": "Malware payload (RiseProStealer)", "value": "d1c21f8da1764902654255cc5136f41a6e0301c2587b81d8f8e5d8070508a05c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701292634, "uuid": "53e2719c-e21c-4b1a-b7a8-a39ebaa41de5", "comment": "Malware payload (RiseProStealer)", "value": "5f194cfc71144efd3c27c085546fd2f084c8923d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701292634, "uuid": "81aae8ab-882f-46e5-8469-327a68131c80", "comment": "Malware payload (RiseProStealer)", "value": "0903cdfad0138f9598593105b26c33f4e85ec3b9a96b2974aeb7fb26e7a32fa7d40a998593aeb30105bc20e9e923fb6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701292634, "uuid": "6587226b-9f20-433f-93e8-bd76f8e6ba77", "value": "T190857C10618EC14CE430B6F699C0D94F4E13AF9077A9CDE73E68F8B579BA21D414EA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701292634, "uuid": "4aab5c09-15ce-4b8d-99c3-45eb23233c50", "value": "becb59d6c2cabee1a77fe54131d4eacf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701292634, "uuid": "05067bd3-ab0c-46a0-9b9d-9bf05954ede9", "value": "49152:tflJPjo1laOtQlIg1Vm3akQnzCT5snij4f/SXkwC:tfUhmkuokrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701292634, "uuid": "2ed16d6e-afe2-4954-b802-de6d1361ba6d", "value": 1726240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701292634, "uuid": "00a0f409-2467-461a-a6e9-42eb1c2fc0a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701292634, "uuid": "7ad50432-aedc-4ea4-952d-9ee3c0168280", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea98885-8e9a-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701250335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701250335, "uuid": "d0e81cf2-983f-4963-97a0-c20d8f344ac2", "comment": "Malware payload (RiseProStealer)", "value": "9589d997239c84b7bdd00105d97b0f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701250335, "uuid": "0360cb5e-20b4-40ca-a62e-df1de5a19666", "comment": "Malware payload (RiseProStealer)", "value": "d26224c57a63c18f13618bbf7ce0519cec264445d0adcc1a34ba3d26a3e61919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701250335, "uuid": "ef4f4548-5823-40be-910c-26a2240cacaf", "comment": "Malware payload (RiseProStealer)", "value": "a0e58ab8681d4ce9b83da4b521d6cbc6aba0143d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701250335, "uuid": "e3b713b1-2941-4b8d-9ac2-3a1edc081431", "comment": "Malware payload (RiseProStealer)", "value": "cd1cb5b6423122a9f547cf9811367f5af50ccfb57e0a4bd342faf3b93a90e2036618637253a9b8fd375238983d1e5640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701250335, "uuid": "7ea58b16-665c-4ce7-a973-3e02b752869d", "value": "T155658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701250335, "uuid": "ae827317-1860-4341-8535-a01cc8d3005a", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701250335, "uuid": "d95ffda4-c1e0-4909-a260-fe23fe249c4b", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WtI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701250335, "uuid": "598d9688-8b95-4c51-94b9-b00799ea28c6", "value": 1540041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701250335, "uuid": "565b9c42-3a8e-49e2-80a7-2e11b141e865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701250335, "uuid": "f122955c-111f-4aa8-baee-b23f68a132a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59971e5a-8ef2-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701288203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288203, "uuid": "2ccf65a9-0880-43a9-b827-52064c345a45", "comment": "Malware payload (RiseProStealer)", "value": "7bdef41a67e1cdd16a002ed67bd4e1c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288203, "uuid": "e49545ba-17b3-4558-a2a9-8bf27a9b54eb", "comment": "Malware payload (RiseProStealer)", "value": "d3e922bdfbcff978ba5c46f42c742f01a370b240bee139c847aae760f0afdb8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288203, "uuid": "04d3c886-01cb-4e3a-bab1-03a85a338ebd", "comment": "Malware payload (RiseProStealer)", "value": "5420df9f376e97c9758c41f7c7bb5e78aa94275c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701288203, "uuid": "7366282d-c54f-417e-aec0-726d0b0a88ac", "comment": "Malware payload (RiseProStealer)", "value": "cb008129b9fa190ca8fe16c6a8c98ad21904aca288b6e9f34dfd8fdd3baad84a6ed91fb91e085c7b7aaca634742763a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288203, "uuid": "494ace9d-294e-49e2-92e3-71fe0963a4ca", "value": "T1E5859DCC930B0455F2D5AF78DA288A21D87F644D76F336B2FBEA2BC52DAD12242C4457", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288203, "uuid": "96bb8f6f-ad3f-4335-927f-8beffef0c36b", "value": "becb59d6c2cabee1a77fe54131d4eacf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288203, "uuid": "19e96dd1-8a5d-4ef6-b657-edfe08c98785", "value": "24576:SfPQu3Bm+wDG7/uNmeo+KhNwK3ONbvBgl4gY6jknxFZAE0C:SfDBm+oGruNNObqpBglDLjkXWdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701288203, "uuid": "6a070357-a788-402c-8356-acf3d5bb6b83", "value": 1726240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701288203, "uuid": "3b1919b5-9892-4b99-935d-128652e24cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701288203, "uuid": "d94bcb5e-3c8d-494e-9149-0afa2fab510f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f834f83-8eda-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701277851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277851, "uuid": "73a75361-2d49-41c9-b091-c4ae8bdd392e", "comment": "Malware payload (Stealc)", "value": "a6b8d8e74c1ab5b6b09784c49d36b071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277851, "uuid": "aed5908e-dca9-4a4c-a137-1c18f41a8431", "comment": "Malware payload (Stealc)", "value": "d407f1314cc37bec7df6922d915a66f6b46d76d47f71bc6223884a2f218bdd09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277851, "uuid": "9d35aa7f-dc1f-4772-b5ea-c75301409ee1", "comment": "Malware payload (Stealc)", "value": "21e9f51f25ca66508120268deba7f4daba0c319c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701277851, "uuid": "0013955b-e61e-46ae-9aef-7f47621d17e4", "comment": "Malware payload (Stealc)", "value": "52d27c9163c8710ccd431dde6d3a6577a7e00ed6968f0721a1de857c0ad6f1cb50db3ce1fedbe7aa0a05a89a75747471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277851, "uuid": "74beb47b-5361-4a74-833b-8379a2cec5f5", "value": "T19D34B02176F4C072E1274A394A71C6A55A2BBCE29B2185CF37A42B7E4E317D18F7530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277851, "uuid": "e45fa074-49c2-4f9d-9cfa-40d36fdf9ba4", "value": "fc956831b783140e741d0df04dc16771", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277851, "uuid": "a5ddd847-ecea-43de-96f7-c747e4a03495", "value": "3072:vAwlNe7UpetK9QnDZ4Px2VlJ595guII7kVjhmjUbeJIieLk7esZvbBD:owl7pz6DZ4PxYj2xjhQKeiiR7e8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701277851, "uuid": "71f07271-d2ce-404f-b5b8-af416e787c06", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701277851, "uuid": "79dd7cc3-5e66-450d-965b-dcbfbec07dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701277851, "uuid": "c95d47a8-fa48-4fc0-88b7-dfbc1cd5408b", "value": "a6b8d8e74c1ab5b6b09784c49d36b071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10972348-8eb9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701263599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263599, "uuid": "ab82c250-f930-4f5d-a9f8-69c507c62d76", "comment": "Malware payload (Formbook)", "value": "60822dd70f7e0a01639ccc5a8b990900", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263599, "uuid": "019c0281-c4d3-4351-a549-7c56474dfed3", "comment": "Malware payload (Formbook)", "value": "d4e240c379c4036970297c0a82703c238622e39b833945e4c335201ecf3ceea0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263599, "uuid": "d33f8265-7448-4e62-9530-a373afbf1e92", "comment": "Malware payload (Formbook)", "value": "aca28435d528f283b5087113739efb5ed592556f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263599, "uuid": "d0720463-0982-468a-bd87-3bcc51c5da97", "comment": "Malware payload (Formbook)", "value": "95da826c85490e347bd309fb8e1e8326e819341072ce1712663dbad0cfda32a16a73c0c8ab352a60e9d7608a2e5a855f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263599, "uuid": "5fa894d3-6d4b-47be-87f1-780cfafecfa4", "value": "T19854237F5873C68CD6394532A9D397BEA7844A262A06CF8033C0DB4A7FF2475749EA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263599, "uuid": "af9d425f-979c-4dcd-a00f-3ee7bea8eab5", "value": "6144:OUqlV3f37OrJ27hxyj4hEPLzaTct4OaLlfA655YXlpG9O/wdOa3NEemV:OnD3f3kiTzhESGaPj8wUa3NEemV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701263599, "uuid": "b377e400-0794-4282-a2c0-dd565e447aba", "value": 300645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701263599, "uuid": "28a5e7d5-63ec-4929-b444-8ab43b65b1b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263599, "uuid": "19d7b737-3797-4cfa-ae46-2dd4af1a2215", "value": "Statement pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e7aba6-8ebb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701264465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264465, "uuid": "0cbb4f36-7ebb-41df-abbf-5ccfac60ca2d", "comment": "Malware payload (AgentTesla)", "value": "39a33355e0b0db7354f1ee9fef4a9ae7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264465, "uuid": "c88fa39b-b5fa-4885-85d7-2dbdfabd0da6", "comment": "Malware payload (AgentTesla)", "value": "d5bb4709c6337d475b6217f03b784cd6aaf1642cd103eb5bdfd53788bcf35417", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264465, "uuid": "258edd29-4966-42a4-951a-75b46f405f67", "comment": "Malware payload (AgentTesla)", "value": "e867d971ead2351ea107ccd61517e61d35492270", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701264465, "uuid": "64a62a39-b5e9-485c-a09b-6145219c1993", "comment": "Malware payload (AgentTesla)", "value": "11822626dd7c9e467247680c4a4729b2c5d48b6b00825cdd329124fb1dc17d5d1144f01550dc1648d7c0f66a724f373f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264465, "uuid": "26242e32-789e-408b-8110-0073fb8b1156", "value": "T16305F147ACAABB25E93943F365546A1C0BB76C6E7CE5E3074C8DB1C6D2B6B400611F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264465, "uuid": "7c96bbfa-925d-4411-a7f0-321bc70322b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264465, "uuid": "49e22625-5aeb-4319-bbe7-64cc755dcdb0", "value": "12288:wl78EN4iZwP2XNFzW5b7gTyhRBSe7Y003MiNOx+0t+8U+n911oap:wt8EN4EbXDzWtNnBLvONOk2391d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701264465, "uuid": "2d5c28d3-2b2a-4c4f-be04-6ce433692f34", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701264465, "uuid": "182f9ee3-7977-4f32-8e59-cc03bf437520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701264465, "uuid": "182c209c-1571-4575-b1cd-969bbd56fcc9", "value": "PROMAC_S.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c72dc71-8e74-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701234037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234037, "uuid": "f0583cdb-662b-4c6a-ba95-aa404b201d31", "comment": "Malware payload (RiseProStealer)", "value": "0eca629eb4e864941584863f9f6393eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234037, "uuid": "52b43220-77e7-4b64-8c19-f1c89347573f", "comment": "Malware payload (RiseProStealer)", "value": "d652a76c1139883ad6af8660b00dd54d5237faf7e62f18dbb954ab3f1ac033a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234037, "uuid": "c32edcb6-e3bc-4831-8a0f-38f4716adec7", "comment": "Malware payload (RiseProStealer)", "value": "896928c9972029ff0380b90e3287f3274ab9bde7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234037, "uuid": "d4e042e0-a97e-4f2a-a6ed-3e210c6832ff", "comment": "Malware payload (RiseProStealer)", "value": "c959995df3dcc7961e0df5f5b744b5cce0311a1fd2aba1fbd7b0f15c1b57e4d688e73c1b1f60cc4f209b1039e9975a7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234037, "uuid": "2e9bb954-23f7-4e62-9fa3-caced70a0daa", "value": "T1FB953352B5E8902BE9792F30DCB38B1329B13CD0BEB45399371DA95E1872524EC72727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234037, "uuid": "1969885a-9a6b-4b8c-ad48-2f1035e6b0e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234037, "uuid": "5f43ef98-78c1-4608-8769-7b7c240a4a60", "value": "49152:1EF+NcdV+OiTioznBZpv05vZa1iBjmc59HBEQGGzKUl7:SMcdhCH4mczBEQMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701234037, "uuid": "e9babb05-14a7-410b-9b90-173fe26702f9", "value": 2022912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701234037, "uuid": "e087d26a-c5fe-44af-9271-bdfbf14926dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234037, "uuid": "b37359ae-dde8-43df-b605-c3317076e023", "value": "0eca629eb4e864941584863f9f6393eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f2ca0e-8e60-11ee-8907-42010a9c0042", "comment": "Malware payload (Phonk)", "timestamp": 1701225468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225468, "uuid": "854355c1-33e2-42c5-8a77-4f50d4dfe0eb", "comment": "Malware payload (Phonk)", "value": "c4092420dc39d3324306916a79f8d5a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225468, "uuid": "7d7e3214-0d9f-4ec6-9279-d23ee5591ce5", "comment": "Malware payload (Phonk)", "value": "d6a97630bdf41188120a543b8faab162ca5abf0ebf9651223a0f8dcd75f3e118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225468, "uuid": "28cbb8df-f6eb-44cd-80f0-d2544935ef97", "comment": "Malware payload (Phonk)", "value": "2ccbb1caec2818b8e7084492ff175e9085da3e13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225468, "uuid": "50fb03b8-820e-4a06-9eb7-4bc38720d4ce", "comment": "Malware payload (Phonk)", "value": "78d584e6da2b0968ede57d0fd9779a4f9c04b318a55d3481d7732f1baf5e87b4132a1cdc9dba45fca25ca3525a9f1dde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225468, "uuid": "9c78efc2-1cd5-4ed3-ba72-6b469ee67de9", "value": "T19AF55B55BA001D67CE6D01F3872BC20869D3C569230DDBBE36D791EAF70D2E2947E18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225468, "uuid": "e659ecff-7a09-4d92-8ea7-1d3256a94d1a", "value": "49152:ETHC2GdJF6XENtfiDkvfHGIEhGKi+52X7Wvdsr1rcWN/5TFnef4K:cH2d6UDclRQkfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701225468, "uuid": "71360064-9ce6-4950-9215-0c54eed66792", "value": 3642880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701225468, "uuid": "a586eea0-74dd-4b30-9191-8f162ecbd5d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225468, "uuid": "7b93d720-68f4-407f-bca8-d272b834cf94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a370945-8ed2-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701274540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701274540, "uuid": "52854ce5-519d-46f1-8a54-a3aad0c92adb", "comment": "Malware payload (RiseProStealer)", "value": "c094da38b8ab292a0cf40ee30e21a79f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701274540, "uuid": "361005f9-97e2-4034-8993-27086e766d33", "comment": "Malware payload (RiseProStealer)", "value": "d6b9040f55a9c51ea76e2838dfbaee680e3556a5b5dac65b13fc9223e7d93c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701274540, "uuid": "013fe0b8-2570-42d9-8918-cb3f8a37766d", "comment": "Malware payload (RiseProStealer)", "value": "90f1657ba5d173c6ec202e9bbbf2e050ea949c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701274540, "uuid": "af0a5dfc-d3bc-457e-b7d2-b7ca3dff693d", "comment": "Malware payload (RiseProStealer)", "value": "2fd7a40e80c04b83dd02daab86e079c90ade1feaeb30df6abef562a16ecac5323a499176af407b378d3fddc40a58614b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701274540, "uuid": "ba9266a1-fbcc-447b-ae67-18c9c3caa732", "value": "T1AC85339672DD8063E8B14BB128FF4B835F323E916E74431B2376E54D08226C9E938767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701274540, "uuid": "62a17d55-789c-4d5c-9855-6c185060fdbd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701274540, "uuid": "65d7ae42-748a-4abe-b473-a6380e6ca935", "value": "24576:1yPX2wi000tei12DgNuVBxDt6N0abg/qsXwcjKVljx+TIqxEW01bAHQQbcUtB1EG:Qr/ey2suNDoN0b/qEQ6xwGwQbhL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701274540, "uuid": "afe30d69-4cd7-4825-9045-1f2e7f3a9122", "value": 1829376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701274540, "uuid": "4b6c713b-032e-4763-8964-ff71225b9f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701274540, "uuid": "73f4d6d0-3df3-4428-b2c7-36ed0a821482", "value": "c094da38b8ab292a0cf40ee30e21a79f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44d07c0-8eac-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701258263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258263, "uuid": "8b09592b-85f6-45c2-acbe-6d218f0f178e", "comment": "Malware payload (Formbook)", "value": "614698b189537cd4562737d5935ab5b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258263, "uuid": "daef4c9b-a23d-4e3c-9229-852e20d9122f", "comment": "Malware payload (Formbook)", "value": "d701a8e701c6d150ac156e35b1c71024884ded86c1e8564a02c30b772b7338c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258263, "uuid": "8187c351-bb21-4231-a84d-a702727d1b76", "comment": "Malware payload (Formbook)", "value": "e590b7c807ef52472a1981b7e4ca9bb71b7e8d23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701258263, "uuid": "080325b2-3e15-4e6c-8e63-9412bf8203df", "comment": "Malware payload (Formbook)", "value": "8c444eddc17bb38d1f2267be798e0c6f0ae95692fb9924f647f86f8871bfcedd436f8a9808ac2dc33f5f907b84862731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258263, "uuid": "9cb1351a-b415-4ee9-a12b-3ec79c335f4d", "value": "T197E4128672A4C433CE094FF49467EDB942B5BE632072D39E7DC95CAB35837884A93127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258263, "uuid": "2bd8df4e-d268-4a52-b00e-edf4be7a8818", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258263, "uuid": "e0b68a46-f015-4eea-8d82-8a08abe64d48", "value": "12288:F9copox46B636HoIC/kn2/Qo7mG7DmGhRLhcuWF:we+B636IIC/k21TDmcLhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701258263, "uuid": "e27ad7be-d337-421b-a33b-8c04e70b14d2", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701258263, "uuid": "e6f24054-5891-4d69-9206-79097087efe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701258263, "uuid": "39a96c21-33c8-43b0-b436-9260f68a7588", "value": "PURCHASE INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5858d771-8eb0-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701259854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259854, "uuid": "17308d40-47ef-4676-a51c-ec55c82b2542", "comment": "Malware payload (LummaStealer)", "value": "39e2f8668de35967b7bc4091baa6bc75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259854, "uuid": "8c0f0763-4a42-489d-bea6-4cd73162168b", "comment": "Malware payload (LummaStealer)", "value": "d759eb48ab77e3328bcb22e6544d790878bf24c689f47e5a6ed96161b5c26032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259854, "uuid": "4bdd6d4c-2e77-407c-814d-4b0d4478082a", "comment": "Malware payload (LummaStealer)", "value": "82f75fa9a413c6953bf0702d4b4c8c9367faee54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701259854, "uuid": "0fabc179-6d36-493b-9365-ac15ad0f655a", "comment": "Malware payload (LummaStealer)", "value": "e22f905932b7511ebb368c409cbb60704e0d59201ed7933f001116dd46fbb34612d11fa404860e0cdbc639174f0c4ca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259854, "uuid": "3a030462-7ae9-45bb-8841-6c73bd5d1015", "value": "T17336B579AB1013E59F8359CE4E07E7D6EE6DD1107212246D628F068BDA438EC4373E6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259854, "uuid": "57a3b9fb-d439-418e-ade2-5d3dc25fea67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259854, "uuid": "942beedb-fd7e-4de0-b1df-24e2e048dac5", "value": "12288:e0L7m8mkjKq4qQYs8qNTXjEW1sN0x3OuCr2ZvXacLIcqjLnDUDe3sEsq7Cawq0I6:eSfmSKq4qNWNrjEW1M439VpoQLTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701259854, "uuid": "ff5cb2ba-8e8a-4dff-880c-5d07aafa062c", "value": 4870984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701259854, "uuid": "0c79f26c-53b3-49cb-969e-7f0c9d6ead9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701259854, "uuid": "05b298a6-3421-42d2-b827-c24b596ca517", "value": "D759EB48AB77E3328BCB22E6544D790878BF24C689F47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3a01e9-8ec6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701269475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269475, "uuid": "5e0a94dd-8c7a-4c5c-857d-fe80d4fc9795", "comment": "Malware payload", "value": "da25f4c8298f4f9e322d7848d956a04c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269475, "uuid": "294ba57f-c065-4662-af8b-5f7082f97b97", "comment": "Malware payload", "value": "d7b8caa69d88b7504bb82e8e779404c85d399a1d597a65f91010e840c7b6d733", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269475, "uuid": "d1f2595a-dfb1-4f40-9189-16deeb87b32f", "comment": "Malware payload", "value": "16547061b31d1f256124aa53d08a151e3ae4f957", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269475, "uuid": "f1a09b5c-ce81-41f4-9a6d-21062e60db93", "comment": "Malware payload", "value": "cc45ba1574e064a38116d230edb70d6c72263004e938f83121aec0925c46b347326ed2b2813dc99f307dc8a270e4c0fd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269475, "uuid": "c32ceb84-d7a6-4483-a45a-c84656d3bf25", "value": "T12F447D06B3D5437AE4D702311B9F93628F72EC788663422B1699760E3DF1594B7B32E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269475, "uuid": "23f7e54e-b2fc-4f74-9474-3b76b1257a01", "value": "3072:vPwI/993DQY5ACU6ij4qpXqnnDibAJBVkfMcB3RUN46ILJ9+ZB5yOanVO:voI73DQY5ACTqp4nwEXrWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701269475, "uuid": "f563028f-3b7c-4fd6-9c69-5c0b97d92859", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701269475, "uuid": "a8ee0c81-928b-443e-b715-4adc7a23fbd8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269475, "uuid": "e30c0637-6ea1-4e1b-b5cb-e9bb4561b76d", "value": "MAIL_PDF65674.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedc93e8-8e69-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701229531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229531, "uuid": "df6b7696-cf58-40a9-afe2-62932d75bf51", "comment": "Malware payload (RedLineStealer)", "value": "0f851a66bdcaf417d37f6efcaaf93086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229531, "uuid": "e9eb6b29-b8cc-48b5-9dc7-ed3ff297cd9b", "comment": "Malware payload (RedLineStealer)", "value": "d892609b2ab57d6507c291a19dce9762a2f5a475bb88b2cd8b0359b6c15ec767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229531, "uuid": "bf24a9da-2e9d-46bd-96f4-2fe7f8b5b749", "comment": "Malware payload (RedLineStealer)", "value": "caaeaf5582726d406e22dd94ba3ba5b80a4d81a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701229531, "uuid": "47b6def3-cd0f-4d4d-975f-50c70f4ed98e", "comment": "Malware payload (RedLineStealer)", "value": "b10f2a96dc6e80b3b4e2baa1dc88a88b8a706cc2ba8d111dc2bdf42e26db4c5790d77359e49091fe21d570f818c50bcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229531, "uuid": "981d19ed-984b-46e9-b2db-0c98b231c6a1", "value": "T141851B1172F94B59FAF31BB956BAA61108BAFC69CF11C2DF1260548E0D21BD08972F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229531, "uuid": "e618d907-7daa-414f-aaa7-05cb71f1e6f5", "value": "c7fb2b0f7d1b9bb69de473555ebdc92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229531, "uuid": "8698609e-9ec9-4212-a3e1-eb72af55d765", "value": "24576:BHMBMJIR6FC97GkbnwqjWr7eyh6a9DhvhashX:BHMB0FC97GkbnwwWV6a3vhhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701229531, "uuid": "bfb367f5-b803-4970-ab76-91d205e982c4", "value": 1794848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701229531, "uuid": "b07702ac-be00-4ea5-b1dd-502f7254fee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701229531, "uuid": "c323b95b-596f-4e10-a724-e1597b1ec0b0", "value": "0f851a66bdcaf417d37f6efcaaf93086.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbe7f6e-8ee1-11ee-8907-42010a9c0042", "comment": "Malware payload (Zyklon)", "timestamp": 1701281180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701281180, "uuid": "bfc3a374-7334-4cae-a5b8-e984e7304ae6", "comment": "Malware payload (Zyklon)", "value": "63c2df9e319679532b4514736190b51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701281180, "uuid": "7d3ba7d8-42b1-42eb-846d-b3a9a0a5f05c", "comment": "Malware payload (Zyklon)", "value": "d8a60a7ef1c8d5c20da0b41fa0dd318d6344810d4ccef5ff0adc54dd2bcd1424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701281180, "uuid": "0e276d7b-5073-417f-82e6-fb9b2eb74425", "comment": "Malware payload (Zyklon)", "value": "a65e9c219040a5b22c81c9a188327fb14add4e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701281180, "uuid": "2e14a4da-965d-4577-9122-90ce28696889", "comment": "Malware payload (Zyklon)", "value": "0a82018e6e311c65396df4333bf278b6572abc98b7ea66cc085544ec4a03abf0227455b1bfbdf19e6ee603f42bb1e961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701281180, "uuid": "d0aa6402-8428-4f96-85de-47d7f438609b", "value": "T109F5F10695564E33C2E8BFB185D3495E52A0CB627612EF5BB61F1C81AA16374BF032F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701281180, "uuid": "15d69965-1e9f-4f21-b5b3-13fbe082675d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701281180, "uuid": "260e8a81-9b87-437b-9dd5-cc8a7f19686e", "value": "49152:wiEiVcykJBw/9/62bh3KpdLHGkRGImHkVqPp3ubRB2UWUv27xibsdmpHu:wza0w3YdLmkRGI0kVwVEMfUvxpHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701281180, "uuid": "431c9c55-e44d-4aad-b144-b6754f498b82", "value": 3622400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701281180, "uuid": "a643e9ad-7b21-47f7-9c26-dfabc9d16c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701281180, "uuid": "268c718e-d042-4aee-82d9-fe377d95c0ef", "value": "63C2DF9E319679532B4514736190B51D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbef1ec-8ec3-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701267966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267966, "uuid": "039f9068-129b-47c9-8838-60afd44f006c", "comment": "Malware payload (Formbook)", "value": "5f41ef29e36747fa9dcf6c88d6442be2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267966, "uuid": "52baeb34-58d6-461e-954a-b4a38705e8e9", "comment": "Malware payload (Formbook)", "value": "dd5db5ca37b7e3a33e323e2c984b9bf12eac507d76ad6e037b752b88563df71d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267966, "uuid": "ceb616ea-3fb4-4c3d-8322-b31f29b03173", "comment": "Malware payload (Formbook)", "value": "5e76cf2a8bb4ef97081fb5e54bb07909dce11008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267966, "uuid": "e672d839-df87-4572-b189-da83b5e648b2", "comment": "Malware payload (Formbook)", "value": "37d655542250aeb7bfb9a673d6104bb3bc48a66b1661351a4add8082301a4a67d9144fb42b8cfc8d8a5aee3253d3b752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267966, "uuid": "05095b63-d0c2-4d87-a770-1fe8143dc144", "value": "T1B8D40210E5BC1B26E47B47FE0A656180C3F5A83F2131E7995DD230EB1AA1F580B91F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267966, "uuid": "ba5d41d5-3424-4203-a905-895ec7c538a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267966, "uuid": "67b91d36-f1ab-48d7-8eb3-ce88865223f3", "value": "12288:LHJ5ARocawrt1X0W/ynigTSvzNw+RsesfJaEdVVl/gOopox:V5q2W/6iySvO+cf/dV3Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267966, "uuid": "d2f3cf87-ee0f-4b77-9466-5eb651aef1c4", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267966, "uuid": "82b0d1be-bd11-4dbd-95b5-40e2df9c822b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267966, "uuid": "663d6ab1-56ea-4d85-8caf-ae3406a7e996", "value": "z1ORDENDECOMPRAURGENTEpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf59330-8e5f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701225339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225339, "uuid": "a1755845-3403-41fb-95be-0d83784fda45", "comment": "Malware payload (LummaStealer)", "value": "047d6444c0614877f4d467d4a105cf09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225339, "uuid": "23ea84a3-7fc8-4ea2-b2d6-92de4acc03f5", "comment": "Malware payload (LummaStealer)", "value": "e01a4a38aecfa7ec75547cde3a827c5d4d1bb06297e75c27a2120352188b6159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225339, "uuid": "0be20e59-6132-4725-9c64-8f88ccee0f48", "comment": "Malware payload (LummaStealer)", "value": "fe55f9410d590676cd3d6070a07f98c83bc8a05c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701225339, "uuid": "f050b124-edf4-4bbe-b131-7d3fe3cded4a", "comment": "Malware payload (LummaStealer)", "value": "aba72000645bfb872d1056dea98afdc24fae9de9b981012c87e436f94ec90854d8f718298297edb08b68caf9e856054c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225339, "uuid": "ea490c57-0f77-473d-ac72-d28766918775", "value": "T152C48CC0BD4260BBC4965C350525A77B7EB80F615328DCEFC11728E0E6B5EBB9272927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225339, "uuid": "abca92d7-4824-4489-a684-c203f1c619a1", "value": "6313a99fffecb8759e5b2f8e8aff2a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225339, "uuid": "d8573cd4-d23c-4439-b915-9e6fa951cc1e", "value": "12288:GLmv6J3O1b3pwFRNkdgUkFnl3jURuRe5n4GZ91Rd6qIXzsQxvXnfoMC0YjgN:Qmv66b32F7wQr7e5BnT6qkzs5Mzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701225339, "uuid": "60a1c610-06ad-495d-b17a-96b7da614e22", "value": 563024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701225339, "uuid": "2223c1a6-a634-4c63-ab50-5f3eb6b6a704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701225339, "uuid": "29bf4c57-d420-4dcb-b23f-91cca6dc1028", "value": "047d6444c0614877f4d467d4a105cf09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66ea487-8e54-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701220578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220578, "uuid": "e89f5ed8-4299-474f-ad9b-05e077bf4bbf", "comment": "Malware payload (Tofsee)", "value": "bf884222d475c45abe8cd88d39b6f84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220578, "uuid": "f63c5b9e-fef2-483c-924a-291dac2a9f63", "comment": "Malware payload (Tofsee)", "value": "e0e24affaba5cb879452bd90e5689284b1eed33dd87dfe8ca145397b9d5bbb30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220578, "uuid": "bc10e72c-c591-4ce9-8da6-66c79b43ac92", "comment": "Malware payload (Tofsee)", "value": "3819e4744d82d9dc895c13bdeeabd6c13003fa69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220578, "uuid": "c32ff015-dd67-4423-b5d5-d638862d681d", "comment": "Malware payload (Tofsee)", "value": "5c780d9f4aed098a194017ac34a06ff3d027ef18a5b1e4756caaefaa18872f35c6001278940de1067e91b14ae43e2159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220578, "uuid": "d9fc99d1-7b5b-415a-9346-429de218ebb9", "value": "T1F854E64382E13D44E9269B729F3FD6EC770EF6918E097B6922199E1F04B11B2E263714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220578, "uuid": "b92ca1f0-c063-4e28-b960-a9f821557fae", "value": "4dbc83cc54bc51fb114f9cf586b5210c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220578, "uuid": "80fa1116-99b2-4680-8374-d2a274a05deb", "value": "3072:2CxBPmvf4gRns9F1xleC9bynC/Q65W0oBQ5LlxG:txmnL8F1+C9WnCyFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701220578, "uuid": "39f2f7c5-9a36-4368-9539-731b58bc27fc", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701220578, "uuid": "b85a4baf-846f-4d76-8870-be68f334b69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220578, "uuid": "22d7b4c8-0d3a-4312-93fa-6dd572f60325", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d0c077-8ec3-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701267934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267934, "uuid": "415fad31-892d-4270-b19a-b1ff27fe0fc4", "comment": "Malware payload (RiseProStealer)", "value": "42971155e95ad8ace7b6fc53d70fb952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267934, "uuid": "065debb7-ae6e-46af-876d-c356076ce395", "comment": "Malware payload (RiseProStealer)", "value": "e11d599fd72ad8e339c517202d97986b1c07af6444e1b4a0c7d89b7bbda937a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267934, "uuid": "51f55ed9-3f62-4fb0-93f4-61ee3e0bb66a", "comment": "Malware payload (RiseProStealer)", "value": "ce4b54b604f7bbae2524bf53fef92c2f60f82656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701267934, "uuid": "1ec06b04-ec62-44e4-8235-8b1a4704f6a9", "comment": "Malware payload (RiseProStealer)", "value": "3af07565a32c9b0744d1215b25571c7da890f7e6679576b633816463b7b2b6a2cf6a6c3d087c0357e7b3faad24b2fea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267934, "uuid": "df8b7a8c-05b2-446c-9498-65f777ddec16", "value": "T176B5335BEAE85435F8B1133014F2239369383C52AE94427B8391D85B59B3FA19D373AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267934, "uuid": "549c3cf9-3371-4c44-bd08-0f1e3cb79ee0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267934, "uuid": "0529549b-060f-4051-beee-c416cb9f615b", "value": "49152:icjGiCymFeMBTyRF2dEKsLkGrRsIKoeu8iKEZU+ToWdHK+jUdIGKuYzKZ:fjGi4EYVdyzuowSZjTo+HrLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701267934, "uuid": "aaec7bc7-a691-46a2-91ce-34994bcf918e", "value": 2365440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701267934, "uuid": "89341dc6-87cc-471a-bc91-1efb910e9c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701267934, "uuid": "eebd1a66-59b5-4669-976c-3783cc48ff07", "value": "42971155e95ad8ace7b6fc53d70fb952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2403fd-8e74-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701234035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234035, "uuid": "97d26eb2-faf3-4e2e-889d-bdd15621a074", "comment": "Malware payload (LummaStealer)", "value": "0fcb09278c158af2630ec64c48138435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234035, "uuid": "40f24f64-8ce6-47a3-ad54-293a6fcbf10b", "comment": "Malware payload (LummaStealer)", "value": "e139bab1158bae57794e4756a5bc57309eefe48034e9583675be5881aef278f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234035, "uuid": "179756e7-7970-4cc6-a626-dcc7298e2bbb", "comment": "Malware payload (LummaStealer)", "value": "8d23f2d3eaa827fdd53a822f8e39537a7409fa28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234035, "uuid": "b8b1d4c6-88bb-4473-b4cd-f340adc3b083", "comment": "Malware payload (LummaStealer)", "value": "7ae18d36b7ffe29a1e3a31faf6802565b32e553395068f53216c2a27f6c75f57dba2ec25851441524167788233b9e966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234035, "uuid": "23bf4e67-badc-4bb5-922d-dac3c8e2a7e1", "value": "T14103D08344796A18CA15BE36011188E2F6D5B394F6582101F7CC9CFBBF2E784E75BA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234035, "uuid": "7e56e62a-60be-4b6b-a0ab-6dab1d2c6dd9", "value": "768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701234035, "uuid": "2f799d67-4a7e-4f7b-8439-8e42c1bf3022", "value": 38576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701234035, "uuid": "fc6712ce-6746-4768-9bae-8992fea03584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234035, "uuid": "63b8854e-e3f5-4ae0-968c-4194256958cf", "value": "0fcb09278c158af2630ec64c48138435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2366defc-8eb9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701263630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263630, "uuid": "89faf671-3cc5-4158-a844-51c076284e34", "comment": "Malware payload (Formbook)", "value": "45028195744e486c75b5e3dce5c00f71", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263630, "uuid": "5401614f-3efd-459c-8083-282c42161d59", "comment": "Malware payload (Formbook)", "value": "e140044671da577de0aa3fe0733611d1ae8b20cd2859a1c462c995d3a58dd4b7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263630, "uuid": "58c46a4b-2af2-42b6-b446-746970b4ce13", "comment": "Malware payload (Formbook)", "value": "0f753f165c21edefda6bafcddc71c958df9e70b9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263630, "uuid": "09da94ea-99bb-42c5-8b0f-af8db3c885a6", "comment": "Malware payload (Formbook)", "value": "d72d3ede0c49cafcd37b44cbe79bac13514072f2805acba0291f68e72240673eb5bd116d38e11ddf1a1f9dc704dc0d12", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263630, "uuid": "24c24c95-2b8d-4d03-9da3-8bc75cc74e91", "value": "T116D4235F989BE78B2339D80D600D5B09A4F688F9E663213C529843F8C7C7A8359F7265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263630, "uuid": "9fb37f2c-02fb-4380-a03b-fc4243ac1ec2", "value": "12288:tia0XRaPevDoI6ilc5suhmIcHyIA+GV17HL/l1WRsZOSJNgP0P4EJ:kjham/esuhmIcS+GX7HL/l5Z/gsPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701263630, "uuid": "6fd62545-a640-49b3-8c0c-0c7fbcd3c5de", "value": 629957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701263630, "uuid": "3d0de897-b81b-4fb9-b419-578c4a1bfd3c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263630, "uuid": "e6bc0426-be90-48ef-9496-cbd8a2aab168", "value": "Revised invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80dc3e7-8e92-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701247237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247237, "uuid": "85d2adfc-fdba-4f8b-8868-21637f334385", "comment": "Malware payload (Formbook)", "value": "658481823dd17da112545a451c301314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247237, "uuid": "e588bcf1-8ae1-4ea5-a1eb-2fd31cecf589", "comment": "Malware payload (Formbook)", "value": "e1ce6041d3b57827447bc59e6bf6ba9ab43b41763b351740bc1dbd851d747d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247237, "uuid": "4a37a653-237e-4d3a-870c-5fc97cbbba16", "comment": "Malware payload (Formbook)", "value": "6016802e6e737fcbfe5d9c750de90cebbb3ca23b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701247237, "uuid": "e6c24941-7232-459a-80e0-9b1569f6a777", "comment": "Malware payload (Formbook)", "value": "95c0f808b63088b6b0ba0ac8095e5a342ceb4231f4371d9ee342e153887afaff38c8550692fb4b780ce91eee55e4f325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247237, "uuid": "9ff5f431-fd51-431d-92e6-33189f3007b6", "value": "T186953317C5DD8122DEB03FB098F653930A32BC90BAB492AB1756694C5C63E94BD3173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247237, "uuid": "ecfa3b29-be5a-44cb-a3b2-bf0e1a442d1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247237, "uuid": "ad877123-aa77-493a-8cd1-d493d91ec22e", "value": "49152:EizEQDDqK/JimVeYTQsjTv4fMsrFQMn5USdnCBg5+PA:DQcDqK/AYAXFQg5UInCgcPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701247237, "uuid": "cc01aa58-58a7-4cdf-a02f-8a6e93c90c72", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701247237, "uuid": "4ff55e9d-b0da-4750-978a-fe812bc5472f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701247237, "uuid": "d712892b-1f00-43ee-afa0-ff15e561ab47", "value": "658481823dd17da112545a451c301314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b4fcfa-8e5c-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701224018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224018, "uuid": "f47a8fc8-0861-4512-b07b-91f7945ff2ef", "comment": "Malware payload (RiseProStealer)", "value": "5295f955d178a370fdf3bf2b5da6adcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224018, "uuid": "053594c0-7e2c-491d-9442-d677087aa448", "comment": "Malware payload (RiseProStealer)", "value": "e236f9d4ec05936292916f84b4a0948191c642ba02e4199af6b939afe90c3457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224018, "uuid": "d5083e15-0714-42e3-8084-8315dd4c2b9f", "comment": "Malware payload (RiseProStealer)", "value": "a011d0a5a5ebadf29026bc28a761b73e87ecd516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224018, "uuid": "b1b471d1-5cc4-46a0-a2c3-d6e09d6aba5c", "comment": "Malware payload (RiseProStealer)", "value": "f909b5fd102e03268091b72b48f2818728b15598a856f8567b0e45e0ed73dfca7efa69e8dec152c094672ca23542a06a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224018, "uuid": "1a693dcb-94f8-4c05-9000-7cd71ba72e79", "value": "T1B0658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224018, "uuid": "fc5a6f12-0253-40bd-9505-82810217fe4c", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224018, "uuid": "12c064bc-7605-42cd-a532-a26e4d4b6138", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WtI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701224018, "uuid": "41247c17-468a-4901-9c3f-f02de2822464", "value": 1539910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701224018, "uuid": "ff6b1b76-544f-4bbe-afd2-5d592ea5e8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224018, "uuid": "b075def7-11f3-40da-929b-0fb80032543f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99624388-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701283156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283156, "uuid": "085d9a62-ed61-4f02-80ea-3519980fd671", "comment": "Malware payload (Mirai)", "value": "811993c01409dc16400e68131f36e616", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283156, "uuid": "4e3219df-f975-4733-99e4-c349c2e52236", "comment": "Malware payload (Mirai)", "value": "e50305e60880d40e604076b4adeebde52a4dcbe9ecd1247409e0450926115469", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283156, "uuid": "ff089269-8a78-4c0f-867b-73d7e478f07f", "comment": "Malware payload (Mirai)", "value": "0fe299558fb0abef9d9f47b60a3e0890fb8f102a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283156, "uuid": "4b99ca94-20a6-4be1-b04d-77cde3aa1c5c", "comment": "Malware payload (Mirai)", "value": "b70cc5890b8c1752836475e1e5d387a58462790e84cffc91d31061cf2b09f42be3a407bb16b7c42f5f25692ca6475c78", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283156, "uuid": "7ef65da8-27ca-435a-8fa1-a23492ed78c7", "value": "T11804885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283156, "uuid": "fe52d4e5-68d0-445b-8361-fcfe8d395361", "value": "1536:Cl2JvnXPvL0QuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zHt/Y:Cgv/KcwZsCK9VRhAX+bShFSP0HbbHlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283156, "uuid": "c259ec42-1dc5-49ec-bc71-0a7451c59cd9", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283156, "uuid": "668bf873-a60b-46c1-a177-d67569328187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283156, "uuid": "66867edc-af04-4d62-b3bd-fe3b1bd91404", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee25335-8e84-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701241235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701241235, "uuid": "157efcbe-33d9-4a48-b207-1c48ea095ee3", "comment": "Malware payload (RedLineStealer)", "value": "24d166fd88321d035acc915700693601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701241235, "uuid": "2450bc4b-ce41-4fa5-8ef7-047d236c26f8", "comment": "Malware payload (RedLineStealer)", "value": "e72b8d48554951d7c19ac727e4718ed0f7e72e095f47cfc9cf8669dc6dcff3ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701241235, "uuid": "21381cac-5a2b-41d2-a036-8b6cd3e3144e", "comment": "Malware payload (RedLineStealer)", "value": "86f75c438ad4c345fc627315644d0f0b9fa5ae8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701241235, "uuid": "0cc726b1-19aa-4389-9ebc-59f7e628842b", "comment": "Malware payload (RedLineStealer)", "value": "8d4cfd8c759256ec6f2f8dfd7cd1cc6bc356314d241115615665a33c9d2171e82cf646710473fd4c294e75a45c7ca70a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701241235, "uuid": "37b92f63-6f79-4a90-a301-311ca76b1a94", "value": "T11835230BAAE4A173D8F527B408F703970B35BCA2953C934BB746595A1CB30D4A235B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701241235, "uuid": "bcc65180-6b89-4cd3-9e6c-11ffab4bea57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701241235, "uuid": "316c35f7-06aa-4933-9f14-a77c5c8958be", "value": "24576:lyWTEnfxCVa7t0IkiUoVhcCo6OBo9+prxEgM/Z7KglOe6:AWCfxCVatTcj6+o9MrxPMx7VIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701241235, "uuid": "b008080c-2608-49f0-a8c4-c2200c31f013", "value": 1156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701241235, "uuid": "3d4c8375-40ab-4ec2-b760-7217e481d2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701241235, "uuid": "b88df681-af6f-4c96-aafd-55f5f2d360a1", "value": "24d166fd88321d035acc915700693601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5f8067-8ef6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701289870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289870, "uuid": "634fbcb7-bdb4-4404-a3de-5a7a4d1f848a", "comment": "Malware payload", "value": "d612294134cc6395779111675e7f4333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289870, "uuid": "f277f941-bc60-466c-9e3b-7681e091e0c5", "comment": "Malware payload", "value": "e7729036b9e69fd7dcf07e6ee0c8dd71a4b1432f55ab4e48572634de8d44b673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289870, "uuid": "d432748e-474e-44af-a3f8-8956b55d8527", "comment": "Malware payload", "value": "ced6438a7ef0674f1333d7fd8822ec9164b04881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701289870, "uuid": "07625c01-7259-4480-a44a-108a50aedf55", "comment": "Malware payload", "value": "b0cf439d01aa054c399cf5ce026b8d36d356489cc3ce9083aa19e4a173364f934643d91351ea20f51ae1d722784c7e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289870, "uuid": "22e0724d-6d6a-41f7-92ed-ffba890d6648", "value": "T1B335E01223E06BC3F07451A07B7814A3C9636B07B62DA5059A5D385FADFBEF0766B0C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289870, "uuid": "77c6e07c-8768-4de9-a215-3e4ea943c7c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289870, "uuid": "854ec5ff-057a-4b9e-96d6-543a3f80a710", "value": "24576:jP8WwW5NilGG01JVDXrMb6Y8U2gBLdNmP3WN7e7h2TGfpo:jP/wW5NqH0HVcbbV24dNUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701289870, "uuid": "82f8e9bb-6d5e-48f8-a163-c3bcb89f9c21", "value": 1084792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701289870, "uuid": "9244e671-458d-4c20-bc98-50fbe53811aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701289870, "uuid": "f3d3cc47-ebbf-488d-9627-2b8f55bc18bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291c85d4-8e5c-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701223697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701223697, "uuid": "721d615f-3b93-408e-a9c4-ca7a7c02698e", "comment": "Malware payload (Smoke Loader)", "value": "66375624a927b871398ca02ec4f7b9c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701223697, "uuid": "f7ef8f0b-4daa-404a-b954-92b7e27a0674", "comment": "Malware payload (Smoke Loader)", "value": "e805e010ed08270484c8107666d61b61256efa91f4756eec8f0208ab4f4d6ccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701223697, "uuid": "bb3002e9-0b08-499e-95ef-19a26cb4874e", "comment": "Malware payload (Smoke Loader)", "value": "14eed1cae43cf66d118e0349ca781330a5059f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701223697, "uuid": "ab9f6795-5216-4f42-aca5-ceb485e96e38", "comment": "Malware payload (Smoke Loader)", "value": "f1bbb8a23fbb470fc56b1636a72f193a15cb5f8e674a7fb92407b33620a2216a71531a196a6e1b89151430ff490b3e4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701223697, "uuid": "648f4e61-a6a2-4b8c-a974-7dc13181eff7", "value": "T19E54E65382E17D44F9268B729F2FD6EC7B0EF2918F493B6921189E5F04B11B2E263714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701223697, "uuid": "a2975fb7-d1a2-4620-9420-27c996a3cd6f", "value": "4dbc83cc54bc51fb114f9cf586b5210c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701223697, "uuid": "729ebea6-70a1-4862-8ad7-1d2daae423fb", "value": "3072:yRlgDTjk7/pS/ckxjX3Fg3r+pHvEk55+lgyQ5LlxG:uEOqcOI6MHl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701223697, "uuid": "5e647d53-82f9-42e3-80b0-eb03cf0adad8", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701223697, "uuid": "c956c1a5-6ecb-47cc-8bf0-a17c8d72a2d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701223697, "uuid": "560e076a-e924-4e82-98e5-06c82b263fc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7c1b6e-8e75-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701234629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234629, "uuid": "150de5df-5510-4cb1-9111-df18ffb1c5cf", "comment": "Malware payload (RiseProStealer)", "value": "f8fd813aee86b05376577fcc88d2e02d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234629, "uuid": "56837d3e-b312-47b8-bc2a-8941eca922f8", "comment": "Malware payload (RiseProStealer)", "value": "e821aecbe1ff17494e6390117f8f8b5ddfe9d811a1c78e07edf831d652f247f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234629, "uuid": "f0c7947f-7c7a-4c9b-b05e-876825632183", "comment": "Malware payload (RiseProStealer)", "value": "72a986ca688c6b0dd40788649f512b4a3a443360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701234629, "uuid": "5060dc75-5269-4531-8d6e-9b9490f71e55", "comment": "Malware payload (RiseProStealer)", "value": "216b796757303906fd10305b26ccddd52898bba5e84c4c23b11e51907f6131f9d6bb8125efdf5af7aa7d6eb6d0f52a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234629, "uuid": "139a68b8-4b12-4f0f-93e3-01266534344d", "value": "T11C953312569E406AFA713F7809F917A3063A7CD08BA01767B31AD91D1873791A9F332F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234629, "uuid": "b8df6c56-1e5d-4490-9724-f4032e45e2f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234629, "uuid": "3ee6ef22-7142-402b-84cc-f7ca8c191af4", "value": "49152:ikSo9RlVesowRh4838ZLoU8e5vDjTLcZfRBOK+vnsrLgGm1r:zSoBVqwRhPsLn0fRolvnUgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701234629, "uuid": "699b9239-ab0b-42e9-bd29-3f1db8db2183", "value": 2024960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701234629, "uuid": "23e62689-3a13-43d3-a201-0b60eaa99a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701234629, "uuid": "14621f84-5296-43a4-a326-e923144d575b", "value": "f8fd813aee86b05376577fcc88d2e02d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77358c29-8e55-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701220821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220821, "uuid": "1e38935a-3891-43ad-ab51-7d6d3921d14d", "comment": "Malware payload (RedLineStealer)", "value": "0d549c3b2dec6c12d9cc2f2e13b926b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220821, "uuid": "827fb77e-9941-4c8e-a657-83f3077b69d3", "comment": "Malware payload (RedLineStealer)", "value": "eaa6d13d610e89b2fdedafd985d58abac85a3193c0701ded97c3c77e2a401da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220821, "uuid": "db8b71fb-ab7a-46c6-87b5-92e5dcde8c9f", "comment": "Malware payload (RedLineStealer)", "value": "1718b8cba593cff40338cd46a640b2024f033750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701220821, "uuid": "7358c4a0-de28-48f7-bf54-7e57f4705157", "comment": "Malware payload (RedLineStealer)", "value": "9b388abd7002e6f7398a43b52e33421796e70b44e56fa323833a81dd301fab8edbd67e1b8a47a5ddd033fae193d44bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220821, "uuid": "39eb61ae-9015-403a-8c3c-00c718679ea4", "value": "T105547C0676D2C4B3C523123209E8C7B96E3EB9510F5189EFA7A44F7E8EB17C09E31569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220821, "uuid": "cb9a6f06-123a-42bc-84fe-a42474b0c9b4", "value": "87d552636d31eb7a2797c4a63e862d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220821, "uuid": "9c1127d5-8499-4e81-9443-83b2fe4475c5", "value": "6144:+yU1zKCKVDp3Cbitu7gJzmgkYUDBg8ZHAOa8DxL366G:+yU1K9pv6RZHBDR66G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701220821, "uuid": "b6b652a4-99f5-4166-b6f2-e24ce90cf2ab", "value": 292128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701220821, "uuid": "da4c9cda-de45-4aa7-b24e-2ad717fd3bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701220821, "uuid": "875c298b-307c-46ad-892b-00f1fa256100", "value": "0d549c3b2dec6c12d9cc2f2e13b926b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de34a9d-8f01-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701294679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294679, "uuid": "ae969080-d9d5-40e6-8db9-481eb3f7a91d", "comment": "Malware payload (AgentTesla)", "value": "50fcb0b381ff9bbef33e90561ca1d324", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294679, "uuid": "2434d292-a15c-4426-8656-e623a93ef0fc", "comment": "Malware payload (AgentTesla)", "value": "eb0c9f7ff7106033740df49533023ab8c93304ec66c76496dde0aab528a7472a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294679, "uuid": "c6dbe53b-e98b-4d99-9eae-1bbc5a1f2892", "comment": "Malware payload (AgentTesla)", "value": "eb9d093de06bacc8204058ba9ed7c77f2194560c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701294679, "uuid": "a58c2a38-3d13-450f-850b-a137da620126", "comment": "Malware payload (AgentTesla)", "value": "a6ab3c24a4ab996e958b35ff1671fa994a3a5ea4e714625ac67918569821d6435f5eb24d9a4f69693741ded7629db43c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294679, "uuid": "66b1bb2d-5c12-43ac-8c7e-a8658bb8fa6b", "value": "T1DD3501442268DB02D7FA7BF60FA1D43103B12C9D5820E2656DF26EDF36EDB434A45A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294679, "uuid": "ab0c0bc6-405f-4558-bb5c-1a9eafacb20c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294679, "uuid": "1c8e9d69-a2c6-4121-b702-9de7295edd0b", "value": "24576:6yBN2mseCYCHXDm/jvyzRT5Fl2ue8+KkewDyTnUdVXR:6ybsNYCHTm+t1r+QmyTn+VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701294679, "uuid": "13fee22f-022d-41ae-9cbe-85b8bf3618c3", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701294679, "uuid": "66cf967a-5a6a-4ce4-8cbe-35db77531d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701294679, "uuid": "ccb01eab-6103-4106-ad28-5f87af1b57d7", "value": "003035044445.AWB.PRG.CHO.M20.20231124.003622.20231124.004549.10532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d962d1a0-8e82-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1701240313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240313, "uuid": "ebf7890f-ec82-434a-af40-e4a461405786", "comment": "Malware payload (CoinMiner)", "value": "d02c98b4b3c62b5933d78e0e587718d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240313, "uuid": "35d90a5a-0785-4a80-a503-35d6d9e6f156", "comment": "Malware payload (CoinMiner)", "value": "ebd83827518516b73d7d02933c5a17e2afb3db4439669a570d1dfd4b47218128", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240313, "uuid": "cb6a194c-c011-428a-a70a-36e0512f3bc0", "comment": "Malware payload (CoinMiner)", "value": "404665657dc6a6999f70983a60ecc74fbfb2b9f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240313, "uuid": "06166539-5e0c-48f9-a2b3-992735498a9d", "comment": "Malware payload (CoinMiner)", "value": "d572da8f7a2dc6410b8e77696d76a9fb128a1283a7e9cc8b88f9602fe3541012e3569026f9bcde9dfb8a25a1206f27ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240313, "uuid": "2a62fef0-d6d3-4043-862b-10dc92ab11a9", "value": "T1B3546C1366E96821E5274A33FE2EC6E8675EF9518F152B9B33186F2F49711E1C272303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240313, "uuid": "7b135890-2b83-4ae7-b1b9-70beee311b54", "value": "99e733edb40d39f08a07658473c3f554", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240313, "uuid": "83284255-cb64-4804-9a52-c9e1b3da7372", "value": "3072:q9Qq0/wMiqR+vlxLIm4pn4pWOlYk7QgqOqnjPugvpQi3yOC2XsMV:pqiiNdRIm4pcxxqj1v6TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701240313, "uuid": "2a426abc-9599-48c8-86e4-1cf25ee91b83", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701240313, "uuid": "69397f03-efa3-4768-924a-0ec1b8a7d690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240313, "uuid": "a7570a70-86e5-49bb-882f-9eb787c356b0", "value": "d02c98b4b3c62b5933d78e0e587718d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd7531f-8ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701272157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272157, "uuid": "2b9eca72-4187-4221-bcc1-b50bd2d47de4", "comment": "Malware payload (Stealc)", "value": "e0242f3d9e9a6d65db7ebf060beb4fa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272157, "uuid": "6880b383-a44e-4a7f-b095-18ed5144e478", "comment": "Malware payload (Stealc)", "value": "ec8023c54a870806d4ba36d1dd4635fd69d3f7b0dd72c75d41b6c93b19a34b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272157, "uuid": "8b1b9fa1-4d4d-484b-bcd4-d0195d2cb8ed", "comment": "Malware payload (Stealc)", "value": "d76de2eda99ce86e605cce140ed61a1c94549648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701272157, "uuid": "d9395e47-b41e-42e5-9cf5-4fa86c9fc8de", "comment": "Malware payload (Stealc)", "value": "3374ddb5ebc40a2f4ca4d02208d8d4767dfd93e92d8e4b4b44f644f41d5e81df29f5100cd1c14c812fabf13489d0580c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272157, "uuid": "77234ac2-4183-49aa-bf95-ee6892f084d1", "value": "T1F5546C12A2E56861E5234A33FE1AC6F8675EF9509F156B9B33586F2F49702E1C273303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272157, "uuid": "9444bb72-2449-43a2-af87-20ed9d6d1347", "value": "df618219e8a2366147b60cb4a381a402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272157, "uuid": "d39ce50b-4336-444b-b12d-9bb31f6cbfa6", "value": "3072:YKsSo+7xyZJKZKq454/xukTMCbSRIIvMLzS2Ji8mgViZNqmE9pIeHYqyFLk742sU:YLSjyekT54/xNMCQE9mg7jI6y274bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701272157, "uuid": "33623291-a71f-4bae-8075-988e1080e8b5", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701272157, "uuid": "ff6c2442-1e6d-40f5-a104-d57f4694b068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701272157, "uuid": "3b304d45-eaa4-40e8-b95e-b887224407f1", "value": "e0242f3d9e9a6d65db7ebf060beb4fa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae499d3-8ef0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701287561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287561, "uuid": "581439f9-823e-431b-8f9f-6bdefc58e1d3", "comment": "Malware payload", "value": "aadaf3f1711c96b0707f970a03e3ccb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287561, "uuid": "a5e00f72-61a8-4a02-b1e8-2e0196ea4554", "comment": "Malware payload", "value": "ecef2bdd7882f6d92488bcee21e5b9348015b70d6f5e8da86b072b1f09727f54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287561, "uuid": "83300ca4-18e8-4859-9d18-bfc64e9876ad", "comment": "Malware payload", "value": "cd03612c81128db6eacbac90159692cb9b2afcdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287561, "uuid": "e0365422-4278-43b7-968b-1ca92f52bad5", "comment": "Malware payload", "value": "723910f90e0558f476c9749a668e0daae5ec23c05c436c0d68e25486b09c1821397274b659868416cda83b09f15cbc84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287561, "uuid": "9dbb7ada-9680-48ec-804d-59e5a5196890", "value": "T189945B99F0E15BB5D5E122330AD3CB6D862C2477AB7287DF4A91025ECF2B3066B315C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287561, "uuid": "7fd63cef-7129-40d6-bf37-3da2a86b173b", "value": "becb59d6c2cabee1a77fe54131d4eacf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287561, "uuid": "f1d57a77-c1be-43a7-abed-b5fa195f1a07", "value": "6144:Pn03zFVHcinxvGLMBCnEAO09EcAuql96D6b349eFFqbI70PA0jC/pE:83xV863ui9rbo9eFFrjr/pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701287561, "uuid": "e49ce572-3197-4dee-a8b9-c5f612773fce", "value": 411424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701287561, "uuid": "97fa37f9-8f77-4c9c-87ff-b20fdb039e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287561, "uuid": "c56ad791-3758-4fc7-b73e-13ee35d92685", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d612a8-8e96-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701248919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248919, "uuid": "5413f03f-7d91-42bd-8254-261e1e8847ea", "comment": "Malware payload (Formbook)", "value": "a66c46f216994a7cab9c9845c88337ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248919, "uuid": "30dd3b60-24fd-4fc3-a698-a7f10f7d89bc", "comment": "Malware payload (Formbook)", "value": "ecf35cb255906b46d905041e57f46c21bafb77e4cf7189107bb5977867327a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248919, "uuid": "6bee3a18-a69f-40e6-9e94-c2d25669f4dc", "comment": "Malware payload (Formbook)", "value": "42ab2947b12ed098268bbc56106d60ac8c847653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248919, "uuid": "9165f174-ed94-47ce-bcde-cb9a8fd70c97", "comment": "Malware payload (Formbook)", "value": "d047a938818baac934a24864932a28202b5d352bed65b97500130d6810722677507a3947127843875bc2860b55c0bdd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248919, "uuid": "f840037b-1547-488e-8dc7-ab52d8eafa8d", "value": "T11E84220AB2EA44D7EC57657242279B78D3B3489E92B1F34B13C96F3512822D3DA5C393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248919, "uuid": "be2a1e4a-13d3-46d0-a02a-464738ae9658", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248919, "uuid": "818027a3-c804-4e32-aa20-6570af6dc333", "value": "6144:6BlL/kpWbOJiiQsb3HbnZns7VEr/CgSCJvMm7Q/f2UHnMBk1i98YjP+pP:A2XJidsb3TZns7OrkCMmEfHMBk1i64+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701248919, "uuid": "56aaf74c-b6bb-4761-a8c4-7eb599fb3779", "value": 375407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701248919, "uuid": "fdb4390b-7206-427e-82d5-4c679ad143c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248919, "uuid": "ad2572ff-baf1-4ce9-b0e5-341c80b83215", "value": "Control Valves.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f288f9-8e8b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701243990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243990, "uuid": "9964ff3f-8ff6-4ba1-93ac-33f862a395cf", "comment": "Malware payload", "value": "c9da65c5b4716c7b1a6f4595b84b9147", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243990, "uuid": "9b3af77e-3987-4ef2-8004-854ed8c8c1ee", "comment": "Malware payload", "value": "ed224ae5b85e6ab2ed2abaef6723142b6d142b958dc623500048e312a9de7d04", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243990, "uuid": "5c8bbde2-edf3-4ca4-aa58-2a84f9dd5c6c", "comment": "Malware payload", "value": "4c3931478e23a610af57cd2e47615919113ae288", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701243990, "uuid": "4882c26d-916e-4c36-b2f8-421bd96c1349", "comment": "Malware payload", "value": "1c22d0a1c2c595812f6e7b58494eedfc9e1c99a4969f5c79fc626f33dfc97bada82dd5cbaef1c1a69c0101e197290155", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243990, "uuid": "9300817e-2bfa-47ed-9200-28b7fe065060", "value": "T1D5218495C784E923FF1C282C2D82CCC1DACE6146556ADC075889C2060A2BC4B5F86CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243990, "uuid": "0a55c545-9820-4117-8bc6-a98e9ee76212", "value": "24:5dhchsuhzRtWdN5/wbsQIE13rd3d9jZRQdlhv0Pd7vhIAhRm:5dhes/dN5/c53d9gdlhv0Pdbh5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701243990, "uuid": "93362a7e-2316-434c-8f28-b229b24fd47b", "value": 1244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701243990, "uuid": "22ee64e8-854a-421a-9c6c-21117e5936b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701243990, "uuid": "1e97c090-7ddf-4aa3-8322-02c84bfb6436", "value": "6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148ee747-8e98-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701249432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249432, "uuid": "eb1a5695-60aa-4867-adf0-650ad6719065", "comment": "Malware payload (AgentTesla)", "value": "e0fe9073bce397e9ef1f7754d7dfe4ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249432, "uuid": "9782643f-f42c-4a99-b5c9-8a733adfec5a", "comment": "Malware payload (AgentTesla)", "value": "ed3b9198a931bf13b81f4a92d8122edf074519e72310365c2fc4f7d9f3bbd9a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249432, "uuid": "9f419d87-1932-4e91-a8c9-fb9233fcd484", "comment": "Malware payload (AgentTesla)", "value": "2bba40b64d9c9e2f072b2ac3d642b657b7c3a38d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701249432, "uuid": "b683875b-24f5-4266-90fc-f1bcca2201f0", "comment": "Malware payload (AgentTesla)", "value": "e08b5a7f91a40519b15b8ccd0011990dbad84abe7155ad939992baf917e3c1a1ad1e2cbbafa60bf2c05572ff0ace0a0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249432, "uuid": "a6e46859-85ad-4b73-9fe5-4c19f8efb267", "value": "T149F4E02436BE2F23E07A57F9046215200BF979AE103EF2D85CD271CB25A4F645B89F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249432, "uuid": "7c731506-f2df-47d1-8873-0eb37bd41f74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249432, "uuid": "571caf0c-468c-42ba-8aa7-88b165d95d7c", "value": "12288:0eWSQmbCpdLAXdTAkl5e2K6317H6PKGCow6jBV8UfDGeFbFgtMis7zDAx:JNT3ls2K219GCc/ZFJQs7zMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701249432, "uuid": "94e1fde2-e3a9-418e-8d1c-750a979f8a21", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701249432, "uuid": "282dd834-34b1-46ec-ae2e-911fcc083caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701249432, "uuid": "6bf4bb8a-59f3-4c42-ad03-e653107c85e7", "value": "AMZ401722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2822a7a4-8e5d-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701224125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224125, "uuid": "f48ab32f-5419-4f0a-bfa8-66c913ac0853", "comment": "Malware payload (RiseProStealer)", "value": "0a3f3de5c4a31c44999d85d161e6cc63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224125, "uuid": "acad0cb3-cd02-49b7-b818-9bd6f06db36b", "comment": "Malware payload (RiseProStealer)", "value": "efd7aa7d7abc3cfc31ab83c5086b82da3253fa4a477956825e73d64d8386586f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224125, "uuid": "c37c96f1-e39a-442c-91cb-fb5fde8c3302", "comment": "Malware payload (RiseProStealer)", "value": "4c2e56263221e02c27b55682f91aa8c8acca6ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701224125, "uuid": "e41c9163-fef1-4d73-bad4-5b7243b35e2d", "comment": "Malware payload (RiseProStealer)", "value": "e41e7d1a5d53fc32d3c154abfb37dc3d021fe68df8c4ea8fc1ee97407a0d89b274b65abf3f6a6274ae98043f892bb873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224125, "uuid": "e5de7b3c-92b3-4a89-89db-a7a510f6cd1a", "value": "T1ED752342E6E8A423CAF677B10CF6474B0F3D7CE15968871B2A0B9A4749F35D4A43172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224125, "uuid": "594b05c3-3783-488f-bae3-595efa3096a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224125, "uuid": "d5705b0d-04de-48ff-819f-85234daf12de", "value": "24576:TyLF0V62HediU48Cvwd6Oin7JfgJgLP/pHYJkfHlG5R3hAliYXM:mLF0V62Hx1va6PJogz/NfHlG5R3hAEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701224125, "uuid": "a08696f3-d8ba-406c-a9ac-4544f3cce9f7", "value": 1646080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701224125, "uuid": "56238955-752e-4978-a697-60c77749c757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701224125, "uuid": "6ca5f46c-195f-4665-9ec9-e74e3100e759", "value": "0a3f3de5c4a31c44999d85d161e6cc63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeede2b3-8e4b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701216620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701216620, "uuid": "afaf754c-796b-458e-a5d6-168f7002e109", "comment": "Malware payload (RedLineStealer)", "value": "5b7f4792e7092190ac2d0fc2c4aafde7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701216620, "uuid": "49e24745-a935-4881-b920-e2b40b81eabc", "comment": "Malware payload (RedLineStealer)", "value": "f09ccf0fbb63f17669b32ca8cda1140ec02798acb94d5630d9ea829ce10811a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701216620, "uuid": "e58ba390-1c01-4788-9052-f7095e9a3122", "comment": "Malware payload (RedLineStealer)", "value": "97799113c081bf4bc329428cffa9b3cc0e5c5e1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701216620, "uuid": "ca8ef592-61d9-478b-a8b0-a353403ff8fa", "comment": "Malware payload (RedLineStealer)", "value": "bebf99458b0396e20c3579c94fec9672fce0c16e9eaae1a3974e819477b20ea99a676482c53a38cb0611b7294b33e64d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701216620, "uuid": "ee86ac8e-cb77-48bc-884a-66c79ffdd7c8", "value": "T19095230673EDC0B2D5B03B7444B347D70735BCE0A6B1A36AA759AA664D622D0F4B2337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701216620, "uuid": "cd357b1e-6473-4196-a582-f3867683f3ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701216620, "uuid": "4657122b-cd6f-4424-b029-643fa95126fc", "value": "49152:2oj3uPssw+YS5yE8Y0vFKO6EZueEvJ+tJTPWx5AHJcfVHirR:9j32ssMIyE8FgR+PTPWxOcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701216620, "uuid": "de3f80d0-3ec9-401f-b01c-4f9e263d8814", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701216620, "uuid": "6e953f17-e014-41a4-adbc-c0b7b4dde0e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701216620, "uuid": "707218c4-7508-48bf-8d57-ea651f250b2f", "value": "5b7f4792e7092190ac2d0fc2c4aafde7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ee75ae-8e8e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701245438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245438, "uuid": "3344cc53-1329-40a0-a5a2-c5bfaffb78e4", "comment": "Malware payload", "value": "bf7b95fff1de2c87771c2dc7a564932e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245438, "uuid": "0f71aa0b-9c4f-4e7f-88e9-b831c1a003c5", "comment": "Malware payload", "value": "f0eb1b0d56c93008307de0e34f9b4d2c970feeaf3664032a7323b6717b934e66", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245438, "uuid": "aeb7c3e2-bddb-4c3a-9ea8-5a375e364978", "comment": "Malware payload", "value": "7e81ba519cf5c1451d8ba3f1b07e6fec66d74da8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701245438, "uuid": "b1d0ec0b-c986-47ba-9d6b-01055d0180c0", "comment": "Malware payload", "value": "659bb88c09fb86da6c0443d5535154ae947934392062f95cc6e8f5eaf1e3bee7e91f7f545c57e3b7ea37c887a3add159", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PayPal", "colour": "#774CFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245438, "uuid": "01ae1c21-4f64-48af-8b08-8a01b9e56d8e", "value": "T149A1950535D13C495B934FBA79A23EEAF64D8EF727A08407C110D285389462ADECF873", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245438, "uuid": "5acc9f2d-bdc8-4784-a901-c3b2d9a4771a", "value": "96:mD8TsmAamAlvt9FrAT3Qjy9XcHELWjVV8lsStFPfW7c:mD3mAQllrrAT3QjyNcaW8lTFPfW7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701245438, "uuid": "e0b128fb-aa1e-49e3-a955-c70fcbcb3c77", "value": 4644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701245438, "uuid": "36fd59e5-a2a5-42c7-a380-39666b116f85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701245438, "uuid": "5dec1db9-ba71-442b-91df-330d1f5a6878", "value": "pagamento_30.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a3a36d-8eb9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701263790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263790, "uuid": "4ab08c6f-0a01-4962-8ef0-d4f6f4274249", "comment": "Malware payload", "value": "62170ecd13f1c3dead7c2703933776e2", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263790, "uuid": "4df1b4f3-b86c-4bfc-a6c2-5254cf63d6bd", "comment": "Malware payload", "value": "f12a9220246114b76d86519b74bfb90ae0974f8479457f318914128ce3df4290", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263790, "uuid": "6930a8cb-9cb4-4c28-903c-2033b4e20b20", "comment": "Malware payload", "value": "14d0a080316e5dda491fc0dda50dc17cdda23610", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701263790, "uuid": "0951396f-97be-43f9-90c3-e8c09ba992a2", "comment": "Malware payload", "value": "965a42437ed2a0d05607a6e6865b99896643d432bdd6bfa37475b0525a68dacbe05af98cfe20bb3674476506acbfc13d", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263790, "uuid": "4037e011-9941-40c4-8392-b52828ce1b83", "value": "T11B653365DA76483325C100D2EC7E37609CB173EA1F4B5A7B38A46219606CFD99C8B3ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263790, "uuid": "1c5d65b1-519c-4a68-b069-3666d899be12", "value": "24576:d1gdQirjgT+urpfmeue22hy/joPOgNljoctDGx5qsy8Eim9LaIJf/gvvEHskeWoX:odQtT+Oc9ehy/juOgHjoSDGx5qSILhwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701263790, "uuid": "e6d0f25b-5e5a-4529-967c-cf5f8fb13fc7", "value": 1539636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701263790, "uuid": "6cf6a61e-cd5d-40a6-83b9-1a6083e2ca10", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701263790, "uuid": "9224d8c2-632d-4e5e-8964-4fae7d4c176d", "value": "PO112301-Quotation-november order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dab60a-8e96-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701248948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248948, "uuid": "b29cbee3-11db-4e4e-a2b9-1458bf6bdc85", "comment": "Malware payload (Formbook)", "value": "03d4c1d51e8ad21440dcccf080d5e90f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248948, "uuid": "df7ed734-c8b0-4f66-8058-1b9e33ff6289", "comment": "Malware payload (Formbook)", "value": "f359f98374348f2c033d01bcbfd67b97230a9579d6a9776d43235fc55213d8cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248948, "uuid": "b1cc97a1-f8ef-4c15-bfad-caef8e769692", "comment": "Malware payload (Formbook)", "value": "1b2ac8932784efaedb3ec8e38cc03330eb389534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701248948, "uuid": "24916fbd-bb31-4ab9-a16a-810a80057108", "comment": "Malware payload (Formbook)", "value": "c60ac882cc5f0cd4ec92694b51a73cf821ecfa33fdbba2f38ce54bf290f23dee61db77a9b05c4b6be90b88e8d8ccab14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248948, "uuid": "bb060fdc-796d-4812-bd64-cac8aad6d8e2", "value": "T1F97412CA0FF10AC3D8D18A314439E3A49E35AC6BA81956976B50F9171DB32C75C633AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248948, "uuid": "92853975-1988-469f-bae6-71f65ac73365", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248948, "uuid": "f624ab68-edde-47b7-82fa-a8d9d45dcc52", "value": "6144:3BlL/s/rlBbpWkLOxOfKo0QJpjlIdpaH9n/veD218LpujpxbeJif6xirfoS8f:x2jlB13LXfK1mpjedMZvQ+9pJewf6xu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701248948, "uuid": "6d084319-a132-4061-9141-d952e0655e07", "value": 365460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701248948, "uuid": "55436a6c-ff45-4d52-ac2d-b20c4c4ae999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701248948, "uuid": "031764a1-45f8-46fd-9643-d56565907e7e", "value": "SOA 291123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e765d6e9-8e82-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701240337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240337, "uuid": "7defb2da-7e7d-4b24-99d7-41bd6efdc83d", "comment": "Malware payload (RiseProStealer)", "value": "5d5aab234367c4952264beb5299f671f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240337, "uuid": "2225c856-4c52-4592-9c83-3c4ee148a368", "comment": "Malware payload (RiseProStealer)", "value": "f35c7db785fa56d49119b88165f5eb98c9841abff46d59a32694f4d318d2cdb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240337, "uuid": "72b20998-6758-4d39-8c07-4631324455f1", "comment": "Malware payload (RiseProStealer)", "value": "e295eac92937f9bf5e9fcac18134bc63990ff5ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240337, "uuid": "00c64572-1d4a-4ba9-889f-8c38c3f9d320", "comment": "Malware payload (RiseProStealer)", "value": "ef532170cd9fcf88eec7511be9b927d2ca101ba96f0d146fed61b798e74b050360c197b7ae4f4cb15ad1212ef6d65b90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240337, "uuid": "37d9b34a-49c7-4e9c-b0b3-8fbda3d32e2b", "value": "T1649523466BEC8035D2786B318CB757631831FC83EAB0D7631645AA9E1C33A45F97236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240337, "uuid": "1be03950-0830-4089-8c3e-25b590a6d08b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240337, "uuid": "bcc317e0-321f-4134-846c-335d7be3678b", "value": "49152:wLi6UqJgl040+m9iCSRvC07hv80O3E73yVH:ai61Jgmy/hyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701240337, "uuid": "35863223-8852-42cb-bb08-473e924710c4", "value": 2022912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701240337, "uuid": "7e109418-57a7-4c27-a2b9-b5576141d843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240337, "uuid": "ee7e0ab7-4044-4d44-a139-707688c26e3e", "value": "5d5aab234367c4952264beb5299f671f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995b1197-8ef1-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701287880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287880, "uuid": "3a3efa86-f913-49ff-8d52-0ef904bbecf7", "comment": "Malware payload (Smoke Loader)", "value": "ca1539411d3f54369288fb823519aad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287880, "uuid": "f18f4a33-7cd1-4cdf-b513-173988ef6c2a", "comment": "Malware payload (Smoke Loader)", "value": "f43cd9aed1b8fa7202418b692c3e0713bbee1ee181bcad36e7382276c79dca47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287880, "uuid": "162467dc-cdf6-4212-9b7a-a011a0a08fec", "comment": "Malware payload (Smoke Loader)", "value": "20f39a08a9c13afedae534414a67dba964a97e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701287880, "uuid": "8060299f-fb92-445b-b3a2-8d4096646f38", "comment": "Malware payload (Smoke Loader)", "value": "df5a8203e2f3b2612111198d7ce9c1c5f94e6a01557b1d5b73ebbf3df03a6b30f697767d3b27906feaf1ca8ebcc57937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287880, "uuid": "529b699d-b3f6-440a-81a8-c8c2758c92ee", "value": "T19A34CF2177F1C032E12755354961C6A55B37BCE2AB358ACF27A42B7E4E322D18BB9307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287880, "uuid": "6288f229-d689-4087-a569-43c4fb3044fb", "value": "eebe007c35cdacb43a780348e45aefac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287880, "uuid": "ee2083ea-1cfd-4655-82c9-39994403a622", "value": "3072:8ws32AFSRN2e78HS4Dq/SMPI0sXKdXIFtNfZ/1UKSoEhTQC5D+fHpa:JsNSWEuS4Dq/B9sXEIFvfZ3fEh8kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701287880, "uuid": "47c9bed3-3746-4879-a92d-fea618049a0d", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701287880, "uuid": "c48b3fb5-92d3-4f2a-808c-6eb69b862577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701287880, "uuid": "9f8c9866-69fb-44bb-8ffb-22f1cbb95655", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f1f1b4-8ec7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701269921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269921, "uuid": "f66e8a0f-1c5d-4e8a-a947-766b7726af9e", "comment": "Malware payload (RedLineStealer)", "value": "bee39fddb4282cb25cd1da67b9553024", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269921, "uuid": "f2eef892-53f7-4310-b9d6-e092c4d0ac38", "comment": "Malware payload (RedLineStealer)", "value": "f4d7a9daea3ede7da995c3bc9e993b3b7e1b75c61e73858de9820ae1892af3d6", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269921, "uuid": "058ec5be-a456-4d58-a613-305d154faf7a", "comment": "Malware payload (RedLineStealer)", "value": "0c408f565b60009f8a99271208e7e1f3e8276fc4", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701269921, "uuid": "8fd33b33-9f7f-4906-af41-59e78d0bd0dc", "comment": "Malware payload (RedLineStealer)", "value": "849c2bf447f7b45a2a10e4c784865a181cb7d03cca22d564661f4858cd20c440304600d82e1332eee8edc70a132ff59f", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269921, "uuid": "4aaa3ce1-eda3-451a-aa13-4f85d1ee4c29", "value": "T12195CF217686C437C97E01302A2ADBAB567DBD604B7244DBB3C83E6E2E705C15336E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269921, "uuid": "aa5797e4-60af-4279-a359-ebc1755fe15c", "value": "49152:1VkldbW8zBQSc0ZnSK/uxtZCZKumZrPCDmon/6n:mo0ZnPux4KDCBn/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701269921, "uuid": "e2d7028f-5550-42c6-a80e-41a8e8c0d015", "value": 1982976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701269921, "uuid": "839c8b5c-10b9-4499-9deb-b3b32182aa17", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701269921, "uuid": "a0739f02-739b-422f-9aea-c147ed510e07", "value": "Cheat Lab 2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43bf00e-8ed0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701273779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701273779, "uuid": "4994af1e-735c-4032-9960-5644680b7fdb", "comment": "Malware payload", "value": "7db4c8e9380f295dae6f47acb99065e1", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxKeylogger", "colour": "#14EA65", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701273779, "uuid": "495d4e85-a318-4e1f-bd9c-58acbde9ccd6", "comment": "Malware payload", "value": "f51d58557cfa1d62f1370d36aa055427cb20c623da9c9efe4fd0a2c375293e7d", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxKeylogger", "colour": "#14EA65", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701273779, "uuid": "4e804a5f-2d12-4a8b-a5b6-c683ddda4edd", "comment": "Malware payload", "value": "6db91e19eb289456fde23602c153294054c72c1b", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxKeylogger", "colour": "#14EA65", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701273779, "uuid": "e58b4ebb-049d-4b91-89b1-96f9a588db84", "comment": "Malware payload", "value": "7b0ba4bec3709d45e4b1930ae86cfedf907fa13244684551ebfbe901ac6959b2cb9feac78d7262ff1523a7b304139a5b", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxKeylogger", "colour": "#14EA65", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701273779, "uuid": "3a988a5a-664b-4836-9a0f-510cb2a0bff6", "value": "T1C211DDF66B5E5012C9B6CB411D9BA25ECF6081A258C00B10B8FD4E71DF39122A35EBCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701273779, "uuid": "3d32f056-f8c7-4f2c-b15a-cffe6ab38bb2", "value": "24:DOVtyCi8rf2sFTxnswvpdPNuR71q2z8JAh/:DOVtyCi4+sFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701273779, "uuid": "075dbf98-1ef5-46a9-ace4-6537e57e0d66", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701273779, "uuid": "5b9947b7-2502-40c7-a06b-deb8bdac0fed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701273779, "uuid": "fe508d73-4df3-4d02-b0dd-f0d1cc760190", "value": "awZnTKHp.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975389d3-8e83-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701240632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240632, "uuid": "482d494b-a1f6-47f6-866d-152f11989f27", "comment": "Malware payload (RiseProStealer)", "value": "e2ccabc7f34bd9d5004a1567cb5479b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240632, "uuid": "95dcb1c6-36ed-4ee7-94ef-217aedbe2844", "comment": "Malware payload (RiseProStealer)", "value": "f87d53c27725ade58b2717a2bcf96a76ca0efec6d5ebc08a3b335fe4d388d5c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240632, "uuid": "87810690-fd57-47d7-9af3-47066da89177", "comment": "Malware payload (RiseProStealer)", "value": "c59f192207496aafe788d5a726489e5bc3c44c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701240632, "uuid": "c502fa70-fa05-4c10-a99f-5a4dd730353a", "comment": "Malware payload (RiseProStealer)", "value": "f6fc42fdd83e827ff2c15db3a45b39fd19342cbe5b88cf2759960cff3a0fc71ca44baa6e32091576317c7ee34646304c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240632, "uuid": "58e74d3c-f744-4967-a4cc-4242c9da00f0", "value": "T15395335293C98013DA7427B148F757530A3B7CE4BDB4A2AB1329ED4E1C22A85F5B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240632, "uuid": "bd713a31-006b-424c-9a65-7833f918ddd9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240632, "uuid": "ffb2da91-a170-4966-826e-fddf089ebf91", "value": "49152:UOeUrAgm+tlWEtb05Eov4MasTEmBVB7tbhzHfz:RPrAgzS971td7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701240632, "uuid": "00e39cd0-ad3f-434c-aa8a-a6cdddba533f", "value": 2024960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701240632, "uuid": "7a6ccf7b-de52-4525-89af-0ebb700810c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701240632, "uuid": "35532715-9d6e-498b-afea-4af95ae79263", "value": "e2ccabc7f34bd9d5004a1567cb5479b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566064ff-8ede-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701279607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279607, "uuid": "644aa85e-7c50-4dc5-b1e4-25e2507aa467", "comment": "Malware payload", "value": "f0345e0f87ada884a0e2f88b1089af8e", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279607, "uuid": "959e4355-0b23-4c1e-a9ad-19a9767fb49a", "comment": "Malware payload", "value": "f8986aefe6b254bd530ab4a3c72b3070b0447f58647fae0ec83a33074b8167df", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279607, "uuid": "471a31d7-a385-4ded-8a5d-d8dec8cbebde", "comment": "Malware payload", "value": "63ad47e403bace305575dd2bef8e400aa2ab0a27", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701279607, "uuid": "735ef983-e487-47ab-bdee-33b035fbdb1d", "comment": "Malware payload", "value": "331c07bcb58cf113309d146a8e4f49316fc38c32df3379574a43163c9d2a8e1e46917a5d64385a36e41813691ff9fc3f", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279607, "uuid": "dbf6231e-ba64-40c6-8ce4-5d350a7bb9d3", "value": "T1C1A4121AF59B9E1FCC931434D88A75D5E26C6C791F04E38F31C1734B0A72AA2436BB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279607, "uuid": "4deb6bf6-04e4-403a-bc0d-a642c12e85ba", "value": "12288:BaJOeAIni5XgZTt2FlLKp5s367mXwirs:AOeAIuwL2ze2qZss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701279607, "uuid": "e151e883-8f01-434e-9c5d-17036f4c6c57", "value": 467973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701279607, "uuid": "b74bfbc8-53e7-426d-a729-856e43a67c97", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701279607, "uuid": "fe08bcd8-84d6-4bea-a86a-4b34b73af917", "value": "f0345e0f87ada884a0e2f88b1089af8e_h_boleto bancario.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243b380a-8e6e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701231420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231420, "uuid": "bf09afcf-af41-47c5-b981-d837eecc5b7b", "comment": "Malware payload (Formbook)", "value": "fbc73a73884b22f27716879f3163991a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231420, "uuid": "f8465729-7abc-46ae-b56d-f4931e66548b", "comment": "Malware payload (Formbook)", "value": "f925810c89fa8a74336dd667fd0b57e3caf827a0976647a20d655351252b91cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231420, "uuid": "86940db9-02c2-4ee6-9b65-3ac311103f83", "comment": "Malware payload (Formbook)", "value": "05e4515f67aed1fbd774c6ad5d2cbfcd94a2e4ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701231420, "uuid": "a6aebb0c-a641-490d-a223-81d325cfce80", "comment": "Malware payload (Formbook)", "value": "32a53ab2a40eeabe4506ee07cdb3fea66da06716b4e5956eee5d7df8526739713319d7a7b684c37d881f9b54d551b375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231420, "uuid": "37e4d3e2-b6fa-45d7-b0f0-162ea7e3ded5", "value": "T1C7E4124D62CCC25AEC785BBA5879C8B2E332BE16243AE74F2AE11DD77A673404540F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231420, "uuid": "918e0c3c-84b7-438b-bd05-6d3dfda689df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231420, "uuid": "769210cd-2c5b-4a90-934b-1c98fdcc78ac", "value": "12288:g9copox4t0ILzyd6n5wlMkGZ5jyuMvlfKTHVha6M9Xs38Ecy7LozBOo5:jeh0Do5wiP3uBJ8S9Wt+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701231420, "uuid": "f7a415fa-63bf-4237-b9ff-3f70ab36e332", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701231420, "uuid": "50505305-2633-4b9f-86b6-0d909c5e4879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701231420, "uuid": "dcebe490-4bcc-4473-8b2d-d1dece264eb1", "value": "SecuriteInfo.com.Win32.PWSX-gen.25302.2989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795468c0-8edc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701278807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278807, "uuid": "6b49fc71-d375-4f03-9551-e70940af2945", "comment": "Malware payload (AgentTesla)", "value": "642ee11e59a08b3af91ce06cb6134c2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278807, "uuid": "cb2ee0fa-79db-4d54-96bc-89bcc6fcace0", "comment": "Malware payload (AgentTesla)", "value": "fa5195110ab813fd692abb50ffa507844863ff858d22492133632551aedf1121", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278807, "uuid": "5e6a65da-6add-4355-bf3b-330745c68eb4", "comment": "Malware payload (AgentTesla)", "value": "6bb4f5181bfb7935c71a37f5dd87e7dd38b0536b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278807, "uuid": "d7a4053a-bd82-4c66-a0bb-9e136a65efd1", "comment": "Malware payload (AgentTesla)", "value": "f53cdc41fb332ad019a4a70200e1a7b1ce40e8097888ff99b404aa57c3dd35d036e92d6d0811d3d425445ce3c766e1fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278807, "uuid": "83dbe898-f37a-475c-a402-a16ebe213720", "value": "T185E41205B9787F66E87A53F62A64244483F4E57F3231F7AA5C9130DA0AB1F484781F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278807, "uuid": "a09c65da-fe6f-4649-ac2e-2f35cb27ad10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278807, "uuid": "9f03a4ba-420b-4556-b8c4-252ef8ca526b", "value": "12288:lxysXIYZ/dxQsvHUQg9GpEw/xJ+BsfAjitORopox:Pys42LvHU/9GpEYxJVUitKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701278807, "uuid": "db1c5a72-161c-4f63-93e7-384d975150ab", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701278807, "uuid": "425934fa-297f-42f2-9fd2-525caa6ec1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278807, "uuid": "3182ac59-3a29-499b-abde-f4b210d67bd6", "value": "SecuriteInfo.com.Win32.CrypterX-gen.29115.25797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0cdc7a-8edb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701278327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278327, "uuid": "d2c92997-ae24-4de8-bc68-389ce84c0f34", "comment": "Malware payload (AgentTesla)", "value": "ff1eb59fead63e9e085cc141cfe2ea05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278327, "uuid": "15de9bf6-b46f-41e5-86ba-3cb3d7747e2a", "comment": "Malware payload (AgentTesla)", "value": "fa9768671a5cf88a6140c7dc6a4a23e428707e903640e66d7eab3fa7e0ba52e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278327, "uuid": "a23f4fe5-3e77-4397-a348-dc906e93709f", "comment": "Malware payload (AgentTesla)", "value": "f367f16f00b643194270fae417603025fd720a4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701278327, "uuid": "bc045e8b-8dbc-431c-a069-5979d9736513", "comment": "Malware payload (AgentTesla)", "value": "49cb9ba5caf1e7d840bcf4ec713fe493825d303f7503d6f7b30d42b3065a5ab94ba9778b9a686ad7f085066b0278a5f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278327, "uuid": "a75a9adb-0ea3-4bbb-9e82-4a03c200511c", "value": "T1D5257C9CF540759ECC16CA329975CC3096223CBA573AD10E54DB3DAB7BBE6D38A110A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278327, "uuid": "8fcd4312-73ac-47c5-b38f-b006d53be093", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278327, "uuid": "15a21a38-59a2-4f01-aa13-1117efd1a458", "value": "12288:DsJ28iaLMu8KCzKXB/wqKFtAEJaGyrP11UFWopoxpgn2IyFqpXWr0EeS7J/P7r9O:D+2vaLP8v+lhj1UYei1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701278327, "uuid": "90a2331f-1e42-4181-91e1-825518ceb498", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701278327, "uuid": "b6965f5f-cd69-45d3-9564-44232beeeac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701278327, "uuid": "2387dcfe-1240-4725-81f0-447e58912e59", "value": "Proforma Invoice - Well Ergon 16-09-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cccc58b-8ef8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701290704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290704, "uuid": "d124e03d-462f-42b2-969c-43af0fac362f", "comment": "Malware payload", "value": "78585de9790ca443167688caa24c4cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290704, "uuid": "fe18f8d7-1b88-42c3-89ff-553bb99e7fba", "comment": "Malware payload", "value": "fabea9a712e2a0ecb7c652950ff743c8d3c937fb3e24ad6c286f2c5cf6c00a45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290704, "uuid": "6e0ef580-56ff-4034-ba16-17a0acbea68b", "comment": "Malware payload", "value": "2c3aee90b8ec28466bf58d8a7ad3c0ea2cc350d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290704, "uuid": "57f4ab7f-82d8-43e0-882d-699f329b419b", "comment": "Malware payload", "value": "1c002562123531edcbed1363ee50b10d8b88c9e98f2f15b9fa6919064ab9791d48adefcff654c42aeb38270f87348498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290704, "uuid": "65f30629-7cd4-436f-b88a-581a3c12cc50", "value": "T19AB4021AF6E95B9BFE3AD7F8192481008BB5BD2B513AD3081DC172CA42B8B504F61F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290704, "uuid": "37645389-b292-47ee-91c2-0ae86ae0b3a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290704, "uuid": "641c63af-a409-4d33-814b-c6f91ddc5c09", "value": "12288:gYp1E6jD/SRUNlgvGzwvZ9dbOOdUUyvRQopox9:Pp1tD/SRyTzwh7GUyJQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701290704, "uuid": "a98f2c93-12a8-4411-b0f2-2436baca5104", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701290704, "uuid": "dd62a40d-f75e-4075-a6a9-2d8d750f79dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290704, "uuid": "891d8f0f-26e5-42c5-abb6-4bc242c60408", "value": "damianozx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab6f8e7-8ee6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701283158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283158, "uuid": "5b18a5d5-c07b-4cbe-9794-3531a5e5d856", "comment": "Malware payload (Mirai)", "value": "7184bf9633a5cb599c646cd0a7058384", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283158, "uuid": "4751973c-9cc7-4169-94c4-d34d72b8afef", "comment": "Malware payload (Mirai)", "value": "fac6c75b683f0f097db434c8e4ba7279fd8a788d3230427b74ab0546b6015dcc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283158, "uuid": "ce8cee1b-63a5-4996-9aa8-f1d334d6da55", "comment": "Malware payload (Mirai)", "value": "fb72ca9f0301aefe1f11e6ebfdfb5b3129a1f3c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701283158, "uuid": "2447e72e-7a6f-49eb-ad67-46eeb5253b22", "comment": "Malware payload (Mirai)", "value": "efc2b73621137236bc8e2bb0a626e1c49bfdf3e91a4ca6ff2c4d2ce7fe023d6fb4d06bf5a0518cb8f6c3fd6049c9fe78", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283158, "uuid": "c56047c4-328f-4f46-b011-91e6f5191336", "value": "T15D936CC5F683D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA1511EA16B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283158, "uuid": "3c79c22a-ec18-4fb1-a6d9-df63f49b7ac7", "value": "1536:xpmWc2AcighsZ82fJxfc1Hv1mSsM8qioFgBQ9TnkISGtAdl0xZ:xpmX2riED2frfeHtmLFomQ9kVTl0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701283158, "uuid": "cda27570-4ffe-4a73-be34-7307050512ab", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701283158, "uuid": "22196666-1731-4c73-ac07-da8cd0459218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701283158, "uuid": "ca753c10-e8c8-4657-9db7-99e4c69aa1e8", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83770b2-8eea-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701284952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701284952, "uuid": "49689489-d0f5-44f7-8aa4-608dcc94d0a4", "comment": "Malware payload", "value": "5abd032f89ad0e91f14df06914f1a244", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordScreenGrabber", "colour": "#862461", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701284952, "uuid": "18a4115d-8322-4c73-8d61-5e2b6d3219e1", "comment": "Malware payload", "value": "fc380b51c8afffe99434c5bfb09f1aa60b8ff84d8f4740166f610556f665ecaf", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordScreenGrabber", "colour": "#862461", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701284952, "uuid": "f0925faf-41c3-430b-9a68-effe4d38c81c", "comment": "Malware payload", "value": "db1346fde254cfead22208bac7e7de68e1ab16e8", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordScreenGrabber", "colour": "#862461", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701284952, "uuid": "f144e3fb-5781-4489-8843-70983ae76487", "comment": "Malware payload", "value": "c7591c6cfd38e27d44cb39a11652e128c14c842f38d84eb81c210cf0d28103ffa5238431baf3e3de1f69a979172df4d0", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordScreenGrabber", "colour": "#862461", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701284952, "uuid": "0e5cd256-f933-4420-a0ab-b6dd137c13db", "value": "T1044194F2F327C1C04476A27BEDA7E089EE7C806D016115097ADCCC9AE7B1A606275F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701284952, "uuid": "0a345837-cf58-4099-ac41-8c8d5db7029b", "value": "48:8c2NDfr1Vje11Z9IYb19Z/cPFFpgfqpg4:8tLrLGZB191C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701284952, "uuid": "2ee0200c-b34a-4d07-9dcd-d163b2df5a5d", "value": 1952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701284952, "uuid": "8c0dcf0f-3591-4da6-8b31-06b69766b5d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701284952, "uuid": "b13b33f0-fd93-4629-b180-755a2fab7b2d", "value": "631Hnn5S.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8cbb91-8e4a-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701216319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701216319, "uuid": "ee6d8c90-6ccd-400c-991b-5d96537fdcd2", "comment": "Malware payload (RiseProStealer)", "value": "72936ad6f165dbe005f25dc11fcb2f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701216319, "uuid": "944a3ee8-d24e-4888-93bf-5899cb75f682", "comment": "Malware payload (RiseProStealer)", "value": "fd13cdd897c6f627ad8b02ef425687b81109a71eccd213a989744b15d70547e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701216319, "uuid": "18e4dcc7-f598-4a46-abf8-57a954a9cb9e", "comment": "Malware payload (RiseProStealer)", "value": "e2b083cf1f0ed2dfee78a904bcaa98e31d73a03c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701216319, "uuid": "1911e376-96e1-43ed-913f-65959cb7199d", "comment": "Malware payload (RiseProStealer)", "value": "be66b74a42566a5ee184db8577cb747a103ac35a2553bd44c67d8e7434ec2f4ddd832e9a012747602ace12ec61358e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701216319, "uuid": "2b992160-bfa1-4691-8892-049b8f8239d7", "value": "T1B695335293E9C063FAF41F758CFB2B630F3D7841B9B097572669ED4A182624064B633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701216319, "uuid": "434e0784-b245-483a-9344-540e9b79035b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701216319, "uuid": "611c280f-913f-4a22-a20a-fde06f9d129a", "value": "49152:ZQDOSmC3LZYKuS0NBMzvIZw9XblXKDZftQIlZmlUi2Xdne:eqSmCt76cbwRFA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701216319, "uuid": "62da766d-c4da-430c-9593-e95fed105c47", "value": 2025472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701216319, "uuid": "8c7a09b6-a0b4-49bf-879a-24050743e87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701216319, "uuid": "d973d0e0-a625-4ac4-8946-e524d756e084", "value": "72936ad6f165dbe005f25dc11fcb2f62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6d7ccc-8ef7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701290622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290622, "uuid": "2f8762a4-c9d7-4ea6-bc51-2f2084a71e2a", "comment": "Malware payload", "value": "98048f5907446140e7d1b6fb58f7e382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290622, "uuid": "1148ebbf-31f8-4454-9f9a-56131d7dca21", "comment": "Malware payload", "value": "fe0c6bc87d80b9d24ef9f02af571c74eeb77e94f3bbe99071beb6a669e226d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290622, "uuid": "f033164e-e766-4b8b-9952-7684262c507c", "comment": "Malware payload", "value": "449eccc04b169ee5199a9ffdce0edfb15adc78c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701290622, "uuid": "d3a65421-91cd-43f7-81bc-8f4fdf5d1581", "comment": "Malware payload", "value": "d91b106fd86299ec2dd801d9b1df1779e3684c1b5d6aa5d5b9b127281c0d9edc3556909512b0df60680d4e22b820fd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290622, "uuid": "637e8085-3e86-41ac-9591-37d9e700558c", "value": "T144857C14A29A60F7FAB619751B80B116AD26DB1DCF25C9456F03C8208A0C7C7663FEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290622, "uuid": "d304657f-c30f-433c-bd08-f8f01bf06bf0", "value": "becb59d6c2cabee1a77fe54131d4eacf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290622, "uuid": "7dfd4931-2f7d-4a50-a3a7-ff14c525986c", "value": "24576:ffNf2KiB2UyAiHrRIKZCjC60N5prvEisnitBTofUSP2/5aSWscUC:ff3lEisn8TofHPOWsrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701290622, "uuid": "54cc65e6-8d0a-419e-87f5-5e8c977f3566", "value": 1726240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701290622, "uuid": "33115be5-f8c3-4d4d-b0e2-91d87341dded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701290622, "uuid": "86528cc3-f0d9-455d-813f-c23e8ca97d79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60128c9-8e86-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701242053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242053, "uuid": "6cf5a891-1499-4131-91ef-d41bdfee76fb", "comment": "Malware payload (RedLineStealer)", "value": "4f00d694480aecbb90dbb0761d6050de", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242053, "uuid": "8900c0ec-1775-4a15-99ba-53f6e7fe8afa", "comment": "Malware payload (RedLineStealer)", "value": "fe18a134e7c28866c7e5d2004108faee79d83695a912fd0684f7abbfc84a765c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242053, "uuid": "73a2e5bc-a741-4bf6-80c3-99a882efa354", "comment": "Malware payload (RedLineStealer)", "value": "593becab35981f98f6adbb1f19a94a4ce7033402", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701242053, "uuid": "9314cccb-ec09-4196-a587-d9c7013d1dce", "comment": "Malware payload (RedLineStealer)", "value": "bbdef668070846463cd5ddb34ae8321c88201e6f28b3ec4165ff46e94d9564c2a5f9e94dff83d4f835bb58252ce8212f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242053, "uuid": "75d45d13-6ba1-43f9-95fe-78e19be7951f", "value": "T155459E2074D46172DDE211B6C3ACB626896CD0A00F6645DF1FE816EECB6ADC16A31FF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242053, "uuid": "7cc62526-80d1-4d9e-aa76-a0cfc0eeae69", "value": "9207da9a0ce5c03fd6793615b1132500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242053, "uuid": "d5428c18-9df9-4441-8d3b-b86eb84d1b89", "value": "12288:e279uMb+59OZCVN/ubHsA+VCiVchJJ5cjE0MYFupL8pjGHYh9Yp9bQCEfmK:eTMb+TOZCVNucoYchJkEAznE90CEOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701242053, "uuid": "a741c6db-bcad-4715-a1ce-0169c5d78015", "value": 1168672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701242053, "uuid": "59d071ca-ea95-444c-9291-352f624e6966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701242053, "uuid": "763a34a1-c498-4509-b364-43633d9747d4", "value": "CheatLab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dedb365-8ec9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701270681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270681, "uuid": "0410b238-faec-4fd3-80a7-6b84d01bf2ab", "comment": "Malware payload", "value": "f781a3dfae41e5f73decc69d6699d4ec", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270681, "uuid": "cb6b8a3b-4c7a-4c2b-9933-6e3aa4246165", "comment": "Malware payload", "value": "fe83cc673c2fbae46f583509f4a9e655fe3637d37c3b80bbf67ccf2b3babb417", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270681, "uuid": "8f19a594-3064-41e4-bb49-c378911cfd24", "comment": "Malware payload", "value": "a8ad891f878f6e73055012d46828f51d7579ecbd", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701270681, "uuid": "17d71e56-f507-4d32-aa64-c25548d94ac2", "comment": "Malware payload", "value": "49335e499c41e2e03b5c3411fe701229c69137d3b1948b9b826fa0a5efa2acef69d382e43fa828ce4f68e5a4aebc7df2", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270681, "uuid": "3536e39c-863e-4d9e-a919-d38000e8d0c2", "value": "T1F911DDB66B2E5012C9B1CB421C57529ECF6041A254C00B11F8FD4E61DF39126A35EBCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270681, "uuid": "25708f5d-0f15-424b-990f-fa97dc79f450", "value": "24:DOVtyCiWqxvMsFTxnswvpdPNuR71q2z8JAh/:DOVtyCiWcMsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701270681, "uuid": "99f59949-d8a9-4ef5-919f-d5eb5cf33ab1", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701270681, "uuid": "d67e332a-03e3-4197-a19b-30b8bd365a4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701270681, "uuid": "061043a5-e034-407c-b027-b09132c6fd13", "value": "0Z0TzyB1.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10b2b42-8e79-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701236434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236434, "uuid": "2e1f9bd4-8c5d-481a-892d-6f5d92a13f91", "comment": "Malware payload (LummaStealer)", "value": "86eec50e42883d4ce83358de84d80d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236434, "uuid": "5a971af7-c67c-4b6c-bcb3-5a0f1c86f8d1", "comment": "Malware payload (LummaStealer)", "value": "fef2fc3a0da4590f77853b39c6c28ac9406b1ca9e9636e085a1d7ed592c8bbfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236434, "uuid": "6d4767d6-c0a7-46fc-9f54-cfc3278a6a70", "comment": "Malware payload (LummaStealer)", "value": "18bad8570db593209da43cf023d11802610a2169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701236434, "uuid": "0e33ea66-da42-4a52-9b4e-f8a434e05422", "comment": "Malware payload (LummaStealer)", "value": "50aefdb6292ec5aaf539eec8f1154891486ac4e0dc4b2b3476811b334ac789b22f059975399a9cc3431c233aaee194ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236434, "uuid": "58701dba-9ff4-4e03-85b5-940655978cbf", "value": "T1C785235363DE8026C5B42BB08CF7428B2A7578E1F9F412579729E80D1C616A5B47333F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236434, "uuid": "31790d55-c94c-476b-a51c-4cac65af7138", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236434, "uuid": "0c088a1f-52fa-4c6e-9360-ebfcd5e1a2b6", "value": "49152:a512jMPf1abmLsuSvk7a1fvkXSryiswOw9:3ji1ab8AHr6wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701236434, "uuid": "e3b8fda1-bf95-4c4e-afc9-b54edd450d0f", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701236434, "uuid": "f2cacf96-6519-4e12-9412-8d261e92eedb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701236434, "uuid": "95c8aebc-2fd4-4787-9873-55ebdbd03173", "value": "86eec50e42883d4ce83358de84d80d74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba303ce-8eb0-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701260074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260074, "uuid": "88d8c7fb-5eba-480d-b361-a0d1d23c092b", "comment": "Malware payload (zgRAT)", "value": "d96ad0c55fdda0eedebc56b4a2f1d3b8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260074, "uuid": "953664da-cf28-4610-88f1-dd6aee43a7ae", "comment": "Malware payload (zgRAT)", "value": "ff0179442402fa306c85ba83a87df2cc46d13012a1e2819e73a6b3586c5c8dc3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260074, "uuid": "157286e1-4ef0-4fb5-ae6b-72f7f5fb41c0", "comment": "Malware payload (zgRAT)", "value": "303d26dc5282a9043bae52b52c8bac75e7ab3497", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701260074, "uuid": "9613982b-ebce-429f-bee1-81e1a875b482", "comment": "Malware payload (zgRAT)", "value": "48fa87a6d2ff7ec34a28b9acdc586d26fbb80269cb7704b5101e0e8f6ddae7f7654ee4d52ebba6791f0a482059a3a5e1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701260074, "uuid": "d269b1d2-135a-4c0b-8d39-4ba77c399ccf", "value": "T1D685D0C12796CAEBE78F2771E05414987BB5CE2ED153E36F5809A6B4EC83B28190507F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701260074, "uuid": "5251f13a-bcbb-4650-909b-36ce1afbcad1", "value": "49152:nMvAAAU8+ktQq00VyE25kP3+Pne0sP9+1jwWmFyZF:WhSzP83mFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701260074, "uuid": "4548a499-fee0-44d1-bb96-98c779c9fbb5", "value": 1734944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701260074, "uuid": "b601b8ea-7717-4783-a942-ed7eb126aab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701260074, "uuid": "c35234ac-d8d9-45f3-adf3-a32efa86dfb8", "value": "d96ad0c55fdda0eedebc56b4a2f1d3b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d64b733-8e4f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701218121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701218121, "uuid": "6e6f78de-516e-4d6e-9095-11b7af52b413", "comment": "Malware payload (LummaStealer)", "value": "291c0366d942eb3d80909db185188a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701218121, "uuid": "00b802c0-01da-4324-a886-0b49799a571f", "comment": "Malware payload (LummaStealer)", "value": "ff4061a3af41e6013be762c8a679ec9357b15cf3ba0641b16ec49c242315094d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701218121, "uuid": "65f0c397-f626-4604-bfef-f2a66d54f38b", "comment": "Malware payload (LummaStealer)", "value": "eb59540abc2e09bc6126222d818f6c500a3c601c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701218121, "uuid": "6cdbc822-20bb-4e29-a5e8-7a8a2f74ceeb", "comment": "Malware payload (LummaStealer)", "value": "bbcde620903fb3e01ed14443148cbd9db0be4661b651938d15cd081b4f120177101852092d5f1514d58d17d13362889c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701218121, "uuid": "87a05533-bf73-4db3-b5e0-1bc54faec00e", "value": "T1C003D08344796A18CA15BE36011188E2F6D5B394F6582101F7CC9CFBBF2E784E75BA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701218121, "uuid": "5bda4472-fd80-48a3-9fe4-f31c0557323d", "value": "768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701218121, "uuid": "227d1e72-9553-4b1c-bb5c-b18c91f36323", "value": 38931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701218121, "uuid": "0b8438be-1019-4642-ad79-2c49e5a0087b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701218121, "uuid": "d02b0b89-5c77-4808-915b-e8f2b7671dbe", "value": "291c0366d942eb3d80909db185188a95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5203aedd-8efb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701292055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701292055, "uuid": "465008e4-e0c5-4b37-9298-4cf1548fd8ee", "comment": "Malware payload", "value": "ae406d57867902cff8a9466a71e8a073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701292055, "uuid": "d5dec8a0-546d-49ff-9813-3d309c7e0072", "comment": "Malware payload", "value": "ff52b9c7360f437cc07d14b80cdb4588037fa57b233b2412fb60d0662843fb7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701292055, "uuid": "b6c2b3cd-b95b-421b-9c25-6760a902c1bd", "comment": "Malware payload", "value": "1d8eb9550d6bccb61a58cd478c29a508670338d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701292055, "uuid": "0adee8a7-2615-448b-8517-2469c4867de7", "comment": "Malware payload", "value": "9668de184be778bb51e748fe55b9fbf33786fbff2ba23e27ada13c64cae2524847c810ee2ee2b36512f2805b405b2c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701292055, "uuid": "eb8d2a62-0d98-4608-abea-0fb2d102c501", "value": "T172859D0F912D9C5ACB1F1577CAF4B91C3E6DE9136FD8882B2280FFDA89127806E53915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701292055, "uuid": "949d0119-e930-417d-89d0-972ad82128af", "value": "becb59d6c2cabee1a77fe54131d4eacf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701292055, "uuid": "218cdd85-644d-47d2-b688-3aa7a0e53456", "value": "24576:2fe8rj94y5D36yxnztsLTWf2JuBx1pd2NeZlB9XWls68jMXE6G56WLXobIo6VLHh:2f1Nf/tK6BVCpnI4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701292055, "uuid": "42aed430-77c7-4e9c-913c-063bc4001ecf", "value": 1726240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701292055, "uuid": "ae641b23-4d49-49a5-87d3-7f9dd44b3dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701292055, "uuid": "5dc8d322-f851-4f92-b995-b72898af0398", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }